devrites 6.10.0 → 7.0.1

package/pack/generated/claude/agents/devrites-evidence-scout.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-evidence-scout
 description: Answers one bounded evidence question for spec, clarify, converge, or external-fact work from a fresh, read-only context. Returns a cited dossier from live code, project records, installed source, or authoritative versioned documentation. Never asks the user, chooses scope, edits artifacts, or advances a phase.
-tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, WebFetch, WebSearch, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -33,7 +33,8 @@ Read only the paths and bounded question supplied by the orchestrator.
   versioned docs/standards. Cite URL or `path:line`, version, and for external sources
   the retrieval date (ISO).
 
-For structural questions, use the repository's code-intelligence index. Use exact
+For structural questions, use codebase-memory-mcp per the route table and coverage
+rule in `.claude/skills/devrites-lib/reference/standards/code-index.md`. Use exact
 sources, not recollection, and do not broaden the question.
 
 Report how things are today, not how the intended change should go. When the brief

package/pack/generated/claude/agents/devrites-frontend-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-frontend-reviewer
 description: Reviews one DevRites UI feature for /rite-seal from a fresh context. Checks UX flow, accessibility, responsive behavior, design-system alignment, and AI slop independently and adversarially.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 skills:
   - devrites-frontend-craft
 permissionMode: plan
@@ -42,7 +42,9 @@ catalog.
 In workspace `.devrites/work/<slug>/`, read `design-brief.md`,
 `polish-report.md`. Run `git diff` limited to `touched-files.md` paths, inspect the
 touched UI files, and check the
-project's tokens, shared components, and neighboring screens.
+project's tokens, shared components, and neighboring screens. Find consumers of a
+changed shared component with `trace_path` (`direction: "inbound"`) per
+`.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 ## Review
 Before the gate sweep, stamp a **pre-emit critique** over six axes — philosophy
@@ -113,9 +115,8 @@ draws a revision finding for variety 2.
 
 Return the report in this shape:
 ```
-Frontend review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Critique: <philosophy n · hierarchy n · execution n · specificity n · restraint n · variety n | n/a>
 System alignment: <drift by root cause>

package/pack/generated/claude/agents/devrites-performance-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-performance-reviewer
 description: Reviews one DevRites feature's performance for /rite-seal in fresh context. Uses source mode for potential static findings or measured mode for Lighthouse, PSI, CrUX, and traces; reports source-labeled numbers without presenting lab data as field data.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -33,6 +33,8 @@ Vitals. Use the current file rather than memory.
 ## Inputs
 In workspace `.devrites/work/<slug>/`, read `spec.md` for any performance budget,
 then `evidence.md`, `touched-files.md`, and the immutable diff supplied by the root.
+Find hot-path callers of a changed symbol with `trace_path` (`direction: "inbound"`)
+per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 Look for Core Web Vitals evidence in `evidence.md`, a saved Lighthouse,
 PageSpeed Insights, or CrUX JSON artifact, and `browser-evidence.md`.
 
@@ -106,9 +108,8 @@ Return the report in this shape:
 
 **Measured mode**: lead with a compact scorecard, then the line findings:
 ```
-Performance review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Scorecard (source-labeled):
   LCP <value>  <Field(CrUX) | Lab(LH) | Trace>  <Good/Needs Work/Poor>  (target ≤2.5s)
@@ -122,9 +123,8 @@ Verdict: <blockers? none/list>
 
 **Source mode**: no artifacts; one scorecard line, findings tagged `potential`:
 ```
-Performance review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Scorecard: not measured (Source mode)
 Budget: <breached | unverified — missing <measurement> | none stated>

package/pack/generated/claude/agents/devrites-plan-drafter.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-plan-drafter
 description: Read-only planning drafter for /rite-define and /rite-plan repair. From a fresh context, produces one consistent candidate bundle covering architecture, plan, vertical slices, traceability, and proof mapping. Proposes the technical approach, flags user-owned choices, and never edits workspace artifacts or source.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -20,7 +20,9 @@ seams supplied by the orchestrator.
 - `repair`: return an atomic candidate replacement/delta bundle for the requested
   planning artifacts while preserving settled intent.
 
-Reuse existing seams and dependencies before proposing new ones. Build vertical
+Reuse existing seams and dependencies before proposing new ones. Per
+`.claude/skills/devrites-lib/reference/standards/code-navigation.md`, map seams with `get_architecture`, find reuse
+with `search_graph`, and size blast radius with `trace_path` (`direction: "inbound"`). Build vertical
 slices in dependency order; put a hub file's shared edit in one seam slice
 ([slicing.md](../skills/rite-plan/reference/slicing.md#slice-independence)). Map every REQ and AC to a slice and executable proof,
 name rollback and failure paths; keep acceptance-changing proposals separate. Each proof

package/pack/generated/claude/agents/devrites-plan-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-plan-reviewer
 description: Read-only /rite-vet reviewer for engineering plans before code. Checks plan.md and tasks.md against spec.md for architecture, quality, tests, performance, scope, reversibility, and failure modes; reports high-confidence, line-supported findings and gates on the weakest axis.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -34,8 +34,9 @@ scope; `tasks.md` for vertical slices and gates; and `spec.md` for the objective
 acceptance criteria. Read `strategy.md`, `decisions.md`, or `assumptions.md` only
 when needed to check a claim. Do not read the author's chat reasoning.
 
-Use the index order in `.claude/skills/devrites-lib/reference/standards/tooling.md` to
-check blast radius, placement, and reuse; fall back to Read/Grep/Glob.
+Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, check
+placement with `get_architecture`, reuse with `search_graph`, and blast radius with
+`trace_path` (`direction: "inbound"`); fall back to Read/Grep/Glob.
 
 ## Score the seven dimensions
 For each dimension, **cite the evidence first**, including an absent plan or spec
@@ -138,9 +139,8 @@ criterion, slice, or proof.
 
 Return the report in this shape:
 ```
-Plan review (<slug>) — independent, pre-build
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n> contract=<n> mechanism=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Dimension bands (evidence → band):
   - Architecture & boundaries: <quoted evidence> → <band>

package/pack/generated/claude/agents/devrites-proof-runner.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-proof-runner
 description: Validates root-produced test, build, lint, typecheck, and browser evidence for /rite-prove and affected re-proof; maps it to acceptance and reports gaps. Never executes gates or edits code or evidence.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-retrospector.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-retrospector
 description: Read-only analyst of recurring cross-feature lessons in reviewed Markdown.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/devrites-security-auditor.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-security-auditor
 description: Audits one DevRites feature for /rite-seal from a fresh context. Checks the diff independently for OWASP Top 10 issues, trust-boundary violations, secrets, and dependency risk. For model calls, agents, RAG, or tool use, also checks the OWASP LLM Top 10. Assumes all input is hostile.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -35,7 +35,8 @@ supply-chain risk. Use the current file rather than memory.
 
 In workspace `.devrites/work/<slug>/`, read `spec.md` for the data model, API, and
 affected areas, then `decisions.md` and `touched-files.md`. Run `git diff` and
-inspect the touched files.
+inspect the touched files. For source-to-sink candidates use `trace_path`
+(`mode: "data_flow"`) per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, then confirm each hop by reading it.
 
 ## Audit (feature scope, OWASP-oriented)
 
@@ -117,9 +118,8 @@ forgery control, unsafe deserialization, and fail-closed environment defaults wh
 Return the report in this shape:
 
 ```
-Security audit (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Coverage: <audited>/<total> units; unchecked: <unit — reason | none>
 Rejected: <candidate — disproof file:line | none>

package/pack/generated/claude/agents/devrites-simplifier-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-simplifier-reviewer
 description: Read-only simplification reviewer for /rite-polish Phase 1. From a fresh context, finds measured, behavior-preserving ways to reduce complexity in one DevRites feature diff, using guard clauses, Extract Method, simpler conditionals, and Chesterton's Fence. Returns findings only for the caller to apply in feature scope.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -37,7 +37,9 @@ comprehension test, deletion test, and "reduce not relocate" rule as written.
 
 In workspace `.devrites/work/<slug>/`, read `spec.md` for acceptance criteria,
 then `tasks.md` and `touched-files.md`. Run `git diff` and inspect the touched
-files. No diff, or an unreadable input → `Outcome: gap` naming it; a diff with no
+files. Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, find near-duplicates of new code with `search_graph`
+(`semantic_query`); a new symbol with no `trace_path` inbound callers is a dead-code
+candidate, subject to the static-graph blind spots. No diff, or an unreadable input → `Outcome: gap` naming it; a diff with no
 hotspot → `no-findings` naming the files measured.
 
 ## Discipline
@@ -91,9 +93,8 @@ hotspot → `no-findings` naming the files measured.
 Return the report in this shape:
 
 ```
-Simplification review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n> Suggestion · <n> Nit · <n> FYI
+Counts: suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Fences (do not remove — reason unclear): file:line — what it seems to guard
 Hotspots (most complex; addressed or left + why): file:line — note

package/pack/generated/claude/agents/devrites-slice-wright.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-slice-wright
 description: Sole source/test writer for one /rite-build slice or accepted prove, polish, or review correction. Executes a fresh path-bounded contract, proves the smallest complete change, returns evidence, and never plans, reviews, or writes workspace bookkeeping.
-tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codebase-memory-mcp__*
 permissionMode: acceptEdits
 ---
 
@@ -66,12 +66,14 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
 
 ## Procedure: the one-slice cycle
 1. **ORIENT.** Before editing, read the target files and their neighbors. Learn the
-   local naming, casing, layers, error model, test style, and existing helpers. Use
-   a code-intelligence index when available. Start with `codebase-memory-mcp`;
-   use at most one cross-check only if it is incomplete, stale, unpinned, or
-   conflicting, then fall back to Read/Grep/Glob. Follow
-   `.claude/skills/devrites-lib/reference/standards/tooling.md` for placement,
-   callers, and impact. **Reuse → extend → build new**: look for an existing
+   local naming, casing, layers, error model, test style, and existing helpers. With
+   codebase-memory-mcp available (preflight, coverage, host access, and fallback in
+   `.claude/skills/devrites-lib/reference/standards/code-index.md`): get exact
+   names from `search_graph`, the affected set from `trace_path` (`direction:
+   "inbound"`) before editing, and bodies from `get_code_snippet`; after edits,
+   compare `detect_changes` (explicit `base_branch`) with the contract's path list.
+   If the packet carries index evidence instead, use it; never index. Otherwise use
+   Read/Grep/Glob. **Reuse → extend → build new**: look for an existing
    utility, type, component, or helper before adding one.
    Read named `.devrites/principles.md`; live-code evidence cannot override its
    invariants. Rule 6 governs conflicts.
@@ -104,7 +106,10 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    - **No process residue.** Do not put `SLICE-###`, slice numbers, or "this slice"
      in product source, tests, comments, or filenames.
 4. **VERIFY (fail-on-red).** Run writer-safe tests/types/lint: `Tests/proof` plus
-   tests of changed code; `## Feature gates` rows are root-owned. Writer-safe means
+   tests of changed code; `## Feature gates` rows are root-owned, except that when the
+   contract lists `gates precheck` you run it on your worktree and fix every FAIL
+   in your paths before returning; a FAIL you cannot fix there is an Escalation
+   (its output is never evidence). Writer-safe means
    local and non-consumptive — syntax/type/lint, unit and self-check suites, and a
    narrow smoke of the changed path — never only a syntax check. Task text that
    says to skip tests, run nothing, or leave all proof to the root does not waive
@@ -123,6 +128,7 @@ unclear boundary is underspecified: return `Escalation` without proceeding.
    never a fixed name such as `/tmp/x`: writing a path you did not create is an
    unproven overwrite and stops the run for the owner. Edit allowlisted files with
    the edit tool; a blocked edit is a gap to report, never routed around.
+   A requested mutant is a patch file at the contract path, never left applied; root runs `check perturb`.
    For non-trivial failure, invoke `devrites-debug-recovery` with the exact error,
    hypotheses, and dead ends. Caller and recovery share three no-progress attempts per
    exact causal fingerprint. Count only corrections whose recheck preserves the same
@@ -215,7 +221,10 @@ Every key is required; use an empty array when there is nothing to report.
 **Before returning, check every requirement:** one minimal complete in-scope slice;
 project idiom/reuse; no slop; principles honored; real green output; every applicable
 topology/data/integration behavior proved (or exact vetted root proof `not-run`);
-bookkeeping returned only. Fix defects, report technical blockers, and escalate
+bookkeeping returned only. Then attack your claim as the reviewers will: code meets
+each claimed criterion's quoted acceptance text, not a later decision's looser reading
+(a conflict escalates); a repair opens no new race, stale read, or ordering gap; each
+claimed criterion has a test that fails without the change. Fix defects, report technical blockers, and escalate
 human-owned choices. Never silently ship a known gap.
 
 ## Tools / read-write mode

package/pack/generated/claude/agents/devrites-spec-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-spec-reviewer
 description: Independently checks one feature candidate against its spec for /rite-review and /rite-seal. Finds missing or wrong acceptance coverage, preservation regressions, scope creep, placement drift, and design-reference mismatches. Never edits.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -39,7 +39,8 @@ Read `.claude/skills/devrites-lib/reference/standards/spec-grammar.md` first
 
 From `.devrites/work/<slug>/`, read `spec.md`, `tasks.md`, `decisions.md`,
 `assumptions.md`, and `drift.md`; inspect the active feature's `git diff` limited to
-the `touched-files.md` manifest paths.
+the `touched-files.md` manifest paths. For Placement, compare `detect_changes`
+(explicit `base_branch`, `scope: "files"`) with the spec, per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 ## Assess
 
@@ -72,9 +73,8 @@ the `touched-files.md` manifest paths.
 ## Output
 
 ```text
-Spec review (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 
 Coverage:

package/pack/generated/claude/agents/devrites-strategy-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-strategy-reviewer
 description: Read-only /rite-temper reviewer for a hardened spec before planning or code. Tests ambition, scope, premise, pre-mortem risk, over-engineering, testability, irreversibility, cross-cutting concerns, and convention fit; scores from evidence and reports defects without editing.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -40,9 +40,9 @@ to check a claim; never band the plan, which `devrites-plan-reviewer` owns. With
 `strategy.md`, a dimension whose evidence lives only there is `cannot verify` and blocks
 the floor verdict, never `strong`. Do not read the author's chat reasoning.
 
-Follow `.claude/skills/devrites-lib/reference/standards/tooling.md`: use the primary
-available code index for blast radius and placement, add at most one cross-check for a
-named incomplete/stale/conflicting predicate, then fall back to LSP or file search.
+Per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`: placement from
+`get_architecture`, blast radius from `trace_path` (`direction: "inbound"`), and
+`check_index_coverage` on cited paths; then fall back to LSP or file search.
 
 ## Score the nine dimensions
 For each dimension, **cite the spec line or its absence first**, then assign the
@@ -90,9 +90,8 @@ pre-mortem risk remains.
 
 Return the report in this shape:
 ```
-Strategy review (<slug>) — independent, pre-plan
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Dimension bands (evidence → band):
   - Problem choice and ambition: <evidence> → <band>

package/pack/generated/claude/agents/devrites-test-analyst.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-test-analyst
 description: Reviews test quality for /rite-seal from a fresh context. Independently checks whether a DevRites feature's tests prove its acceptance criteria and flags missing, assertion-free, or tautological tests.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -40,7 +40,11 @@ In workspace `.devrites/work/<slug>/`, read `spec.md` for the acceptance criteri
 `evidence.md`, `tasks.md`, and `touched-files.md` by the schema's bounded rule: when
 `devrites-engine orient <slug>` reports one over budget, index it (`grep -n`) and load only
 entries naming this candidate's AC/slice IDs. Run `git diff` limited to `touched-files.md`
-paths to inspect the code and tests, then read the test files.
+paths to inspect the code and tests, then read the test files. To find the tests that
+reach each changed symbol, use `trace_path` (`direction: "inbound"`, `include_tests:
+true`) and `TESTS` edges via `query_graph`, per
+`.claude/skills/devrites-lib/reference/standards/code-navigation.md`; a changed
+symbol no test reaches is a finding.
 
 ## Assess
 - **Coverage of acceptance criteria:** map each criterion to the tests that prove it.
@@ -88,9 +92,8 @@ paths to inspect the code and tests, then read the test files.
 
 Return the report in this shape:
 ```
-Test analysis (<slug>) — independent
 Outcome: <findings | no-findings | gap>
-Counts: <n per severity or kind used in the rows below>
+Counts: critical=<n> important=<n> suggestion=<n> nit=<n> fyi=<n> gap=<n>
 Account: <admitted findings | No-findings | Gap per Result admission>
 Claim map: <claim> | <exact_test> | <consumer_path> | <testing.md category> | <evidence gap> | <discriminating proof>
 Verdict: verified | behavior_unverified

package/pack/generated/claude/agents/devrites-upgrade-planner.md

@@ -1,7 +1,7 @@
 ---
 name: devrites-upgrade-planner
 description: Read-only /rite-upgrade assessor returning a cited current, repairable, unsupported, or gap outcome; never writes/delegates.
-tools: Read, Grep, Glob, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob
 permissionMode: plan
 ---
 

package/pack/generated/claude/agents/fast-builder.md

@@ -1,7 +1,7 @@
 ---
 name: fast-builder
 description: Write-capable builder for /rite-fast. Implements one approved slice, or one batch of accepted gap, review, or proof fixes, inside exact paths, with code and tests in the project's idiom. Runs no test suite and writes no workspace files.
-tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Edit, Write, Bash, Glob, Grep, Skill, mcp__codebase-memory-mcp__*
 permissionMode: acceptEdits
 ---
 
@@ -33,7 +33,9 @@ unclear boundary is an escalation, not a guess.
 ## Procedure
 
 1. **Orient.** Read the target files and their neighbors. Learn naming, layers, error
-   model, test style, and existing helpers. Reuse, then extend, then build new.
+   model, test style, and existing helpers. Reuse, then extend, then build new. Find
+   helpers with `search_graph` and callers with `trace_path` per
+   `.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 2. **Tests with the code.** For every AC in the contract, write a test that would
    fail without the change: real assertions on the new behavior, including the error
    and edge cases the AC names. Use the project's existing runner and style.

package/pack/generated/claude/agents/fast-checker.md

@@ -1,7 +1,7 @@
 ---
 name: fast-checker
 description: Read-only completeness checker for /rite-fast. After all slices are built, compares the diff with the spec's acceptance criteria and the plan's slices and returns every gap with file:line evidence. Never judges style or edits.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -33,7 +33,8 @@ baseline paths in `plan.md`.
 3. **Scope.** Every changed path belongs to a slice. Every new behavior belongs to an
    AC. Anything else is `out-of-scope`.
 4. **Contracts.** For each changed function, type, or interface, check its callers
-   still match.
+   still match: list them with `trace_path` (`direction: "inbound"`) per
+   `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, then read each call site.
 5. **Leftovers.** `TODO`, `TBD`, stubs, `not implemented`, commented-out code, or
    debug output in changed lines.
 6. **Check run.** Each red command becomes one `failing-command` gap with its first

package/pack/generated/claude/agents/fast-critic.md

@@ -1,7 +1,7 @@
 ---
 name: fast-critic
 description: Read-only critic for /rite-fast. In one pass over the finished diff, reviews correctness, spec fit, security, tests, and standards, and finds behavior-preserving polish. Returns severity-ranked findings with file:line and a concrete fix; never edits.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -24,7 +24,8 @@ input, auth, data, or integrations.
 
 `spec.md` and `plan.md` from `.devrites/work/<slug>/`, and the feature diff: `git diff`
 plus untracked files, minus the baseline paths in `plan.md`. Read the touched files
-and their callers, not only the hunks.
+and their callers, not only the hunks; list callers with `trace_path`
+(`direction: "inbound"`) per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`.
 
 ## Review
 

package/pack/generated/claude/agents/fast-planner.md

@@ -1,7 +1,7 @@
 ---
 name: fast-planner
 description: Read-only planner for /rite-fast. From a fresh context, reads the repository, drafts acceptance criteria and up to ten vertical slices, ranks the decisions the user must make with recommended answers, and flags risk. Never asks the user or writes files.
-tools: Read, Grep, Glob, Bash, mcp__codegraph__*, mcp__codebase-memory-mcp__*, mcp__codebase-memory__*, mcp__code-review-graph__*, mcp__graphify__*
+tools: Read, Grep, Glob, Bash, mcp__codebase-memory-mcp__*
 permissionMode: plan
 ---
 
@@ -30,8 +30,8 @@ Formats live in `.claude/skills/rite-fast/reference/artifacts.md`
 
 1. **Facts from the repository, not from the user.** Find where the change lives,
    the existing helpers, types, and patterns to reuse, the test runner and test
-   style, and the callers the change affects. Use a code-intelligence index when
-   available, then Read/Grep/Glob. A question whose answer sits in a file is a
+   style, and the callers the change affects. Use `search_graph` and `trace_path`
+   (`direction: "inbound"`) per `.claude/skills/devrites-lib/reference/standards/code-navigation.md`, then Read/Grep/Glob. A question whose answer sits in a file is a
    defect in your output.
 2. **Acceptance criteria.** Observable behavior at a named surface, one test able
    to show each. Include error and edge behavior the task implies. No criteria for

package/pack/generated/claude/agents/overhaul-recon.md

@@ -39,10 +39,11 @@ and proposals.
    denominator. Note submodules (boundary only), binaries and assets, candidate
    vendored or generated paths with the evidence for each (generator, header, config),
    and security-sensitive ignored inputs by path only.
-3. Use a code graph when the host offers one, to map faster, never to decide scope:
-   `codebase-memory-mcp` (architecture, call paths) or `codegraph` for a full project,
-   `code-review-graph` (changed nodes, impact radius) for a PR or branch. Record which
-   graph you used, its index time and the commit it was built from. A graph is a hint:
+3. Use codebase-memory-mcp when the host offers it, to map faster, never to decide
+   scope: `get_architecture` and `trace_path` for a full project, `detect_changes`
+   (explicit `base_branch`) for a PR or branch, per
+   `.claude/skills/devrites-lib/reference/standards/code-navigation.md`. Record the project, its `indexed_at`
+   and the commit it was built from. A graph is a hint:
    it may be stale or miss dynamic calls, so it can add entry points, contract seeds
    and cross-file edges but never remove a file, range or lane from the step 2
    inventory. Verify every graph-derived fact you report against the source. Without a

package/pack/generated/claude/settings.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "DevRites keeps the root orchestration context source-read-only by instruction; no permission mode enforces it. These allow rules cover the engine, read-only git, code-graph tools and .devrites/ workspace edits. Native subagents own specialist execution; only devrites-slice-wright may edit source in the lifecycle (fast-builder writes for /rite-fast; overhaul-* agents keep every tool). Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
+  "$comment": "DevRites keeps the root orchestration context source-read-only by instruction; no permission mode enforces it. These allow rules cover the engine, read-only git, the codebase-memory-mcp code index and .devrites/ workspace edits. Native subagents own specialist execution; only devrites-slice-wright may edit source in the lifecycle (fast-builder writes for /rite-fast; overhaul-* agents keep every tool). Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
   "permissions": {
     "allow": [
       "Bash(devrites-engine check candidate *)",
@@ -14,7 +14,10 @@
       "Bash(devrites-engine check regression *)",
       "Bash(devrites-engine check windows *)",
       "Bash(devrites-engine check dup *)",
+      "Bash(devrites-engine check anchors *)",
+      "Bash(devrites-engine check perturb *)",
       "Bash(devrites-engine check drift *)",
+      "Bash(devrites-engine check preconditions *)",
       "Bash(devrites-engine orient *)",
       "Bash(devrites-engine next *)",
       "Bash(devrites-engine handoff *)",
@@ -22,6 +25,8 @@
       "Bash(devrites-engine context *)",
       "Bash(devrites-engine metrics *)",
       "Bash(devrites-engine dispatch *)",
+      "Bash(devrites-engine candidate freeze *)",
+      "Bash(devrites-engine packet *)",
       "Bash(devrites-engine claim *)",
       "Bash(devrites-engine note *)",
       "Bash(devrites-engine observe *)",
@@ -29,6 +34,7 @@
       "Bash(devrites-engine migrate *)",
       "Bash(devrites-engine parallel status *)",
       "Bash(devrites-engine parallel select *)",
+      "Bash(devrites-engine parallel add *)",
       "Bash(devrites-engine parallel create *)",
       "Bash(devrites-engine parallel record-green *)",
       "Bash(devrites-engine parallel integrate *)",
@@ -39,22 +45,21 @@
       "Bash(devrites-engine parallel lease-clear *)",
       "Bash(devrites-engine state resolve *)",
       "Bash(devrites-engine state merge-manifest *)",
+      "Bash(devrites-engine state apply-bundle *)",
+      "Bash(devrites-engine state set *)",
+      "Bash(devrites-engine state append *)",
       "Bash(devrites-engine state close *)",
       "Bash(devrites-engine gates scaffold *)",
       "Bash(devrites-engine gates status *)",
       "Bash(devrites-engine gates run *)",
       "Bash(devrites-engine gates reverify *)",
       "Bash(devrites-engine gates lint *)",
+      "Bash(devrites-engine gates precheck *)",
       "Bash(devrites-engine gates attest *)",
       "Bash(devrites-engine gates abandon *)",
       "Bash(devrites-engine overhaul *)",
-      "mcp__codegraph__*",
       "mcp__codebase-memory-mcp__*",
-      "mcp__codebase-memory__*",
-      "mcp__code-review-graph__*",
-      "mcp__graphify__*",
-      "Bash(codegraph *)",
-      "Bash(graphify *)",
+      "Bash(codebase-memory-mcp cli *)",
       "Bash(git status *)",
       "Bash(git diff *)",
       "Bash(git log *)",
@@ -65,6 +70,13 @@
       "Bash(devrites-engine secret-scan)",
       "Bash(devrites-engine secret-scan *)",
       "Bash(devrites-engine open-visual *)",
+      "Bash(devrites-engine --help)",
+      "Bash(devrites-engine help)",
+      "Bash(devrites-engine help *)",
+      "Bash(devrites-engine check --help)",
+      "Bash(devrites-engine state --help)",
+      "Bash(devrites-engine parallel --help)",
+      "Bash(devrites-engine gates --help)",
       "Bash(devrites-engine version)"
     ]
   }

package/pack/generated/claude/skills/devrites-api-interface/SKILL.md

@@ -3,7 +3,7 @@ name: devrites-api-interface
 description: Shape stable API, type, module, or frontend/backend contracts before implementation. Use when a slice crosses a boundary; not for internal helpers.
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"]} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"security":["devrites-lib/reference/standards/security.md","rite-review/reference/security-review.md"]},"workspace":["spec.md","plan.md","tasks.md","state.md","decisions.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-api-interface` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-api-interface: contract before implementation

package/pack/generated/claude/skills/devrites-audit/SKILL.md

@@ -4,7 +4,7 @@ description: Audit one feature read-only for security, performance, or simplific
 argument-hint: "<security | perf | simplify>"
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/agents.md"],"triggers":{"audit-coverage":["devrites-lib/reference/standards/audit-coverage.md"],"architecture-health":["devrites-lib/reference/standards/architecture-health.md"]},"workspace":["spec.md","plan.md","tasks.md","touched-files.md","evidence.md","state.md","decisions.md"],"workspaceByRole":{"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/parallel-dispatch.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-audit` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read.
 
 # devrites-audit: read-only audit dispatch

package/pack/generated/claude/skills/devrites-debug-recovery/SKILL.md

@@ -4,7 +4,7 @@ description: Fix application test, build, CI, runtime, browser, or 500 failures
 argument-hint: "[<slug>]"
 user-invocable: false
 ---
-<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]}} -->
+<!-- loads: {"always":["devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-debug-recovery/reference/build-the-loop.md","devrites-debug-recovery/reference/cleanup-and-classify.md","devrites-debug-recovery/reference/hypotheses.md","devrites-debug-recovery/reference/instrumentation.md","devrites-debug-recovery/reference/regression-test.md","devrites-debug-recovery/reference/trace.md","devrites-lib/reference/standards/debug-recovery.md"],"triggers":{"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"security":["devrites-lib/reference/standards/security.md"],"workspace":["devrites-lib/reference/standards/workflow-artifacts.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/workflow-artifacts.md"]} -->
 > Read-set manifest: `devrites-engine context <slug> --skill devrites-debug-recovery` (no workspace: `--out <path>`) bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
 
 # devrites-debug-recovery: fix the root cause, not the symptom