devrites 7.1.0 → 7.1.2

package/pack/generated/devin/skills/rite-resolve/SKILL.md

@@ -39,9 +39,11 @@ Pull these via `Read` when shaping the resolve:
 - **Never overwrite an answered question.** If the qid's `status` is `answered` or
   `dropped`, refuse with the existing answer; ask the user to open a new qid that
   references the old one (the file is the audit trail).
-- **If the answer materially changes scope, architecture, or acceptance**, route it
-  through the Spec Drift Guard (`/rite-plan repair`) **after** writing the answer: do
-  not modify `spec.md` / `plan.md` inside this skill.
+- **Phase-aware handoff after writing the answer:** before planning artifacts exist,
+  recommend the current phase owner's action emitted by `state resolve` (for example,
+  `/rite-spec`), not Plan repair. Once a plan exists, material scope, architecture,
+  or acceptance changes route through the Spec Drift Guard (`/rite-plan repair`).
+  Never modify `spec.md` / `plan.md` inside this skill.
 - **The script is the source of truth.** Always invoke
   `devrites-engine state resolve`. It keeps `questions.md` + `state.md` consistent and emits the
   next-action recommendation. The one `state.md` field this skill may write by hand is the
@@ -66,8 +68,9 @@ Pull these via `Read` when shaping the resolve:
    - `--batch <plain-text-file>`: bulk resolve, one entry per qid (see
      [`reference/answer-protocol.md`](reference/answer-protocol.md) for the batch
      format).
-2. **Load context.** Read `state.md`, `questions.md`, and the relevant slice from
-   `tasks.md`. Confirm the qid is `status: open`. If `state.md` `Status` is not
+2. **Load context.** Read `state.md` and `questions.md`; require the relevant slice
+   from `tasks.md` only for an actual `SLICE-###` question, not `slice: spec | plan`.
+   Confirm the qid is `status: open`. If `state.md` `Status` is not
    `awaiting_human` and the question's `gate` is `blocking`, surface the inconsistency
    before proceeding (don't auto-repair: flag it).
 3. **Apply explicit consent.** Supplying `<qid> "<answer>"`, `--drop`, or `--batch` is the
@@ -86,13 +89,16 @@ Pull these via `Read` when shaping the resolve:
    writer left them.
    **Completion:** zero exit, or the failure reported with no hand edit.
 
-   On resume, and only after a zero exit, also clear or update the unblocked slice's `Slice mode` in `state.md`: if
+   On resume, only for an actual `SLICE-###` question and after a zero exit, clear or
+   update the unblocked slice's `Slice mode` in `state.md`: if
    the answer lets the slice proceed, drop the pause-time `Slice mode` so `/rite-build`
    re-derives it on the next selection; if the answer re-shapes how the slice should be
    built, set `Slice mode` to match.
-5. **Post-resolve hand-off.** If the answer changes product behavior or acceptance →
-   recommend `/rite-plan repair`. Otherwise → recommend the slice's natural next action
-   (typically `/rite-build` for the slice that was awaiting).
+5. **Post-resolve hand-off.** Before planning artifacts exist, recommend the emitted
+   phase-native next action (for example, `/rite-spec`); do not require or create a plan.
+   Once a plan exists, material scope, architecture, behavior, or acceptance changes →
+   recommend `/rite-plan repair` through the Spec Drift Guard. Otherwise → recommend
+   the emitted phase-native next action (typically `/rite-build` for a waiting slice).
    **Completion:** the resolved state contains exactly one next command.
 6. **STOP.** User-invoked `/rite-resolve` does not run `/rite-build` itself: the
    user re-enters the workflow explicitly. A controlling `/rite-autocomplete`
@@ -101,6 +107,7 @@ Pull these via `Read` when shaping the resolve:
    already names a ranked recommended option.
 
 > **Mid-flight discipline.** Don't edit `spec.md` / `plan.md` to "incorporate" the
-> answer. That's `/rite-plan repair`. Don't silently retry a build after the answer
+> answer. Before planning artifacts exist, return to the emitted current phase owner;
+> once a plan exists, material changes need `/rite-plan repair`. Don't silently retry a build after the answer
 > lands: the user types the next command. Don't merge two open questions into one
 > answered entry: each question is independently auditable.

package/pack/generated/devin/skills/rite-resolve/reference/answer-protocol.md

@@ -87,12 +87,23 @@ writes one block at a time and pauses. When `/rite-resolve` matches the block's
 
 If `state.md`'s `Status` is `awaiting_human` but no `Awaiting human` block matches the
 qid (drift between the two files), `/rite-resolve` flags the inconsistency and refuses
-to silently fix it. Use `/rite-plan repair` to reconcile.
+to silently fix it. Report it to the current phase owner; once a plan exists,
+reconciliation uses `/rite-plan repair`.
+
+## Phase-aware handoff and slice context
+
+Read `tasks.md` and update `Slice mode` only for an actual `SLICE-###` question,
+never for `slice: spec | plan`; the update is allowed only after the writer exits zero.
+Before planning artifacts exist, recommend the current phase owner's action emitted
+by `state resolve` (for example, `/rite-spec`), not Plan repair. Never create planning
+artifacts as part of Resolve.
 
 If the answer materially changes spec/plan, **do not** edit `spec.md` or `plan.md` inside
-`/rite-resolve`. That's `/rite-plan repair`'s job. The skill's post-resolve hand-off
-recommends `/rite-plan repair` whenever the answer touches acceptance criteria, scope,
-or architecture.
+`/rite-resolve`. Once a plan exists, material acceptance, behavior, scope, or architecture
+changes route through the Spec Drift Guard (`/rite-plan repair`); otherwise retain the
+emitted phase-native next action. User-invoked resolutions use `state resolve --human`;
+an internal Autocomplete caller uses the same writer without `--human` and continues.
+Resolve itself never auto-runs the recommended phase owner.
 
 ## Multi-question awaiting
 
@@ -109,8 +120,9 @@ This shape is reserved: current `/rite-build` writes one question per pause.
 
 The user types the next command explicitly. Reasons:
 
-1. The answer may need a `/rite-plan repair` first; auto-continuing would build against
-   a stale plan.
+1. Before planning artifacts exist, the emitted current phase owner must resume;
+   once a plan exists, material changes may need `/rite-plan repair` first.
+   Auto-continuing a build would skip that owner or use a stale plan.
 2. The user may want to `/rite-status` before resuming.
 3. Atomicity: one verb, one mutation. Chaining is a hidden side-effect that hides bugs.
 

package/pack/generated/devin/skills/rite-review/SKILL.md

@@ -31,7 +31,7 @@ Pull these via `Read` when the diff demands them:
 - [`principles.md`](../devrites-lib/reference/standards/principles.md): declared project invariants (`.devrites/principles.md`); a diff that violates one with no recorded exception is a Critical, blocking finding.
 - [`testing.md`](../devrites-lib/reference/standards/testing.md): confirm that passing tests actually prove the spec.
 - [`agents.md`](../devrites-lib/reference/standards/agents.md): when to fan out to which review subagent.
-- [`security.md`](../devrites-lib/reference/standards/security.md): when input / auth / data / integrations / secrets are in scope.
+- [`security.md`](../devrites-lib/reference/standards/security.md): when the shared [`parallel-dispatch.md`](../devrites-lib/reference/parallel-dispatch.md#roster) roster triggers the security auditor.
 - [`security-checklist.md`](../devrites-lib/reference/standards/security-checklist.md): for the same security-sensitive scope, the compact trust-boundary sweep.
 - [`repository-topology.md`](../devrites-lib/reference/standards/repository-topology.md), [`data-integrity.md`](../devrites-lib/reference/standards/data-integrity.md), [`integration-reliability.md`](../devrites-lib/reference/standards/integration-reliability.md): only
   when the spec applicability map or final diff triggers their ownership/failure/proof checks.
@@ -138,9 +138,9 @@ Pull these via `Read` when the diff demands them:
      [performance-checklist](reference/performance-checklist.md)). No UI/route/style
      paths: record `Not-applicable: no relevant paths in diff`.
 5. **Security:** `devrites-security-auditor`
-   ([security-review](reference/security-review.md)) joins the step-3 cohort when
-   input, auth, data,
-   secrets, or permissions are in the diff; else `Not-applicable: no relevant paths in diff`.
+   ([security-review](reference/security-review.md)) joins the step-3 cohort under the
+   canonical [parallel-dispatch roster trigger](../devrites-lib/reference/parallel-dispatch.md#roster),
+   including a dependency-only diff; else `Not-applicable: no relevant paths in diff`.
 6. **Performance:** `devrites-performance-reviewer`
    ([performance-review](reference/performance-review.md),
    [performance-checklist](reference/performance-checklist.md)) joins the step-3 cohort

package/pack/generated/devin/skills/rite-review/reference/security-review.md

@@ -1,7 +1,9 @@
 # Security review (feature-scoped)
 
-Apply when the feature involves user input, auth/authz, data storage, external
-integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+Use the canonical [parallel-dispatch roster trigger](../../devrites-lib/reference/parallel-dispatch.md#roster),
+including dependency and integration changes. A dependency-only diff still requires
+`devrites-security-auditor`; a docs-only diff with no matching surfaces records
+`Not-applicable: no relevant paths in diff`. Delegates to `devrites-audit security`.
 
 ## OWASP-Top-10-oriented checks
 

package/pack/generated/devin/skills/rite-seal/SKILL.md

@@ -10,8 +10,7 @@ argument-hint: "[feature-slug] [--full]"
 
 # /rite-seal: GO / NO-GO
 
-Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible
-actions and close-out.
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible actions/close-out.
 
 ## Authority
 
@@ -21,13 +20,12 @@ security, principles, documentation, observability, deprecation,
 definition-of-done, and [`verification-methods.md`](../devrites-lib/reference/standards/verification-methods.md)
 for coverage-denominator and evidence-status judgment.
 Load [`final-evidence.md`](reference/final-evidence.md) and
-[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
-Follow the shared
-[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
-the reviewed digest and artifact bindings.
+[`go-no-go.md`](reference/go-no-go.md) for proof/verdict safety.
+Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md)
+for reviewed digest/artifact bindings.
 
-The host runs/reconciles named read-only reviewers; engine checks invariants.
-**Standard** is default; **Full** broadens conditional axes per
+Host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** default; **Full** broadens conditional axes per
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Gate
@@ -35,7 +33,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | State | Verdict |
 |---|---|
 | Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
-| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**. Only a human answers `y`; unattended (AFK/autocomplete) keeps **N** and stops for a human if Important remains |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**, unattended keeps **N**. Only humans answer `y`; standalone AFK stops for a human if Important remains. Autocomplete repairs agent-owned findings, re-enters Seal; only human-owned risk acceptance stops for a human |
 | `Critical > 0` | **NO-GO** |
 | Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
 | `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
@@ -48,8 +46,8 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | `check regression` reports an unblessed loss vs the recorded progress baseline | **NO-GO** |
 | `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
 
-A judgment-only criterion needs the human eye; AFK records a validating question
-(`slice: seal`) and stops. Autocomplete never auto-picks it; only a human answers.
+Judgment-only criteria need humans. AFK records a validating question
+(`slice: seal`), stops; Autocomplete never auto-picks.
 
 ## Workflow
 
@@ -67,36 +65,33 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven roster accounts plus proof-runner and doubt-reviewer
    (each engineering lane its own account);
 6. write exactly one candidate binding, then run
-   `devrites-engine check seal <slug>` for structure and identity, never semantics,
-   and, when that check reports a stale readiness-input binding, run
-   `devrites-engine check drift <slug>` before returning to Vet so the repair
-   starts at the named changed, missing, or added input,
-   and `devrites-engine check regression <slug>` to confirm no recorded progress
-   fact was lost since the last checkpoint — `BLOCKED` is NO-GO; `unproven`
-   (no baseline) does not block — plus two separate runs of `devrites-engine check windows <slug>`,
+   `devrites-engine check seal <slug>` for structure/identity, never semantics.
+   For stale readiness-input bindings, run `devrites-engine check drift <slug>`
+   before returning to Vet; start repair at the named changed/missing/added input.
+   Run `devrites-engine check regression <slug>` for progress lost since last
+   checkpoint: `BLOCKED` is NO-GO; `unproven` (no baseline) does not block.
+   Run `devrites-engine check windows <slug>` twice,
    one with `--base <release-base>` and one with `--worktree` (the only mode that scans
    untracked files; never pass both flags in one command, the last one wins) so each deferral marker the feature diff introduced
    carries a `windows.md` waiver row ([`windows.md`](../devrites-lib/reference/standards/windows.md));
-   unwaived hits are NO-GO. The engine already refuses a `gates.md` ledger
-   that is malformed, unmet,
-   stale, unapproved, or abandoned — a seal-side `gates status` reading anything
-   but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
-   --transcripts` on the frozen candidate, so every gate has a transcript bound to
-   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
-   graded other than `exact`: `devrites-engine note check <slug> --repair`
-   re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
-   removed before GO. Repeat each `note: unexecuted driver` line `check seal` prints in the GO/NO-GO reply.
-
-Corrections return through affected Prove/Review before restarting Seal under
+   unwaived hits are NO-GO. The engine rejects malformed, unmet, stale, unapproved, or abandoned
+   `gates.md` ledgers. Unless Seal-side `gates status` says `all-met`, return to
+   Prove: evidence is not current; never attest past it. Before Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate: bind every gate transcript to this
+   digest for the proof runner. It also rejects malformed `notes.md` or non-`exact` anchors:
+   `devrites-engine note check <slug> --repair` re-anchors `moved` notes;
+   fix/remove `stale`/`ambiguous`/`lost` notes before GO. Repeat each `note: unexecuted driver` line `check seal` prints in GO/NO-GO reply.
+
+Corrections pass affected Prove/Review before Seal restarts under
 [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 
-Only repository scripts/CI authorize commands; never guess.
+Only repo scripts/CI authorize commands; never guess.
 
 ## On GO
 
-Set `state.md` `Next step: /rite-ship` and stop. A GO is a verdict, not
-authorization to perform an irreversible action.
+Set `state.md` `Next step: /rite-ship`. Standalone Seal stops. Under active `/rite-autocomplete`, return internally to the caller
+for recorded sequence continuation or [Ship preflight](../rite-ship/reference/git-ship.md#before-type-go),
+no intermediate final reply. GO grants no irreversible-action authority.
 
 ## Output
 

package/pack/generated/devin/skills/rite-ship/SKILL.md

@@ -44,12 +44,16 @@ if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `se
 1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
    repair. If ACTIVE is flagged, confirm the slug.
 2. **Prepare the exact Git candidate.** Follow
-   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
-   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
-   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
-   From the verified index, build the exact project-conformant message/trailers,
-   branch, tag/PR, commands, and skips.
-2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   [`git-ship.md`](reference/git-ship.md)'s read-only pre-GO ladder: inspect the
+   candidate and existing NUL-delimited staged state/path set, refuse out-of-manifest
+   staged work, and rerun candidate/Seal checks. Do not stage or collapse checkpoints
+   before fresh literal `GO`. From the verified candidate, disclose the exact proposed
+   staging/collapse commands, project-conformant message/trailers, branch, tag/PR,
+   commands, and skips; the existing index need not yet equal the candidate.
+2a. **Credential guard (HIGH blocks).** Before type-GO, run only read-only scans of
+   existing staged blobs and the proposed PR body. This is not a final candidate-clean
+   claim; after literal `GO` and exact staging, repeat the full staged scan before commit.
+   HIGH stops
    and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
    LOW is FYI.
    ```bash
@@ -70,7 +74,10 @@ if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `se
    Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
    stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
    native approval is still required.
-4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+4. On literal GO plus native approval, follow `git-ship.md`'s post-GO ladder:
+   disclosed collapse/staging, staged scope/byte comparisons, candidate/Seal revalidation,
+   and full staged secret scan BEFORE commit. Then commit; verify committed state/path
+   set and exact candidate digest; then push →
    tag/PR as applicable via `git-ship.md`. Record SHA and push state in `ship.md` before
    push (git-ship 7a); a push/tag/PR failure stops, and a rerun resumes at push under
    fresh type-GO. Capture branch, tag/PR URL. Mismatch stops before push/tag; retry

package/pack/generated/devin/skills/rite-temper/SKILL.md

@@ -10,10 +10,10 @@ argument-hint: "[feature-slug] [--mode expand|selective|hold-rigor|reduce-to-MVP
 
 # /rite-temper: review scope and risk before planning
 
-Review the readied spec for ambition, scope, pre-mortem risk and unnecessary surface. Fold accepted decisions into the canonical contract before
-`/rite-define`. This step is optional for small work and skips low-stakes specs, but
-`/rite-autocomplete` always invokes it. **Read the active workspace first**; if there
-is no readied `spec.md`, tell the user to run `/rite-spec`. Review depth follows
+Review readied spec ambition, scope, pre-mortem risk, and excess surface. Fold
+accepted decisions into the canonical contract before `/rite-define`. Optional for
+small work; skips low-stakes specs; `/rite-autocomplete` always invokes it.
+**Read active workspace first**; no readied `spec.md` → `/rite-spec`. Depth follows
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md);
 the required exact strategy reviewer never changes with profile.
 
@@ -27,24 +27,24 @@ that needs more than the default pre-mortem) selected by the section's risk). Lo
 the spec applicability map triggers that risk family.
 
 ## Operating rules
-- **Raise outcome ambition without expanding the solution unnecessarily.** Solve the
-  underlying problem without adding speculative capability or abstraction.
+- **Raise outcome ambition, not excess solution surface.** Solve the underlying
+  problem without speculative capability/abstraction.
 - **Route every scope change through the Spec Drift Guard.** A scope change takes effect
   only when `spec.md` records the confirmed decision. Growth (`expand`, extra
   acceptance) needs a resolved human `questions.md` qid, so an unattended run holds it
   open. Irreversible-risk still pauses.
-- **Apply maximum caution to hard-to-reverse changes.** Auth, migration, public API, and
-  data-model changes always pause under the irreversible-risk list.
-- **Honest verdict.** Never round "needs work" up to "ready"; record every scope call's *why*.
-- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) decision ownership; only human-owned calls
-  enter the interactive walk.
-- **You write; the reviewer judges.** You are the single canonical writer (`strategy.md` +
-  the spec edits); the reviewer agent is read-only.
-- **Require spec-quality checklists for significant features.** Before hardening,
-  confirm `checklists/<domain>.md` exist and pass ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
-  scope expansion you fold in **adds its own** rows (new Success/Acceptance criteria get
-  checklist rows too). A folded expansion with an unquantified criterion is a CRITICAL
-  failure that reopens the readiness gate.
+- **Maximum caution:** auth, migration, public API, and data-model changes need
+  full review and explicit rollback. Pause only for [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal data-model change.
+- **Honest verdict.** Never round "needs work" to "ready"; record each scope call's *why*.
+- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) ownership;
+  only human-owned calls enter the interactive walk.
+- **You write; reviewer judges.** Sole canonical writer: `strategy.md` + spec edits;
+  reviewer is read-only.
+- **Significant features require spec-quality checklists.** Before hardening,
+  require passing `checklists/<domain>.md` ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
+  folded scope expansion **adds its own** rows, including new Success/Acceptance
+  criteria. An unquantified folded criterion is a CRITICAL failure reopening readiness.
 
 ## Workflow
 0. **Read `.devin/skills/devrites-lib/reference/standards/core.md`**, then

package/pack/generated/devin/skills/rite-temper/reference/scope-modes.md

@@ -1,7 +1,6 @@
 # Scope modes + the two passes
 
-The heart of `/rite-temper`: two ordered passes (heat, then quench), converging on exactly
-one scope mode. Ambition is a **generative** move followed by a **required convergence**: the
+`/rite-temper`: two ordered passes (heat, then quench), converging on one scope mode. Ambition is a **generative** move followed by a **required convergence**: the
 divergence is never the spec; the converged sweet spot is.
 
 ## Pass 1: FORWARD (heat: raise ambition on the outcome)
@@ -41,11 +40,11 @@ Mode selection is the first convergence move. Record the chosen mode + rationale
 | **REDUCE-TO-MVP** | Over-scoped: second-system bloat, ~all must-haves, gold-plating | Hammer scope to the Minimum Usable Subset; move the rest to Non-goals with one-line reasons + revisit notes | Strongest YAGNI alignment. Cutting acceptance is **still a spec change**: record it via the Guard, never a silent trim |
 
 ## Bound ambition by reversibility
-The bigger the bet, the more it must be reversible. Irreversible-risk areas (auth, migrations,
-public API, data model) get the **opposite** of ambition: maximum conservatism, explicit
-rollback, and they **always pause** regardless of mode (the [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md) irreversible-risk
-list is honored verbatim). Size big bets so that if the whole thing vanished tomorrow, you'd be
-fine.
+Bigger bets need more reversibility. Auth, migrations, public API, and data-model
+changes need maximum conservatism, full review, and explicit rollback.
+Pause only for actual [canonical irreversible-risk items](../../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+or unresolved human-owned decisions, not an already-approved reversible internal
+data-model change. Size bets to tolerate their disappearance tomorrow.
 
 ## Effort foresight (frame it now, not "later")
 While choosing scope, surface the late-stage questions early: *"What will surprise us at

package/pack/generated/devin/skills/rite-upgrade/SKILL.md

@@ -99,8 +99,13 @@ references, and only current phase contracts needed for the observed gap.
    - a missing/malformed strict manifest, missing/malformed/mismatched evidence binding,
      a browser-binding defect when that file exists, or current candidate-check failure
      → `/rite-prove`;
-   - candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still deferred by
-     an old Ship-era workspace → `/rite-polish`;
+   - required candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still
+     deferred by an old Ship-era workspace → `gap`: no admitted route. STOP with an
+     explicit `/rite-polish` handoff for separate user authorization; never invoke
+     those rollup writes inside Upgrade. After authorization outside Upgrade, normal
+     affected Prove → Review → Seal applies;
+   - workspace-only Polish refresh → `/rite-polish` only when its exact paths remain
+     within the admitted gate artifacts and no candidate-affecting rollup is required;
    - a missing, stale, or mismatched review binding → `/rite-review`;
    - a missing, stale, or mismatched seal binding or failed Seal gate → `/rite-seal`.
 

package/pack/generated/devin/skills/rite-vet/SKILL.md

@@ -10,10 +10,10 @@ argument-hint: "[slug] [--cross-model] [--full]"
 
 # /rite-vet: review the plan before build
 
-Vet every plan's scope, architecture, quality, proof, performance, failures and writer
-safety. Fold cited technical findings; design Build tests. Temper owns product;
-Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
-`reference/depth.md`; profiles never remove the exact plan-reviewer gate
+Vet each plan: scope, architecture, quality, proof, performance, failures, writer
+safety. Fold cited technical findings; design Build tests. Temper owns product,
+Vet implementation. Current `$ARGUMENTS` (`--full`) feeds `reference/depth.md`
+triggers; profiles never remove the exact plan-reviewer gate
 ([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
 
 ## Rules
@@ -40,21 +40,23 @@ plan declares a root-authored executable workflow file, read
 
 ## Invariants
 
-- Review implementation, not ambition. Challenge creep, complexity, proof, and
-  risk without changing accepted product scope.
-- Root owns decisions/writes/readiness; reviewers judge without route policy.
-  Cite findings/confidence; suppress
-  unverified or confidence ≤4 findings under `review-axes.md`.
-  Lens arrows in `eng-lenses.md` are heuristics; band findings only under the
-  four `review-axes.md` names.
-- Auth, migration, public API, and data-model changes use maximum caution and the
-  irreversible-risk stop. Project principles never become trade-offs.
+- Review implementation, not ambition. Challenge creep/complexity/proof/risk
+  without changing accepted product scope.
+- Root owns decisions/writes/readiness; reviewers judge, not route. Cite
+  findings/confidence; suppress unverified or confidence ≤4 findings per
+  `review-axes.md`. `eng-lenses.md` arrows are heuristics; use only the four
+  `review-axes.md` band names.
+- Auth, migration, public API, and data-model changes need maximum caution,
+  full review, and explicit rollback. Pause only for
+  [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal
+  data-model change. Project principles never become trade-offs.
 - **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
-  `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
-  human approval before plan slices may edit them. A slice touching a protected path
-  without approval → Vet **NEEDS CLARIFICATION**.
-- Use the lowest axis band; never average or round thin to ready. Search before
-  asking and resolve reversible technical choices. Ask only human-owned choices.
+  `NOTICE.md` generator regions, documented CI/hook config) require explicit
+  human approval before plan slices edit them; absent approval → Vet
+  **NEEDS CLARIFICATION**.
+- Use lowest axis band; never average/round thin to ready. Search; resolve
+  reversible technical choices; ask only human-owned.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
   internally to its caller, not to the human; on a direct invocation there is
   no caller, so Vet becomes it — save a return cursor
@@ -75,18 +77,16 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
-1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Every initial
-   pass records an engineering verdict and test-plan coverage. A valid Recovery
-   recheck retains prior depth and enters 1b.
-1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
-   read-only plan reviewer — plus developer-experience reviewer for developer
-   surfaces (trigger `devex`) and the current strategy reviewer after significant
-   Temper — in
-   parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
-   independent read-only passes on one frozen candidate. Missing
-   required account blocks. Run root steps 2–4, including step 3's preflight
-   commands, on the same frozen candidate while the wave is out; reconcile the
-   accounts when they return.
+1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
+   record engineering verdict and test-plan coverage. Valid Recovery rechecks
+   retain prior depth; enter 1b.
+1a. **Independent initial pass.** Freeze candidate; dispatch exact fresh read-only
+   plan reviewer, plus developer-experience reviewer for developer surfaces
+   (trigger `devex`) and current strategy reviewer after significant Temper, in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
+   read-only passes on one frozen candidate. Missing required account blocks.
+   Meanwhile run root steps 2–4, including step 3 preflight commands, on that
+   candidate; reconcile returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
@@ -117,14 +117,13 @@ plan declares a root-authored executable workflow file, read
    Do not fall through to steps 2–7. Retain evidenced unchanged coverage; changed
    global contract/uncertain impact requires full applicable review. Reopen historical
    findings only for affected invariants/dependencies.
-2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
+2. **Challenge scope.** Apply review-axes §0; search accepted decisions.
    Harden to the smallest contract-complete plan, using marked topology action.
    Then verify bidirectional ID-and-meaning traceability across spec/plan/
    tasks/test-plan/traceability, acceptance, terms, principles, anti-slop,
    and conventions; every slice and test-plan row maps to a live requirement
-   and vice versa. Critical gaps and
-   unexcepted principle breaches block; record the challenge result in `eng-review.md`
-   §2 (Scope challenge) after recheck.
+   and vice versa. Critical gaps/unexcepted principle breaches block. Record
+   rechecked result in `eng-review.md` §2 (Scope challenge).
 3. **Preflight Build entry.** Under `reference/artifacts.md`, verify exact
    command/cwd/tool/version/prerequisite; output filters must preserve upstream
    failure. Verify dependencies from authoritative source plus nearest manifest.

package/pack/generated/omp/agents/devrites-upgrade-planner.md

@@ -38,7 +38,10 @@ rules cannot fail.
 - `repairable`: each defect is neutral, preservation-safe, and owned by Clarify,
   Plan repair, Converge, Vet, Prove, Polish, Review, or Seal.
 - `unsupported`: cursor/topology is unofficial; propose no rewrite.
-- `gap`: evidence/contracts are insufficient. Missing input or unverifiable current rules produce `gap`, never `current` or `repairable`.
+- `gap`: evidence/contracts are insufficient or the required delta has no admitted
+  preservation-safe route. Missing input or unverifiable current rules produce `gap`,
+  never `current` or `repairable`. Required candidate-affecting rollup writes also
+  produce `gap`.
 
 ## Rules
 
@@ -52,9 +55,14 @@ rules cannot fail.
   slices beyond the feature ceiling to Plan course-correct (`MVP cut` + named
   continuation sequence); built slices and their evidence stay.
 - For released post-Build work, route a strict-manifest, evidence/browser-binding, or
-  candidate-check defect to Prove; an old Ship-era candidate rollup to Polish; a
-  review-binding defect to Review; and a seal-binding or Seal-gate defect to Seal.
-  Include only applicable owners, ordered Prove, Polish, Review, Seal. Never infer scope
+  candidate-check defect to Prove; a workspace-only Polish refresh to Polish only
+  within Upgrade's admitted gate artifacts; a review-binding defect to Review; and a
+  seal-binding or Seal-gate defect to Seal. Required candidate-affecting capability-ledger,
+  `DESIGN.md`, or ADR rollups are outside admission: return `gap` with an explicit
+  `/rite-polish` handoff for separate user authorization, no writable paths and no admitted route.
+  Never recommend invoking those writes inside Upgrade. After authorization
+  outside Upgrade, normal affected Prove → Review → Seal applies.
+  Include only applicable admitted owners, ordered Prove, Polish, Review, Seal. Never infer scope
   or treat an old pass as current proof. A Prove repair is admissible only when legacy
   scope inputs are present and agree unambiguously; ambiguous candidate scope produces
   `gap` with no route.

package/pack/generated/omp/skills/devrites-debug-recovery/SKILL.md

@@ -53,6 +53,21 @@ has no clear next move. Optional slug selects the active workspace; defaults to
    gone, hypothesis recorded. Classify the failure.
    See [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 
+## Caller-owned records and routing
+
+The controlling root accepts and persists all recovery records in `decisions.md`,
+`evidence.md`, and `## Dead ends` before the next admission/attempt. This rule governs
+all loaded recovery steps, including cleanup and regression instructions. A leaf
+returns the complete class/rationale, proposed routing, hypothesis/probe, baseline,
+exact failure/evidence, causal fingerprint, attempt number and failed idea/dead ends,
+and human predicate in its existing result fields (`gates`, `dead_ends`,
+`follow_ups`, or `Escalation` as applicable); no new result schema is required.
+A leaf never writes `.devrites/**`, changes phase, invokes agents, or commits through
+recovery. Only the controlling root routes to owning rites and supplies later attempts
+with accepted records. Product/test edits remain inside the caller's exact allowed
+paths; recovery never widens them. Commit/PR wording is a returned proposal for the
+authorized owner, not authority to commit.
+
 ## Hard rules
 
 - Quote exact signal-bearing error text with typed redactions (not paraphrase); apply
@@ -79,8 +94,9 @@ has no clear next move. Optional slug selects the active workspace; defaults to
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"durable active failure or ambiguous admitted state","action":"OFFLINE_RECOVERY; correct offline, re-preflight, narrow Vet, retry only under cap","return":"saved caller or exact Plan/Vet route"} -->
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
-- **Durably record class and rationale** in `decisions.md` and the applicable
-  `evidence.md` or `## Dead ends` entry.
+- **Durably record class and rationale** through [Caller-owned records and routing](#caller-owned-records-and-routing):
+  root persists `decisions.md` and the applicable `evidence.md` or `## Dead ends`
+  entry; leaves return the full payload for root acceptance.
 - **One causal fingerprint, counted by the caller.** Normalize the root cause as
   `<affected boundary>: <failed invariant/failure mechanism>` and bind its minimal
   reproduction plus decisive signal rather than hashing symptom text.
@@ -98,5 +114,6 @@ has no clear next move. Optional slug selects the active workspace; defaults to
   human-only access becomes a human gate; otherwise return the spent strategy and
   reproduction to the caller, which escalates or parks per the
   [retry contract](skill://devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve);
-  never request attempt four of the same strategy. While budget remains, coupled failure requiring behavior change routes
-  `/rite-plan repair` inline; behavior-neutral rerouting uses `unblock` inline.
+  never request attempt four of the same strategy. While budget remains, the controlling
+  root routes coupled failure requiring behavior change to `/rite-plan repair` inline;
+  behavior-neutral rerouting uses `unblock` inline. Leaves return proposed routes only.

package/pack/generated/omp/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -1,5 +1,10 @@
 # Cleanup + classify
 
+All recording and routing below follows
+[`SKILL.md` § Caller-owned records and routing](skill://devrites-debug-recovery/SKILL.md#caller-owned-records-and-routing):
+root accepts/persists the full payload and owns transitions; leaves return proposals
+and evidence only, never workspace writes, agent launches, or commits.
+
 ## Classify one causal fingerprint
 
 Fingerprint the diagnosis, not its symptom. Reuse it until evidence disproves it; then
@@ -19,8 +24,9 @@ required before the next consumptive execution pause. Fresh authorization never
 pauses offline diagnosis or correction from retained evidence; never ask for a
 blind retry.
 
-Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
-or `## Dead ends`. Apply the causal-fingerprint and three-attempt rules in
+Root records class/routing in `decisions.md` and each failed attempt in `evidence.md`
+or `## Dead ends`; leaves return the complete record for root acceptance/persistence
+before the next admission. Apply the causal-fingerprint and three-attempt rules in
 [`SKILL.md`](skill://devrites-debug-recovery/SKILL.md) Hard rules; record baseline, exact failure,
 hypothesis/probe, attempt number, and any human predicate.
 
@@ -31,4 +37,5 @@ hypothesis/probe, attempt number, and any human predicate.
 - [ ] Regression test passes (or absence of seam is documented).
 - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix).
 - [ ] Throwaway harnesses deleted (or moved to a clearly marked debug location).
-- [ ] The correct hypothesis is stated in `evidence.md` + the commit/PR message: next debugger learns.
+- [ ] Root persists the correct hypothesis in `evidence.md`; leaves return it plus
+      proposed commit/PR wording for the authorized owner, without committing.