devrites 7.1.1 → 7.2.0

package/pack/.claude/skills/rite-autocomplete/reference/stop-conditions.md

@@ -1,9 +1,8 @@
 # Stop conditions: when autocomplete pauses
 
-On a real stop, write `state.md` as `awaiting_human` or `blocked`, persist the
-reason, and include one resume command. Agent-owned recovery never ends the run:
-a spent strategy escalates and a fully escalated fingerprint parks while other
-work continues ([retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)).
+On real stops, persist `state.md` `awaiting_human` or `blocked`, reason, and one
+resume command. Agent-owned recovery never ends the run: spent strategies
+escalate; fully escalated fingerprints park while other work continues ([retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve)).
 `--ship` never bypasses a stop.
 
 Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
@@ -14,7 +13,7 @@ Authority: `.claude/skills/devrites-lib/reference/standards/acceptance-preservin
 
 ## Always stop
 
-Regardless of flags or AFK ceiling:
+Flags/AFK ceiling never override:
 
 - destructive data migration;
 - auth/authz boundary change;
@@ -22,8 +21,8 @@ Regardless of flags or AFK ceiling:
 - external-service contract change; or
 - filesystem destruction outside the workspace.
 
-Red proof cannot advance. Run bounded Debug Recovery and escalate spent
-strategies; a fully escalated fingerprint parks unless the remaining owner is human.
+Red proof cannot advance. Run bounded Debug Recovery; escalate spent strategies.
+Fully escalated fingerprints park unless remaining owner is human.
 
 ## Not stops: internal technical routing
 
@@ -32,13 +31,12 @@ forward work, persists the return cursor, and invokes Plan repair plus Recovery
 Vet inline. The same applies to nested `STOP`/`Next step` when its decision is
 agent-owned.
 
-Agent-owned backtracking is not a stop condition while the exact causal
-fingerprint has budget. Invoke the earlier phase, affected Vet, remediation, and
-proof; then resume the origin. Three no-progress corrections of that exact
-fingerprint spend only its current strategy: escalate to the next correction
-class inline (shared root cause, diagnostic amplification, boundary redesign)
-with a fresh budget, never asking permission. After three escalations in this
-activation the fingerprint parks; finish all independent work, then stop once.
+Agent-owned backtracking is not a stop condition while its exact causal
+fingerprint has budget: invoke earlier phase, affected Vet, remediation, proof;
+resume origin. Three no-progress corrections spend only that fingerprint's current
+strategy: escalate inline to the next class (shared root cause, diagnostic
+amplification, boundary redesign) with fresh budget, without permission. After
+three escalations per activation it parks; finish independent work, then stop once.
 Preserve reproduction, attempts, and dead ends; never offer `/rite-plan unblock`
 or another routine phase command. A new user-issued `/rite-autocomplete`
 reopens parked fingerprints with fresh escalation; wakes and compaction do not.
@@ -50,11 +48,10 @@ It blocks another execution; retained new Critical/Important evidence still
 enters offline recovery. After affected Vet is READY, pause for fresh action
 authorization and never reuse old GO.
 
-Past evidence being irretrievable is not by itself terminal. If an in-scope
-trusted seam can uniquely discriminate the next failure, run diagnostic-
-amplification Plan repair and narrow Vet inline, then pause for fresh GO before
-one evidence-acquisition attempt. Without a safe seam, escalate to the next
-class or park; only a real human/risk/scope gate stops for a human.
+Past evidence being irretrievable is not by itself terminal. If an in-scope trusted seam
+uniquely discriminates the next failure, run diagnostic-amplification Plan repair
+and narrow Vet inline; pause for fresh GO before one evidence-acquisition attempt.
+Without a safe seam, escalate or park; only a real human/risk/scope gate stops for a human.
 
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"classifier returns owner-busy, exhausted, or existing hard gate","action":"escalate BLOCKED_EXHAUSTED; on WAIT_ACTIVE_OWNER run independent work and recheck; stop on exact BLOCKED_GATE result","return":"unchanged cursor plus fixed route-owned output"} -->
 ## Other stop classes
@@ -74,10 +71,9 @@ class or park; only a real human/risk/scope gate stops for a human.
 - **Clarify:** material `open`/unowned decision coverage or a
   low-confidence high-consequence assumption. Continue the initial interview;
   never arm AFK early.
-- **Seal:** remaining NO-GO after recommended-option questions are closed, with
-  every remaining blocker and fix direction. Never round up to GO. An open
-  recommended-option blocking question is not a Seal stop: resolve it, recover
-  agent-owned findings, then re-enter Seal. A first NO-GO is not a stop either:
+- **Seal:** report remaining NO-GO with every blocker/fix direction; never round
+  up to GO. Resolve recommended-option blocking questions internally; recover
+  agent-owned findings and re-enter Seal. A first NO-GO is not a stop:
   recover every agent-owned blocker (missing or unbound proof, a reviewer gap root
   can close, a finding with a fix direction, a missing `review.md` verdict), then
   re-enter Seal. The unattended `N` to accepting Important risks means repair, not
@@ -95,23 +91,26 @@ class or park; only a real human/risk/scope gate stops for a human.
 - **Resource envelope:** overlapping run or missing AFK after arm still stops.
   Do not stop on `--max-slices`, `max_agents`, `max_minutes`, or `max_review_queue`.
 - **Confidence:** intent still cannot become testable acceptance after interview.
-- **Repeated failure:** not a stop. Escalate; a fully escalated fingerprint parks,
-  and the run stops only once no independent work remains.
-- **Resolver failure:** `devrites-engine state resolve` not found, or nonzero exit.
-  Never hand-edit `questions.md`/`state.md` in its place. Not found stops at once;
-  nonzero allows one identical re-run (the fingerprint is command + exit code +
-  decisive stderr line; an unchanged re-run is not a correction, so no further
-  attempts). Then stop `blocked` with the exact command, exit code, and stderr line,
-  and resume action `/rite-doctor`.
+- **Repeated failure:** not a stop. Escalate; fully escalated fingerprints park.
+  Stop only when no independent work remains.
+- **Resolver failure:** `devrites-engine state resolve` missing or nonzero.
+  Never hand-edit `questions.md`/`state.md` instead. Missing stops immediately;
+  nonzero permits one identical re-run (fingerprint: command + exit code + decisive
+  stderr line; unchanged re-run is no correction, no further attempts). Then stop
+  `blocked`: exact command, exit code, stderr line; resume via `/rite-doctor`.
 
 ## Final GO and durable stop
 
-`--ship`/`--yolo` never authorizes Git. With a flag, complete Ship preflight,
-disclose the exact plan, and stop for literal `GO` plus native approval. Without
-one, stop at Seal GO with `/rite-ship`. Seal GO, AFK, prior approval, and flags
-never satisfy Ship approval.
+With a recorded continuation, no opt-out, and workspace budget, Seal GO stays
+internal: continue without `--ship`, leaving milestones sealed/unshipped. Only the
+final milestone, explicit `continue_sequence: false`, or exhausted sequence cap
+ends green sequence continuation.
 
-A cold-resumable stop records `state.md` status, exact reason, and one resume
-action: the human-owned action, or `/rite-autocomplete` to reopen parked
-fingerprints; the owning question/drift/seal entry explains it. The user-facing line says what stopped
-and, only when applicable, what human action resumes it.
+There, `--ship`/`--yolo` requires [Ship preflight](../../rite-ship/reference/git-ship.md#before-type-go):
+disclose exact plan; stop for fresh literal `GO` plus native approval.
+Without flags, stop at Seal GO with `/rite-ship`. Seal GO never authorizes Git
+or satisfies Ship approval; neither do AFK, prior approval, or flags.
+
+Record cold-resumable `state.md` stops: status, exact reason, one resume action
+(human-owned or `/rite-autocomplete` to reopen parked fingerprints). Explain in
+owning question/drift/seal entry. Tell user what stopped and any required human action.

package/pack/.claude/skills/rite-define/SKILL.md

@@ -147,21 +147,18 @@ Pull these via `Read` when shaping the plan:
    cross-slice boundary names producer, consumer, invariant, integration step, and proof.
    Map each applicable topology/data/integration risk to a slice, failure/recovery path,
    and discriminating proof; a risk cannot live only in the architecture narrative.
-4a. **Persist traceability natively.** The drafter proposes and root writes
+4a. **Persist traceability natively.** Drafter proposes; root writes
    `traceability.md` (`AC/REQ ID → slice → proof → evidence ID → files → status`).
-   Re-read spec, tasks, and proof fields: every ID must exist and every mapping
-   preserve meaning, not just labels. Reject orphans, inventions, and false mappings;
-   `/rite-prove` and `/rite-seal` read this file directly. Reference the plan's
-   `Shared contract proof` rows from existing slice/proof mappings; do not create a second
-   traceability system.
-5. **Complexity and deviations gate:** justify anything outside DevRites defaults (new dep,
-   extra abstraction, second design system) in the plan; if you can't justify it, simplify.
-   **Principles conformance:** read `.devrites/principles.md` (if present) and confirm the
-   approach honors every declared invariant. A plan that conflicts with one is not "a deviation
-   to justify away": either reshape the approach to conform, or, when the conflict is genuine and
-   intended, route it through the Spec Drift Guard plus a recorded decision and a scoped principle
-   exception a human approves. Never ready a plan that silently violates an invariant. (Re-scored
-   as a blocking gate at `/rite-vet`; no file → none declared → nothing to check.)
+   Re-read spec/tasks/proof: require real IDs, meaning-preserving mappings, not
+   just labels. Reject orphans/inventions/false mappings. `/rite-prove` and
+   `/rite-seal` read it directly. Reference plan `Shared contract proof` rows from
+   existing slice/proof mappings; never create a second traceability system.
+5. **Complexity and deviations gate:** justify deviations from DevRites defaults
+   (new dep, extra abstraction, second design system) in plan; else simplify.
+   **Principles conformance:** honor all `.devrites/principles.md` invariants
+   (absent → none). Reshape conflicts; intended genuine conflicts need Spec Drift
+   Guard, a recorded decision, and a human-approved scoped principle exception.
+   Never ready silent violations; `/rite-vet` re-scores this blocking gate.
 6. **Write** `architecture.md`, `plan.md`, `tasks.md`, and `traceability.md` — save the
    accepted bundle under `packets/` and apply it with `devrites-engine state
    apply-bundle <slug> <bundle.json>` before root reconciliation edits; update
@@ -169,27 +166,31 @@ Pull these via `Read` when shaping the plan:
    `flows.md` (**Mermaid-first**). If a richer reviewable visual earns it, emit
    `visual/<flow>.html` + `visual/<flow>.outline.md` after loading matching playbooks from
    [`../devrites-lib/reference/visual-playbooks/index.md`](../devrites-lib/reference/visual-playbooks/index.md)
-   (progressive; never preload all seven), link the pair from `flows.md`, treat outline as
-   SSOT (outline wins), and never require Lavish or a new phase.
-6a. **Cross-artifact gate.** Read spec, tasks, and traceability together: every
-   buildable AC/REQ maps to an existing slice/proof, every slice maps to real
-   acceptance, and names/prose agree. Missing, duplicate, contradictory, or
-   meaning-changing mappings block. Then run
+   (progressive; never preload all seven), link both from `flows.md`; outline is
+   SSOT (wins). No Lavish or new phase required.
+6a. **Cross-artifact gate.** Read spec/tasks/traceability together: each buildable
+   AC/REQ maps to existing slice/proof; each slice maps to real acceptance;
+   names/prose agree. Missing, duplicate, contradictory, or meaning-changing
+   mappings block. Run
    `devrites-engine check task-graph <slug> --strict`; a malformed dependency graph, or a
    shared path written by `hubAdvisoryMin`+ slices with no `Serial rationale:`, blocks
-   before Vet rather than spending a reviewer context on invalid tasks. Resolve each
+   before Vet; no reviewer context for invalid tasks. Resolve each
    `ADVISORY size:`/`hub:`/`chain:` line now (split or seam slice, or a rationale);
    `--strict` refuses the contended plan, the default run only advises.
 7. **Readiness gate** (`plan-template.md`): require CLEAR coverage; complete acceptance,
    wiring, shared-contract proof, applicable outputs, and rollback; risk-first acyclic order;
    justified deviations; and every horizon item present, with blockers resolved, planning
    items resolved/validly spiked, and local/action entries bounded and owned.
-   **Stop and confirm** before code. Render the review-before-code
-   digest first: `Intent` (one sentence from the spec), `Done means` (acceptance coverage x/y),
-   `Plan sanity` (slice count + riskiest boundary/gate), `Expected build interruptions`
-   (`none` or only justified action-time gates), and `Build exactly this?` (yes → approve;
-   no → `/rite-plan revise`). When the human confirms the plan, write `Plan approved: <iso>` to
-   `state.md` (see [state-workspace](../rite-spec/reference/state-workspace.md)).
+   **Standalone: stop and confirm** before code. Render digest: `Intent` (one
+   spec sentence), `Done means` (AC coverage x/y), `Plan sanity` (slice count +
+   riskiest boundary/gate), `Expected build interruptions` (`none` or justified
+   action-time gates), `Build exactly this?` (yes → approve; no → `/rite-plan revise`).
+   Human confirmation writes `Plan approved: <iso>` to `state.md`
+   ([state-workspace](../rite-spec/reference/state-workspace.md)).
+   Under active `/rite-autocomplete`, once this readiness gate is green and no
+   unresolved human-owned decision, irreversible-risk, scope, or access gate remains,
+   root writes autonomous approval to existing `Plan approved: <iso>` cursor and records Autocomplete provenance and rationale in `decisions.md`;
+   never claim human approval. Return internally for `/rite-vet`. Plan approval grants no protected-path, Git, or safety authority.
 
 ## tasks.md slice format
 

package/pack/.claude/skills/rite-plan/SKILL.md

@@ -170,8 +170,13 @@ Before classifying any Reslice, read `.claude/skills/devrites-lib/reference/stan
    the previous vet verdict: set `Phase: plan`, `Next step: /rite-vet`, and, when
    `eng-review.md` exists, set `Implementation readiness: NEEDS REPLAN`. Never retain READY
    across changed planning inputs. Preserve `Plan approved` only for behavior/acceptance-neutral
-   technical repair; clear it for a contract-changing or newly blocking horizon item and
-   reconfirm only after Clarify and Vet close it. If you stopped for drift,
+   technical repair; clear it for a contract-changing or newly blocking horizon item.
+   Settle human decisions and restore current `CLEAR` coverage through Clarify,
+   then obtain renewed Plan approval BEFORE Vet using only
+   [`rite-define`'s readiness/approval rule](../rite-define/SKILL.md), not its initial
+   decomposition. Under active Autocomplete, retain that rule's explicit autonomous
+   provenance in `decisions.md` — never claim human approval. Approval grants no
+   protected-path, Git, or safety authority. If you stopped for drift,
    mark the `drift.md` entry resolved. Never remove or overwrite a valid caller
    return cursor while writing the Plan checkpoint.
 6. After editing `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`,

package/pack/.claude/skills/rite-plan/reference/replan-and-repair.md

@@ -17,8 +17,11 @@ First (or fresh) breakdown into vertical slices. Use `task-breakdown.md` +
 
 A slice proved too large (couldn't build+prove in one cycle, or its goal has multiple
 "and"s). Split into thinner end-to-end slices, preserving acceptance coverage: split
-**by the sizing rule, not to a target count**. Update `tasks.md`; renumber; fix
-dependency edges.
+**by the sizing rule, not to a target count**. Update `tasks.md` under the canonical
+[ID contract](../../devrites-lib/reference/workspace-artifact-schema.md#id-contract):
+preserve unaffected IDs; never renumber or fill retired gaps. New meanings get the
+next unused IDs; record relationships in `decisions.md` or `drift.md` before updating
+downstream dependency edges and traceability.
 
 ## repair (after Spec Drift Guard)
 

package/pack/.claude/skills/rite-resolve/SKILL.md

@@ -39,9 +39,11 @@ Pull these via `Read` when shaping the resolve:
 - **Never overwrite an answered question.** If the qid's `status` is `answered` or
   `dropped`, refuse with the existing answer; ask the user to open a new qid that
   references the old one (the file is the audit trail).
-- **If the answer materially changes scope, architecture, or acceptance**, route it
-  through the Spec Drift Guard (`/rite-plan repair`) **after** writing the answer: do
-  not modify `spec.md` / `plan.md` inside this skill.
+- **Phase-aware handoff after writing the answer:** before planning artifacts exist,
+  recommend the current phase owner's action emitted by `state resolve` (for example,
+  `/rite-spec`), not Plan repair. Once a plan exists, material scope, architecture,
+  or acceptance changes route through the Spec Drift Guard (`/rite-plan repair`).
+  Never modify `spec.md` / `plan.md` inside this skill.
 - **The script is the source of truth.** Always invoke
   `devrites-engine state resolve`. It keeps `questions.md` + `state.md` consistent and emits the
   next-action recommendation. The one `state.md` field this skill may write by hand is the
@@ -66,8 +68,9 @@ Pull these via `Read` when shaping the resolve:
    - `--batch <plain-text-file>`: bulk resolve, one entry per qid (see
      [`reference/answer-protocol.md`](reference/answer-protocol.md) for the batch
      format).
-2. **Load context.** Read `state.md`, `questions.md`, and the relevant slice from
-   `tasks.md`. Confirm the qid is `status: open`. If `state.md` `Status` is not
+2. **Load context.** Read `state.md` and `questions.md`; require the relevant slice
+   from `tasks.md` only for an actual `SLICE-###` question, not `slice: spec | plan`.
+   Confirm the qid is `status: open`. If `state.md` `Status` is not
    `awaiting_human` and the question's `gate` is `blocking`, surface the inconsistency
    before proceeding (don't auto-repair: flag it).
 3. **Apply explicit consent.** Supplying `<qid> "<answer>"`, `--drop`, or `--batch` is the
@@ -86,13 +89,16 @@ Pull these via `Read` when shaping the resolve:
    writer left them.
    **Completion:** zero exit, or the failure reported with no hand edit.
 
-   On resume, and only after a zero exit, also clear or update the unblocked slice's `Slice mode` in `state.md`: if
+   On resume, only for an actual `SLICE-###` question and after a zero exit, clear or
+   update the unblocked slice's `Slice mode` in `state.md`: if
    the answer lets the slice proceed, drop the pause-time `Slice mode` so `/rite-build`
    re-derives it on the next selection; if the answer re-shapes how the slice should be
    built, set `Slice mode` to match.
-5. **Post-resolve hand-off.** If the answer changes product behavior or acceptance →
-   recommend `/rite-plan repair`. Otherwise → recommend the slice's natural next action
-   (typically `/rite-build` for the slice that was awaiting).
+5. **Post-resolve hand-off.** Before planning artifacts exist, recommend the emitted
+   phase-native next action (for example, `/rite-spec`); do not require or create a plan.
+   Once a plan exists, material scope, architecture, behavior, or acceptance changes →
+   recommend `/rite-plan repair` through the Spec Drift Guard. Otherwise → recommend
+   the emitted phase-native next action (typically `/rite-build` for a waiting slice).
    **Completion:** the resolved state contains exactly one next command.
 6. **STOP.** User-invoked `/rite-resolve` does not run `/rite-build` itself: the
    user re-enters the workflow explicitly. A controlling `/rite-autocomplete`
@@ -101,6 +107,7 @@ Pull these via `Read` when shaping the resolve:
    already names a ranked recommended option.
 
 > **Mid-flight discipline.** Don't edit `spec.md` / `plan.md` to "incorporate" the
-> answer. That's `/rite-plan repair`. Don't silently retry a build after the answer
+> answer. Before planning artifacts exist, return to the emitted current phase owner;
+> once a plan exists, material changes need `/rite-plan repair`. Don't silently retry a build after the answer
 > lands: the user types the next command. Don't merge two open questions into one
 > answered entry: each question is independently auditable.

package/pack/.claude/skills/rite-resolve/reference/answer-protocol.md

@@ -87,12 +87,23 @@ writes one block at a time and pauses. When `/rite-resolve` matches the block's
 
 If `state.md`'s `Status` is `awaiting_human` but no `Awaiting human` block matches the
 qid (drift between the two files), `/rite-resolve` flags the inconsistency and refuses
-to silently fix it. Use `/rite-plan repair` to reconcile.
+to silently fix it. Report it to the current phase owner; once a plan exists,
+reconciliation uses `/rite-plan repair`.
+
+## Phase-aware handoff and slice context
+
+Read `tasks.md` and update `Slice mode` only for an actual `SLICE-###` question,
+never for `slice: spec | plan`; the update is allowed only after the writer exits zero.
+Before planning artifacts exist, recommend the current phase owner's action emitted
+by `state resolve` (for example, `/rite-spec`), not Plan repair. Never create planning
+artifacts as part of Resolve.
 
 If the answer materially changes spec/plan, **do not** edit `spec.md` or `plan.md` inside
-`/rite-resolve`. That's `/rite-plan repair`'s job. The skill's post-resolve hand-off
-recommends `/rite-plan repair` whenever the answer touches acceptance criteria, scope,
-or architecture.
+`/rite-resolve`. Once a plan exists, material acceptance, behavior, scope, or architecture
+changes route through the Spec Drift Guard (`/rite-plan repair`); otherwise retain the
+emitted phase-native next action. User-invoked resolutions use `state resolve --human`;
+an internal Autocomplete caller uses the same writer without `--human` and continues.
+Resolve itself never auto-runs the recommended phase owner.
 
 ## Multi-question awaiting
 
@@ -109,8 +120,9 @@ This shape is reserved: current `/rite-build` writes one question per pause.
 
 The user types the next command explicitly. Reasons:
 
-1. The answer may need a `/rite-plan repair` first; auto-continuing would build against
-   a stale plan.
+1. Before planning artifacts exist, the emitted current phase owner must resume;
+   once a plan exists, material changes may need `/rite-plan repair` first.
+   Auto-continuing a build would skip that owner or use a stale plan.
 2. The user may want to `/rite-status` before resuming.
 3. Atomicity: one verb, one mutation. Chaining is a hidden side-effect that hides bugs.
 

package/pack/.claude/skills/rite-review/SKILL.md

@@ -32,7 +32,7 @@ Pull these via `Read` when the diff demands them:
 - [`principles.md`](../devrites-lib/reference/standards/principles.md): declared project invariants (`.devrites/principles.md`); a diff that violates one with no recorded exception is a Critical, blocking finding.
 - [`testing.md`](../devrites-lib/reference/standards/testing.md): confirm that passing tests actually prove the spec.
 - [`agents.md`](../devrites-lib/reference/standards/agents.md): when to fan out to which review subagent.
-- [`security.md`](../devrites-lib/reference/standards/security.md): when input / auth / data / integrations / secrets are in scope.
+- [`security.md`](../devrites-lib/reference/standards/security.md): when the shared [`parallel-dispatch.md`](../devrites-lib/reference/parallel-dispatch.md#roster) roster triggers the security auditor.
 - [`security-checklist.md`](../devrites-lib/reference/standards/security-checklist.md): for the same security-sensitive scope, the compact trust-boundary sweep.
 - [`repository-topology.md`](../devrites-lib/reference/standards/repository-topology.md), [`data-integrity.md`](../devrites-lib/reference/standards/data-integrity.md), [`integration-reliability.md`](../devrites-lib/reference/standards/integration-reliability.md): only
   when the spec applicability map or final diff triggers their ownership/failure/proof checks.
@@ -139,9 +139,9 @@ Pull these via `Read` when the diff demands them:
      [performance-checklist](reference/performance-checklist.md)). No UI/route/style
      paths: record `Not-applicable: no relevant paths in diff`.
 5. **Security:** `devrites-security-auditor`
-   ([security-review](reference/security-review.md)) joins the step-3 cohort when
-   input, auth, data,
-   secrets, or permissions are in the diff; else `Not-applicable: no relevant paths in diff`.
+   ([security-review](reference/security-review.md)) joins the step-3 cohort under the
+   canonical [parallel-dispatch roster trigger](../devrites-lib/reference/parallel-dispatch.md#roster),
+   including a dependency-only diff; else `Not-applicable: no relevant paths in diff`.
 6. **Performance:** `devrites-performance-reviewer`
    ([performance-review](reference/performance-review.md),
    [performance-checklist](reference/performance-checklist.md)) joins the step-3 cohort

package/pack/.claude/skills/rite-review/reference/security-review.md

@@ -1,7 +1,9 @@
 # Security review (feature-scoped)
 
-Apply when the feature involves user input, auth/authz, data storage, external
-integrations, secrets, or permissions. Delegates to `devrites-audit security`.
+Use the canonical [parallel-dispatch roster trigger](../../devrites-lib/reference/parallel-dispatch.md#roster),
+including dependency and integration changes. A dependency-only diff still requires
+`devrites-security-auditor`; a docs-only diff with no matching surfaces records
+`Not-applicable: no relevant paths in diff`. Delegates to `devrites-audit security`.
 
 ## OWASP-Top-10-oriented checks
 

package/pack/.claude/skills/rite-seal/SKILL.md

@@ -11,8 +11,7 @@ user-invocable: true
 
 # /rite-seal: GO / NO-GO
 
-Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible
-actions and close-out.
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible actions/close-out.
 
 ## Authority
 
@@ -22,13 +21,12 @@ security, principles, documentation, observability, deprecation,
 definition-of-done, and [`verification-methods.md`](../devrites-lib/reference/standards/verification-methods.md)
 for coverage-denominator and evidence-status judgment.
 Load [`final-evidence.md`](reference/final-evidence.md) and
-[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
-Follow the shared
-[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
-the reviewed digest and artifact bindings.
+[`go-no-go.md`](reference/go-no-go.md) for proof/verdict safety.
+Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md)
+for reviewed digest/artifact bindings.
 
-The host runs/reconciles named read-only reviewers; engine checks invariants.
-**Standard** is default; **Full** broadens conditional axes per
+Host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** default; **Full** broadens conditional axes per
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Gate
@@ -36,7 +34,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | State | Verdict |
 |---|---|
 | Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
-| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**. Only a human answers `y`; unattended (AFK/autocomplete) keeps **N** and stops for a human if Important remains |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**, unattended keeps **N**. Only humans answer `y`; standalone AFK stops for a human if Important remains. Autocomplete repairs agent-owned findings, re-enters Seal; only human-owned risk acceptance stops for a human |
 | `Critical > 0` | **NO-GO** |
 | Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
 | `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
@@ -49,8 +47,8 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | `check regression` reports an unblessed loss vs the recorded progress baseline | **NO-GO** |
 | `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
 
-A judgment-only criterion needs the human eye; AFK records a validating question
-(`slice: seal`) and stops. Autocomplete never auto-picks it; only a human answers.
+Judgment-only criteria need humans. AFK records a validating question
+(`slice: seal`), stops; Autocomplete never auto-picks.
 
 ## Workflow
 
@@ -68,36 +66,33 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven roster accounts plus proof-runner and doubt-reviewer
    (each engineering lane its own account);
 6. write exactly one candidate binding, then run
-   `devrites-engine check seal <slug>` for structure and identity, never semantics,
-   and, when that check reports a stale readiness-input binding, run
-   `devrites-engine check drift <slug>` before returning to Vet so the repair
-   starts at the named changed, missing, or added input,
-   and `devrites-engine check regression <slug>` to confirm no recorded progress
-   fact was lost since the last checkpoint — `BLOCKED` is NO-GO; `unproven`
-   (no baseline) does not block — plus two separate runs of `devrites-engine check windows <slug>`,
+   `devrites-engine check seal <slug>` for structure/identity, never semantics.
+   For stale readiness-input bindings, run `devrites-engine check drift <slug>`
+   before returning to Vet; start repair at the named changed/missing/added input.
+   Run `devrites-engine check regression <slug>` for progress lost since last
+   checkpoint: `BLOCKED` is NO-GO; `unproven` (no baseline) does not block.
+   Run `devrites-engine check windows <slug>` twice,
    one with `--base <release-base>` and one with `--worktree` (the only mode that scans
    untracked files; never pass both flags in one command, the last one wins) so each deferral marker the feature diff introduced
    carries a `windows.md` waiver row ([`windows.md`](../devrites-lib/reference/standards/windows.md));
-   unwaived hits are NO-GO. The engine already refuses a `gates.md` ledger
-   that is malformed, unmet,
-   stale, unapproved, or abandoned — a seal-side `gates status` reading anything
-   but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
-   --transcripts` on the frozen candidate, so every gate has a transcript bound to
-   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
-   graded other than `exact`: `devrites-engine note check <slug> --repair`
-   re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
-   removed before GO. Repeat each `note: unexecuted driver` line `check seal` prints in the GO/NO-GO reply.
-
-Corrections return through affected Prove/Review before restarting Seal under
+   unwaived hits are NO-GO. The engine rejects malformed, unmet, stale, unapproved, or abandoned
+   `gates.md` ledgers. Unless Seal-side `gates status` says `all-met`, return to
+   Prove: evidence is not current; never attest past it. Before Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate: bind every gate transcript to this
+   digest for the proof runner. It also rejects malformed `notes.md` or non-`exact` anchors:
+   `devrites-engine note check <slug> --repair` re-anchors `moved` notes;
+   fix/remove `stale`/`ambiguous`/`lost` notes before GO. Repeat each `note: unexecuted driver` line `check seal` prints in GO/NO-GO reply.
+
+Corrections pass affected Prove/Review before Seal restarts under
 [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 
-Only repository scripts/CI authorize commands; never guess.
+Only repo scripts/CI authorize commands; never guess.
 
 ## On GO
 
-Set `state.md` `Next step: /rite-ship` and stop. A GO is a verdict, not
-authorization to perform an irreversible action.
+Set `state.md` `Next step: /rite-ship`. Standalone Seal stops. Under active `/rite-autocomplete`, return internally to the caller
+for recorded sequence continuation or [Ship preflight](../rite-ship/reference/git-ship.md#before-type-go),
+no intermediate final reply. GO grants no irreversible-action authority.
 
 ## Output
 

package/pack/.claude/skills/rite-ship/SKILL.md

@@ -45,12 +45,16 @@ if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `se
 1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
    repair. If ACTIVE is flagged, confirm the slug.
 2. **Prepare the exact Git candidate.** Follow
-   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
-   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
-   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
-   From the verified index, build the exact project-conformant message/trailers,
-   branch, tag/PR, commands, and skips.
-2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   [`git-ship.md`](reference/git-ship.md)'s read-only pre-GO ladder: inspect the
+   candidate and existing NUL-delimited staged state/path set, refuse out-of-manifest
+   staged work, and rerun candidate/Seal checks. Do not stage or collapse checkpoints
+   before fresh literal `GO`. From the verified candidate, disclose the exact proposed
+   staging/collapse commands, project-conformant message/trailers, branch, tag/PR,
+   commands, and skips; the existing index need not yet equal the candidate.
+2a. **Credential guard (HIGH blocks).** Before type-GO, run only read-only scans of
+   existing staged blobs and the proposed PR body. This is not a final candidate-clean
+   claim; after literal `GO` and exact staging, repeat the full staged scan before commit.
+   HIGH stops
    and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
    LOW is FYI.
    ```bash
@@ -71,7 +75,10 @@ if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `se
    Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
    stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
    native approval is still required.
-4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+4. On literal GO plus native approval, follow `git-ship.md`'s post-GO ladder:
+   disclosed collapse/staging, staged scope/byte comparisons, candidate/Seal revalidation,
+   and full staged secret scan BEFORE commit. Then commit; verify committed state/path
+   set and exact candidate digest; then push →
    tag/PR as applicable via `git-ship.md`. Record SHA and push state in `ship.md` before
    push (git-ship 7a); a push/tag/PR failure stops, and a rerun resumes at push under
    fresh type-GO. Capture branch, tag/PR URL. Mismatch stops before push/tag; retry

package/pack/.claude/skills/rite-temper/SKILL.md

@@ -11,10 +11,10 @@ user-invocable: true
 
 # /rite-temper: review scope and risk before planning
 
-Review the readied spec for ambition, scope, pre-mortem risk and unnecessary surface. Fold accepted decisions into the canonical contract before
-`/rite-define`. This step is optional for small work and skips low-stakes specs, but
-`/rite-autocomplete` always invokes it. **Read the active workspace first**; if there
-is no readied `spec.md`, tell the user to run `/rite-spec`. Review depth follows
+Review readied spec ambition, scope, pre-mortem risk, and excess surface. Fold
+accepted decisions into the canonical contract before `/rite-define`. Optional for
+small work; skips low-stakes specs; `/rite-autocomplete` always invokes it.
+**Read active workspace first**; no readied `spec.md` → `/rite-spec`. Depth follows
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md);
 the required exact strategy reviewer never changes with profile.
 
@@ -28,24 +28,24 @@ that needs more than the default pre-mortem) selected by the section's risk). Lo
 the spec applicability map triggers that risk family.
 
 ## Operating rules
-- **Raise outcome ambition without expanding the solution unnecessarily.** Solve the
-  underlying problem without adding speculative capability or abstraction.
+- **Raise outcome ambition, not excess solution surface.** Solve the underlying
+  problem without speculative capability/abstraction.
 - **Route every scope change through the Spec Drift Guard.** A scope change takes effect
   only when `spec.md` records the confirmed decision. Growth (`expand`, extra
   acceptance) needs a resolved human `questions.md` qid, so an unattended run holds it
   open. Irreversible-risk still pauses.
-- **Apply maximum caution to hard-to-reverse changes.** Auth, migration, public API, and
-  data-model changes always pause under the irreversible-risk list.
-- **Honest verdict.** Never round "needs work" up to "ready"; record every scope call's *why*.
-- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) decision ownership; only human-owned calls
-  enter the interactive walk.
-- **You write; the reviewer judges.** You are the single canonical writer (`strategy.md` +
-  the spec edits); the reviewer agent is read-only.
-- **Require spec-quality checklists for significant features.** Before hardening,
-  confirm `checklists/<domain>.md` exist and pass ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
-  scope expansion you fold in **adds its own** rows (new Success/Acceptance criteria get
-  checklist rows too). A folded expansion with an unquantified criterion is a CRITICAL
-  failure that reopens the readiness gate.
+- **Maximum caution:** auth, migration, public API, and data-model changes need
+  full review and explicit rollback. Pause only for [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal data-model change.
+- **Honest verdict.** Never round "needs work" to "ready"; record each scope call's *why*.
+- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) ownership;
+  only human-owned calls enter the interactive walk.
+- **You write; reviewer judges.** Sole canonical writer: `strategy.md` + spec edits;
+  reviewer is read-only.
+- **Significant features require spec-quality checklists.** Before hardening,
+  require passing `checklists/<domain>.md` ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
+  folded scope expansion **adds its own** rows, including new Success/Acceptance
+  criteria. An unquantified folded criterion is a CRITICAL failure reopening readiness.
 
 ## Workflow
 0. **Read `.claude/skills/devrites-lib/reference/standards/core.md`**, then