devrites 7.1.1 → 7.2.0

package/pack/generated/dsh/skills/rite-seal/reference/risk-and-rollback.md

@@ -0,0 +1,56 @@
+# Risk & rollback
+
+Before GO, know how to undo the change and what could go wrong in production.
+
+## Risk scan
+Rank risks; for each, note likelihood × impact and any mitigation:
+- **Topology/ownership**: affected roots/deployables, shared contracts/state/resources,
+  dependency cycles, and intermediate deployment combinations.
+- **Data**: schema changes, migration/backfill interruption, concurrent/duplicate writes,
+  tenant/retention boundaries, destructive operations, and invariant reconciliation.
+- **Security**: new trust boundaries, auth/authz changes, secret handling, new deps.
+- **Compatibility**: API contract changes, breaking changes for existing clients,
+  feature interactions.
+- **Integration/operational**: timeouts/unknown outcomes, retry/idempotency, duplicate/order,
+  partial/invalid responses, provider/queue/cache outage, config/env, and rate limits.
+- **Delivery**: schema/config/application/worker/flag order, environment mismatch,
+  monitoring gap, exposure stages, and time to detect/recover.
+- **UX**: changed flows users rely on; unverified UI.
+
+## Rollback plan (required for risky changes)
+For each risky step, state how to back it out:
+- **Migrations**: is there a reversible `down` / a documented manual revert? Is data
+  loss possible on rollback? If rollback is unsafe, is bounded forward recovery rehearsed?
+- **Feature flag**: can it be disabled without a deploy?
+- **Revert boundary**: can the change be `git revert`-ed cleanly, or does it entangle
+  with other work?
+- **Data**: is there a backup / a way to restore prior state?
+- **External/async effects**: can an unknown outcome be reconciled without duplicating it;
+  who drains/replays/quarantines work and repairs partial state?
+- **Configuration/deployables**: what order restores compatible versions and values at
+  every root/environment?
+
+## Blocking rules
+- A **destructive or data-migration change with no rollback plan** is a **NO-GO**.
+- A data change with unknown invariant/tenant impact, no interruption/retry proof, or no
+  rollback/forward-recovery rehearsal is **NO-GO**.
+- A new/changed external or asynchronous boundary with blind retry, silent partial success,
+  or no outage/backlog recovery and monitoring is **NO-GO**.
+- Unsafe intermediate deployment order, unvalidated required configuration, or no watched
+  rollout signal/owner is **NO-GO** for live exposure.
+- Record the chosen rollback path in `seal.md` → "Risks / Rollback".
+
+## Fresh-context availability
+
+A required review must run in a fresh spawned agent:
+
+- If the named role is unavailable, record the roster skip reason and keep seal
+  **NO-GO**.
+- Never run the reviewer in the root context or log root work as a dispatched review.
+- AFK never auto-accepts a missing reviewer.
+- Security or irreversible-risk scope remains NO-GO while independent review is
+  unavailable.
+
+## Destructive operations
+Confirm any destructive step with the user before shipping. Verify backups exist where
+relevant. Never treat an irreversible action as routine.

package/pack/generated/dsh/skills/rite-seal/reference/seal-template.md

@@ -0,0 +1,32 @@
+# `seal.md` template
+
+```md
+# Seal: <Feature>
+Verdict: GO / NO-GO
+Candidate SHA-256: <64 lowercase hex>
+## Acceptance Criteria
+- <AC>: <evidence>
+## Verification Evidence
+<proof>
+## Reviewer Accounts
+- devrites-spec-reviewer: <outcome>
+- devrites-code-reviewer.<lane>: <outcome>   (one account per engineering lane)
+Lane map: <lane → path set, one per lane>
+- devrites-test-analyst: <outcome>
+- devrites-frontend-reviewer: <outcome>
+- devrites-security-auditor: <outcome>
+- devrites-performance-reviewer: <outcome>
+- devrites-devex-reviewer: <outcome>
+- devrites-proof-runner: <outcome>
+- devrites-doubt-reviewer: <outcome, or Not-applicable: no decision stood>
+## Risks / Rollback
+<risks/recovery>
+## Stood Decisions
+<doubt verdict per stood decision>
+## Blockers / Follow-ups
+Blockers: <none | - blocker>
+Follow-ups:
+- <non-blocking follow-up>
+## Final Decision
+<verdict/reason>
+```

package/pack/generated/dsh/skills/rite-ship/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: rite-ship
+description: Commit, push, tag, archive, or close a sealed feature after /rite-seal GO. Use for repository mutation; not for GO/NO-GO readiness.
+argument-hint: "[feature-slug]"
+user-invocable: true
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/standards/git-workflow.md","devrites-lib/reference/standards/definition-of-done.md","devrites-lib/reference/standards/release/ship-checklist.md","rite-ship/reference/git-ship.md","rite-ship/reference/rollout.md","rite-ship/reference/close-out.md","rite-ship/reference/ship-template.md","rite-ship/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"rootOnly":["devrites-lib/reference/standards/afk-hitl.md"]} -->
+> Read-set manifest: `devrites-engine context --skills-root .dsh/skills <slug> --phase ship` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-ship: ship + close the task
+
+`/rite-seal` decides; `/rite-ship` mutates Git and closes. Read the active workspace;
+if absent, route to `/rite-spec <feature>`. Ship only with current **GO** in `seal.md`.
+
+## Rules consulted (read on demand from `.dsh/skills/devrites-lib/reference/standards/`)
+**Step 0:** Read [`core.md`](../devrites-lib/reference/standards/core.md), then pull as needed:
+- [`git-workflow.md`](../devrites-lib/reference/standards/git-workflow.md): Conventional Commits, atomicity, never-commit list.
+- [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md): AFK pause rules for irreversible actions (the type-GO gate itself: [`git-ship.md`](reference/git-ship.md), [`rollout.md`](reference/rollout.md)). Trigger `afk` — load when `.devrites/AFK` exists.
+- [`definition-of-done.md`](../devrites-lib/reference/standards/definition-of-done.md): acceptance, evidence, drift, rollback, docs.
+- [`release/ship-checklist.md`](../devrites-lib/reference/standards/release/ship-checklist.md): final pass/fail sweep.
+
+## Operating rules
+- **GO is prerequisite.** No current `seal.md` GO → stop at `/rite-seal`.
+- **Ship is candidate-read-only.** Follow
+  [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md).
+  Ship must not change any candidate path or `touched-files.md`; it may write only
+  workspace `ship.md`, `state.md`, and archive bookkeeping. Project/manifest mutation
+  returns through Prove → Review → Seal.
+- **Bindings stay exact.** Rerun candidate/Seal checks; require the digest bound in
+  evidence, optional browser evidence, review, and seal. Any mismatch stops.
+- **Fresh approval.** Disclose the exact Git attempt; literal `GO` authorizes it once.
+  Change/retry means re-prompt. Native approval remains separate/authoritative.
+- **Archive, never delete,** every audit `.md`.
+
+## Workflow
+1. **Orient.** Snapshot; read seal, state, spec, touched files, evidence, and any UI
+   brief. Confirm GO/closed digest, then run:
+   ```bash
+   devrites-engine check candidate <slug>
+   devrites-engine check seal <slug>
+   ```
+   Nonzero/mismatch stops; never reinterpret it.
+1a. **Health (advisory).** Apply `/rite-doctor` read-only; surface WARN/FAIL without
+   repair. If ACTIVE is flagged, confirm the slug.
+2. **Prepare the exact Git candidate.** Follow
+   [`git-ship.md`](reference/git-ship.md)'s read-only pre-GO ladder: inspect the
+   candidate and existing NUL-delimited staged state/path set, refuse out-of-manifest
+   staged work, and rerun candidate/Seal checks. Do not stage or collapse checkpoints
+   before fresh literal `GO`. From the verified candidate, disclose the exact proposed
+   staging/collapse commands, project-conformant message/trailers, branch, tag/PR,
+   commands, and skips; the existing index need not yet equal the candidate.
+2a. **Credential guard (HIGH blocks).** Before type-GO, run only read-only scans of
+   existing staged blobs and the proposed PR body. This is not a final candidate-clean
+   claim; after literal `GO` and exact staging, repeat the full staged scan before commit.
+   HIGH stops
+   and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
+   LOW is FYI.
+   ```bash
+   devrites-engine secret-scan --staged
+   ```
+   Scan a PR body with `devrites-engine secret-scan --stdin` only through non-logging
+   process stdin, then close it—never command/argv/env/heredoc/log/temp file. If that
+   channel is unavailable, stop. **rc=3 → STOP:** no type-GO/commit/push/archive.
+2b. **Reconcile residuals before type-GO.** Scan `strategy.md` deferrals,
+   `decisions.md` FYIs/revisit triggers, unresolved `review.md` non-blocking/if-minor/
+   FYI findings, and `seal.md` follow-ups. Deduplicate only rows with identical
+   obligation + disposition, preserving every source pointer. Each residual appears
+   once in the pending `ship.md` table as `tracked` (durable path/ID) or `no-action`
+   (prior decision or explicit human acceptance + reason/revisit). Type-GO never
+   implies `no-action`. Missing/vague/conflicting disposition blocks; `none` requires
+   empty sources.
+3. **Type-GO.** Render [`git-ship.md`](reference/git-ship.md)'s prompt and wait.
+   Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
+   stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
+   native approval is still required.
+4. On literal GO plus native approval, follow `git-ship.md`'s post-GO ladder:
+   disclosed collapse/staging, staged scope/byte comparisons, candidate/Seal revalidation,
+   and full staged secret scan BEFORE commit. Then commit; verify committed state/path
+   set and exact candidate digest; then push →
+   tag/PR as applicable via `git-ship.md`. Record SHA and push state in `ship.md` before
+   push (git-ship 7a); a push/tag/PR failure stops, and a rerun resumes at push under
+   fresh type-GO. Capture branch, tag/PR URL. Mismatch stops before push/tag; retry
+   needs fresh approval.
+4a. **PR only:** render [`git-ship.md`](reference/git-ship.md#pull-request-body)'s
+   structured body; omit empty sections.
+5. Re-scan the four residual sources; any new/missing/changed item blocks archive.
+   Write [the template](reference/ship-template.md) with shipment metadata and the
+   unchanged pre-GO reconciliation.
+6. **Close.** Set `state.md` phase `done`; follow
+   [`close-out.md`](reference/close-out.md) and run `devrites-engine state close <slug>`
+   to move `.devrites/work/<slug>` → `.devrites/archive/<slug>` and clear `ACTIVE`
+   only if it names this slug; preserve another active feature's cursor.
+   Preserve every `.md`; stable hierarchical instructions need no active-workspace sync.
+   Report the recorded `Next step` verbatim — the exact `/rite-spec <parent>-<n> "<objective>"`
+   when a continuation sequence remains — so the next increment starts from one line,
+   never from chat memory.
+
+> **Mid-flight discipline.** No seal GO, skipped type-GO, out-of-manifest stage, or
+> deleted workspace. Stop and use [`anti-patterns`](reference/anti-patterns.md).

package/pack/generated/dsh/skills/rite-ship/reference/anti-patterns.md

@@ -0,0 +1,28 @@
+# rite-ship: anti-patterns
+
+Load this before any irreversible action: `git commit`, `push`, `tag`, publish, deploy,
+or when tempted to skip the close-out.
+
+Pack-wide rationalizations + red flags: see
+[standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "Seal said GO, so I can just push." | A GO verdict is a decision, not authorization. **Render the type-GO prompt every time** and wait for the literal `GO`. |
+| "I'll push the tag now; type-GO is a formality." | Type-GO is the last safety net before an irreversible action. Always render it: even under auto-trigger. |
+| "`git add -A` is faster than listing touched files." | Stage only what's in `touched-files.md`. `-A` sweeps secrets, scratch files, and out-of-scope edits into the ship. |
+| "The evidence is probably still good." | Recheck the canonical candidate digest and every artifact binding. Any mismatch stops. |
+| "The ledger/DESIGN/ADR update is just ship bookkeeping." | Those are candidate paths. Route the change through Polish, affected Prove, Review, and Seal; Ship is read-only. |
+| "Delete the workspace, the feature's done." | Closing **archives** the workspace (`.devrites/archive/<slug>/`); it never deletes the audit trail. |
+
+## Red Flags
+
+- About to run `git push` / `git tag` without rendering the type-GO prompt.
+- Shipping without a `GO` verdict recorded in `seal.md`.
+- Staging files not listed in `touched-files.md`, or any secret / `.env`.
+- Changing a candidate path or the manifest after Seal.
+- Pushing or tagging before the committed NUL-delimited state/path and digest checks pass.
+- `rm`-ing `.devrites/work/<slug>/` instead of archiving it.
+- Marking the feature `done` but leaving `.devrites/ACTIVE` pointing at it.

package/pack/generated/dsh/skills/rite-ship/reference/close-out.md

@@ -0,0 +1,69 @@
+# Close-out: archive the workspace, free the active slot
+
+Closing a feature means it stops being the *active* work, not that its record is
+deleted. DevRites keeps the audit trail; it just moves out of the live path.
+
+## What close-out does
+
+1. **Mark done.** Set `state.md` → `Phase: done`, `Status: done`, and a `Next step`.
+   When this workspace's `decisions.md` records an unfinished
+   [continuation sequence](../../rite-plan/reference/slicing.md#continuation-workspaces),
+   that step is the **exact** next command — `/rite-spec <parent>-<n> "<objective>"` —
+   and the ship reply prints the same line. Otherwise it stays
+   `/rite-spec <next feature>`. Nothing spawns the continuation automatically:
+   the recorded command is the handoff, so the human starts each increment knowingly.
+2. **Archive.** Run the deterministic script:
+   ```bash
+   devrites-engine state close <slug>
+   ```
+   It moves `.devrites/work/<slug>/` → `.devrites/archive/<slug>/` (every `.md`
+   intact) and clears `.devrites/ACTIVE` **only if** ACTIVE still points at `<slug>`.
+   It refuses to clobber an existing `.devrites/archive/<slug>/` (exit 5).
+3. **Confirm the observed post-state.** The archive exists with its audit records
+   intact and the live workspace is absent. If ACTIVE named this slug, verify it is
+   empty; if it named another feature, verify that value remains unchanged. Only an
+   empty cursor permits the claim "no active feature".
+
+Any nonzero exit stops close-out. Archive collision (exit 5) never authorizes overwrite.
+If clearing ACTIVE fails, the engine attempts to move the archive back; that rollback
+can also fail. Inspect the actual live path, archive and cursor before reporting or
+retrying. Record the command/error and observed locations; never claim restored state
+from an attempted rollback or repeat a move against an unverified destination.
+
+## Sequence predecessors
+
+A deferred-ship sequence leaves earlier milestones sealed and unarchived in
+`.devrites/work/`. The release ship's disclosed plan may close them
+(`devrites-engine state close '<slug>'` per predecessor) after the release commit
+lands; each close is safe because `ACTIVE` names the release workspace. Closing is
+bookkeeping only: the release commit already carries their bytes, and their audit
+records move intact.
+
+## Why archive, not delete
+
+- The `.md` files (`spec`, `decisions`, `assumptions`, `evidence`, `seal`, `ship`, …)
+  are the project's record of *why* the feature is the way it is. A future
+  `/rite-zoom-out` or incident review reads them.
+- Deleting them would make the workflow's own "evidence over confidence" rule a lie.
+
+## Re-opening an archived feature
+
+Before restoring an archive, verify its identity, released cursor form and declared
+workspace schema, that the live destination is absent, and that ACTIVE is empty or
+already names this slug. A collision or another active feature stops restoration;
+do not replace its workspace or cursor. A cursor with no `schema` row predates the
+engine schema and needs a human-approved `devrites-engine migrate <slug>` before the
+engine accepts it; beyond that, age or encoding alone never requires normalization (see
+[workspace-artifact-schema.md](../../devrites-lib/reference/workspace-artifact-schema.md)).
+An unsupported declared schema stops restoration: record the observed version,
+installed engine's recovery diagnostic and pending normalization owner. Do not guess
+a repair or claim `/rite-upgrade` migrates archives; archived/done work is its no-op.
+
+After an authorized restoration, verify the actual paths and cursor and preserve the
+audit records. Reconcile the resumed scope through `/rite-converge`; changes return to
+the applicable earlier lifecycle stage. Historical proof/GO remains historical: a new
+candidate requires fresh Prove → Polish → Review → Seal bindings before Ship. Restoring files
+does not reactivate an old GO.
+
+Cross-feature review is user-invoked through `/rite-learn`; close-out does not
+mine, score, nudge, or write a retrospective ledger.

package/pack/generated/dsh/skills/rite-ship/reference/git-ship.md

@@ -0,0 +1,128 @@
+# The irreversible ship: type-GO + git ladder
+
+`/rite-ship` alone runs irreversible actions. A seal GO is never authorization for Git.
+Require fresh approval for one disclosed attempt plus native permission.
+
+## The type-GO prompt (render verbatim, wait)
+
+```
+Feature:  <slug>
+Verdict:  GO  (seal.md)
+Acceptance criteria proven: <n / total>
+Branch:   <target branch>
+Candidate paths: <exact project-relative paths>
+Checkpoint collapse: <exact `git reset --soft '<merge-base>'` command | skip>
+Collapse slugs: <active slug plus every recorded sequence slug in the range | n/a>
+Stage plan: <exact argv-safe `git add -- '<path>'` command for every manifest row>
+Commit:   <exact git commit command>
+Push:     <exact git push command | skip>
+Tag:      <exact git tag command | skip>
+PR:       <exact PR command, target, title, and body source | skip>
+Close:    <exact `devrites-engine state close '<slug>'` for each sealed sequence predecessor | skip>
+
+Type "GO" exactly to approve this attempt once. Anything else cancels.
+```
+
+Rules:
+- Render every attempt; autocomplete flags only reach this boundary.
+- Only literal `GO` proceeds. Anything else cancels, records
+  `user declined irreversible step at <ts>` in `ship.md`, and stops.
+- `GO` is one-use for the shown scope/commands; changed/retried plans re-prompt.
+- Prior answers, AFK, seal GO, and native approval do not replace type-GO;
+  type-GO never replaces/bypasses native permission or sandbox approval.
+
+## The candidate-safe Git ladder
+
+Follow [`git-workflow.md`](../../devrites-lib/reference/standards/git-workflow.md) and project convention; invent no release flow.
+Candidate identity always comes from `devrites-engine check candidate`; do not
+implement a Git-side hash.
+
+### Before type-GO
+
+Pre-GO is read-only. Do not run the disclosed collapse or staging commands.
+
+0. **Protect existing index work.** Read the NUL-delimited staged state/path set.
+   Refuse a pre-existing staged path outside the manifest; never unstage, stage,
+   reset, or discard user work.
+1. **Analyze checkpoint history without mutating it.** Read the upstream, merge
+   base, commit OIDs, and full subjects. If no checkpoint commit exists, disclose
+   `skip`. A collapse is eligible only when every commit in its range has the exact
+   `WIP(<slug>):` prefix for the validated active slug — or, for a release ship of a
+   deferred-ship sequence, for a slug recorded in the parent's `decisions.md`
+   sequence whose workspace is sealed in this run
+   ([afk-hitl.md § Sequence continuation](../../devrites-lib/reference/standards/afk-hitl.md#sequence-continuation-continue_sequence-max_workspaces));
+   disclose the exact slug set. A different slug, missing colon, broad `WIP(` match,
+   ordinary commit, or mixed history blocks; never reinterpret the range. The recorded
+   ship commit of a resumed ship (step 7a) is not an ordinary commit for that rerun.
+2. **Verify the candidate.** Rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, compare every binding, require the
+   candidate worktree paths to be unchanged, and inspect the existing staged
+   scope. These checks do not prepare the index.
+3. **Prepare the disclosure.** Build argv-safe commands from literal validated
+   paths, without `eval` or command-string interpolation. Run only read-only
+   secret scans of the existing staged state and proposed PR body. Render the
+   literal prompt with the exact optional collapse command or `skip`, exact stage
+   plan, commit, push, tag, and PR commands; then wait.
+
+### After type-GO
+
+1. **Optional checkpoint collapse.** If and only if the prompt disclosed it,
+   recheck that `HEAD`, merge base, and every subject are unchanged and that each
+   subject starts exactly `WIP(<slug>):` for the disclosed slug set, then run the
+   exact disclosed `git reset --soft "$mb"`. Otherwise skip. Any different or mixed
+   subject blocks without mutation.
+2. **Exact staging.** Run `git add -- "$path"` once for each disclosed manifest
+   row, passing each validated project-relative path as its own quoted argv
+   element. Use no glob, directory, `-A`, `.env`, secret, out-of-scope path,
+   `eval`, or interpolated command string. A row that `git check-ignore -v --no-index`
+   matches, tracked or not, is disclosed and staged with `git add -f --`: plain
+   `git add` exits 1 on a named ignored path even after staging it.
+3. **Compare staged scope.** Compare the NUL-delimited output of
+   `git diff --cached --name-status --no-renames -z` to the manifest's exact
+   state/path set. `present` maps only to `A` or `M`; `deleted` maps only to `D`.
+   Reject missing, extra, renamed, duplicated, or differently classified paths.
+4. **Compare staged bytes.** Require no index-to-worktree difference for any
+   manifest path. A dirty manifest path stops; never stage or reinterpret it
+   after this comparison.
+5. **Revalidate immediately before commit.** With no intervening mutation,
+   rerun `devrites-engine check candidate <slug>` and
+   `devrites-engine check seal <slug>`, require the exact candidate digest and
+   every evidence/browser/review/Seal binding, then run the staged secret scan.
+   Any scope, byte, identity, binding, scan, history, or command drift invalidates
+   the one-use approval. Stop and render a fresh type-GO prompt; do not repair the
+   drift under the old approval.
+6. **Commit** one logical change using Conventional Commit and a why-body.
+   Non-trivial work adds applicable `Constraint:`, `Rejected:`, `Confidence:`,
+   `Scope-risk:`, and `Not-tested:` workspace trailers; trivial edits omit them.
+7. **Verify the commit.** Immediately after the authorized commit and before any
+   push or tag, compare
+   `git diff-tree --root --no-commit-id --name-status --no-renames -r -z HEAD`
+   to the manifest using the same exact state/path mapping. Require candidate
+   paths still match `HEAD`, then rerun `devrites-engine check candidate <slug>`
+   and `devrites-engine check seal <slug>` and compare the exact digest again.
+   Any mismatch stops; do not reinterpret it.
+7a. **Record before push.** Write `ship.md` `Commit(s)` and `Push: pending`. A failed
+    push/tag/PR records `failed`, an unanswered or timed-out one `unknown`; stop. Check
+    the remote ref (`git ls-remote`) before any retry. A rerun whose HEAD equals the
+    recorded commit and whose candidate digest is unchanged skips steps 1-7 and
+    prompts a fresh type-GO for only the remaining push/tag/PR commands.
+8. **Push** to the project-conventional target branch.
+9. **Tag / PR** only when project convention requires it; otherwise skip.
+10. **Close sealed predecessors** only when the prompt disclosed them: run the
+    exact `devrites-engine state close '<slug>'` once per predecessor. Each is safe
+    because `ACTIVE` names the release workspace; a nonzero exit stops the rest and
+    is reported, never retried against an unverified destination.
+
+Update `Push:` to `pushed` and record branch and tag/PR URL in `ship.md`.
+
+## Pull request body
+
+When this ship opens a PR, include only applicable sections:
+
+- **Summary:** what shipped and acceptance proven.
+- **Risk & rollback:** migration/auth/destructive risk and reversal from `seal.md`.
+- **What to scrutinize:** highest-blast-radius review stops.
+- **Evidence:** condensed proof plus the archived evidence bundle.
+
+For an agent-owned staged rollout, apply [`rollout.md`](rollout.md). CI-owned deploys
+skip that branch. Delete empty sections rather than writing `N/A`.

package/pack/generated/dsh/skills/rite-ship/reference/rollout.md

@@ -0,0 +1,62 @@
+# Staged rollout and recovery: live deploys only
+
+Load this only when `/rite-ship` itself is explicitly authorized to drive a live
+deployment. Git-only Ship stops before rollout; CI-owned deployment follows the pipeline's
+runbook. A Seal GO or AFK setting never authorizes production action.
+
+## Preconditions before exposure
+
+Record one rollout sheet in `ship.md`:
+
+| Item | Required decision/evidence |
+| --- | --- |
+| Units and order | Repository/deployable, schema, config, application, worker, contract, and flag order; safe old/new combinations. |
+| Exposure stages | Project-native internal/canary/cohort/percentage/region stages and hold window. |
+| Advance/hold/abort signals | Project baseline or SLO, measurement window, minimum sample, exact threshold, and owner. |
+| Recovery | Fastest safe mechanism, steps, owner, measured/rehearsed time, and data/external-effect reconciliation. |
+| Observability | Watched dashboard/query/alert, failure signal, and executable first action. |
+| Authorization | Exact target/action approved for this attempt; no inferred retry permission. |
+
+Do not import generic percentage, latency, error-rate, or time-to-rollback numbers. Use
+accepted product risk, current baseline/SLO, traffic volume, and platform capability. If the
+project has no defensible threshold or signal, the monitoring gap blocks live exposure.
+
+## Choose the smallest reversible mechanism
+
+- A feature flag is useful only when the off path preserves current behavior, both states
+  are tested, disabling it stops the risky effect, and it has an owner/removal trigger.
+  Do not add a flag to a change already reversible by a safe atomic deploy.
+- A flag cannot reverse destructive data/schema effects. Apply
+  [`data-integrity.md`](../../devrites-lib/reference/standards/data-integrity.md) and prove
+  restore or forward recovery separately.
+- External APIs, webhooks, queues, jobs, and caches apply
+  [`integration-reliability.md`](../../devrites-lib/reference/standards/integration-reliability.md):
+  reconcile unknown outcomes, drain/quarantine/replay safely, and protect downstream capacity.
+- Multi-root/service rollout follows
+  [`repository-topology.md`](../../devrites-lib/reference/standards/repository-topology.md);
+  references to another repository never grant write/deploy authority there.
+
+## Stage, observe, decide
+
+At each authorized stage:
+
+1. Verify the intended versions/config/schema and candidate identity on the exact target.
+2. Exercise one critical success path and the declared degradation/recovery signal.
+3. Observe for the recorded window and sample; bind results to the stage and baseline.
+4. **Advance** only when every advance condition holds. **Hold** on ambiguous or
+   insufficient evidence. **Abort/recover** immediately on an abort condition, security or
+   tenant breach, data-integrity violation, unreconciled duplicate/unknown effect, or loss of
+   observability.
+5. Re-verify after recovery; record partial effects and reconciliation. A rollback command
+   exiting zero is not proof the prior state or data was restored.
+
+Never compress stages because an early sample "looks fine," continue through a monitoring
+gap, or retry a failed live action without fresh authorization when the attempt/target changes.
+
+## Completion
+
+Rollout is complete only when full intended exposure meets the recorded window/signals,
+telemetry is still watched, migrations/backfills and queues/reconciliation are settled,
+documentation matches deployed behavior, and temporary flags/compatibility paths have a
+dated removal owner. Otherwise report the exact current stage and remaining risk; do not call
+the launch done.

package/pack/generated/dsh/skills/rite-ship/reference/ship-template.md

@@ -0,0 +1,40 @@
+# `ship.md` template
+
+Write Commit(s)/Push at git-ship step 7a; complete before close-out; it moves to `.devrites/archive/<slug>/ship.md`.
+
+```markdown
+# Ship: <slug>
+
+- Shipped at: <iso>
+- Verdict: GO (seal.md)
+- Branch: <branch>
+- Commit(s): <sha> [<sha> …]
+- Tag/PR: <value|none>
+- Push: <pushed|pending|failed|unknown>
+
+## What shipped
+<project-vocabulary paragraph>
+
+## Acceptance
+- Proven: <n/total> (evidence.md/seal.md)
+- Outstanding: <rows below | none>
+
+## Evidence
+- seal.md — verdict/reconciliation
+- evidence.md — acceptance; browser-evidence.md if UI
+- review.md — review findings
+
+## Follow-up reconciliation
+Checked: strategy.md (if present), decisions.md, review.md, seal.md.
+
+| Source | Item | Disposition | Destination / rationale |
+|---|---|---|---|
+| <file + section> | <item> | tracked | <durable path/ID> |
+| <file + section> | <item> | no-action | <decision or explicit human no-action approval + reason/revisit> |
+
+<If empty: No residual items found.>
+```
+
+Keep pointers short. Acceptance MUST match `seal.md`. Each source residual appears
+once; a missing target, unsupported `no-action`, vague disposition, or conflict blocks
+close-out.