devrites 7.1.1 → 7.2.0

package/pack/generated/dsh/skills/rite-vet/SKILL.md

@@ -0,0 +1,242 @@
+---
+name: rite-vet
+description: Review a defined engineering plan before code. Use for plan vetting or lock-in; not for implementation review or final readiness sealing.
+argument-hint: "[slug] [--cross-model] [--full]"
+user-invocable: true
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/gates.md","rite-vet/reference/review-axes.md","rite-vet/reference/artifacts.md","rite-vet/reference/depth.md","rite-vet/reference/eng-lenses.md","rite-vet/reference/anti-patterns.md"],"triggers":{"afk":["devrites-lib/reference/standards/afk-hitl.md"],"applicability":["devrites-lib/reference/standards/repository-topology.md","devrites-lib/reference/standards/data-integrity.md","devrites-lib/reference/standards/integration-reliability.md"],"assumption-delta":["devrites-lib/reference/standards/assumption-checkpoints.md"],"cross-model":["rite-vet/reference/cross-model.md"],"devex":["devrites-lib/reference/standards/developer-experience.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"elicitation":["devrites-lib/reference/standards/elicitation.md"],"errors":["devrites-lib/reference/standards/error-handling.md"],"grammar":["devrites-lib/reference/standards/spec-grammar.md"],"one-shot":["devrites-lib/reference/standards/one-shot-actions.md"],"performance":["devrites-lib/reference/standards/performance.md"],"principles":["devrites-lib/reference/standards/principles.md"],"reslice":["devrites-lib/reference/standards/acceptance-preserving-reslice.md"],"testing":["devrites-lib/reference/standards/testing.md"],"workflow":["devrites-lib/reference/standards/development-workflow.md"],"workflow-artifacts":["devrites-lib/reference/standards/workflow-artifacts.md"],"yagni":["devrites-lib/reference/standards/patterns.md","devrites-lib/reference/standards/coding-style.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","strategy.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md"],"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/standards/afk-hitl.md","devrites-lib/reference/standards/elicitation.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/workflow-artifacts.md"],"workspaceByRole":{"doubt-reviewer":["spec.md","architecture.md","plan.md","tasks.md","test-plan.md","decisions.md","state.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","decisions.md","state.md"],"plan-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","decision-coverage.md","architecture.md","decisions.md","state.md"],"strategy-reviewer":["brief.md","spec.md","plan.md","decisions.md","decision-coverage.md","strategy.md","state.md"]}} -->
+> Read-set manifest: `devrites-engine context --skills-root .dsh/skills <slug> --phase vet` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-vet: review the plan before build
+
+Vet each plan: scope, architecture, quality, proof, performance, failures, writer
+safety. Fold cited technical findings; design Build tests. Temper owns product,
+Vet implementation. Current `$ARGUMENTS` (`--full`) feeds `reference/depth.md`
+triggers; profiles never remove the exact plan-reviewer gate
+([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
+
+## Rules
+
+Read the active standard from: [`principles.md`](../devrites-lib/reference/standards/principles.md), [`patterns.md`](../devrites-lib/reference/standards/patterns.md) + [`coding-style.md`](../devrites-lib/reference/standards/coding-style.md) (over-engineering / YAGNI rubric, trigger `yagni`),
+[`testing.md`](../devrites-lib/reference/standards/testing.md), [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md), [`performance.md`](../devrites-lib/reference/standards/performance.md), [`error-handling.md`](../devrites-lib/reference/standards/error-handling.md) (trigger `errors`),
+[`development-workflow.md`](../devrites-lib/reference/standards/development-workflow.md), [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md), [`one-shot-actions.md`](../devrites-lib/reference/standards/one-shot-actions.md),
+[`developer-experience.md`](../devrites-lib/reference/standards/developer-experience.md), [`elicitation.md`](../devrites-lib/reference/standards/elicitation.md), and [`definition-of-done.md`](../devrites-lib/reference/standards/definition-of-done.md) (trigger `dod`). Load
+repository topology, data integrity, and integration reliability only when
+triggered (trigger `applicability`). When the plan's scope generalizes an existing boundary — a second
+platform/tenant/source of truth, a newly optional field, a constant turned parameter —
+confirm the [`assumption-checkpoints.md`](../devrites-lib/reference/standards/assumption-checkpoints.md) question (trigger `assumption-delta`)
+was answered and recorded, not skipped-as-negative.
+Before classifying any Reslice, read `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+When a
+plan declares a root-authored executable workflow file, read
+[`workflow-artifacts.md`](../devrites-lib/reference/standards/workflow-artifacts.md).
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Invariants
+
+- Review implementation, not ambition. Challenge creep/complexity/proof/risk
+  without changing accepted product scope.
+- Root owns decisions/writes/readiness; reviewers judge, not route. Cite
+  findings/confidence; suppress unverified or confidence ≤4 findings per
+  `review-axes.md`. `eng-lenses.md` arrows are heuristics; use only the four
+  `review-axes.md` band names.
+- Auth, migration, public API, and data-model changes need maximum caution,
+  full review, and explicit rollback. Pause only for
+  [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal
+  data-model change. Project principles never become trade-offs.
+- **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
+  `NOTICE.md` generator regions, documented CI/hook config) require explicit
+  human approval before plan slices edit them; absent approval → Vet
+  **NEEDS CLARIFICATION**.
+- Use lowest axis band; never average/round thin to ready. Search; resolve
+  reversible technical choices; ask only human-owned.
+- Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
+  internally to its caller, not to the human; on a direct invocation there is
+  no caller, so Vet becomes it — save a return cursor
+  (`return_phase`/`return_next_action`) naming this Vet pass as the caller and
+  invoke `/rite-plan` repair inline under the same fingerprint caps. An
+  agent-owned verdict with budget remaining is never a user-facing command.
+- **Recovery recheck is bounded and batched.** A valid cursor plus open
+  fingerprints enters Recovery recheck; it does not start another Full Vet or
+  repeat unaffected axes/reviewers. One dispatch covers every open fingerprint
+  of the fold — each checked individually — with a mandatory correction-created
+  regression audit.
+- Refuse the rationalizations in [`anti-patterns`](reference/anti-patterns.md).
+<!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"plan declares root-authored executable workflow file","action":"emit exact admission; stale/missing authority uses PLAN_VET_REPAIR","return":"Vet READY cursor or exact technical replan"} -->
+## Workflow
+
+0. **Orient.** Read core. Resolve active slug, require state, and read plan,
+   tasks, spec, decision coverage, optional strategy/design brief, decisions,
+   assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
+   otherwise stop for Define or Clarify. Check placement (`get_architecture`),
+   blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
+1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
+   record engineering verdict and test-plan coverage. Valid Recovery rechecks
+   retain prior depth; enter 1b.
+1a. **Independent initial pass.** Freeze candidate; dispatch exact fresh read-only
+   plan reviewer, plus developer-experience reviewer for developer surfaces
+   (trigger `devex`) and current strategy reviewer after significant Temper, in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
+   read-only passes on one frozen candidate. Missing required account blocks.
+   Meanwhile run root steps 2–4, including step 3 preflight commands, on that
+   candidate; reconcile returned accounts.
+1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
+   exact fingerprint/reproduction, repaired candidate identity, changed
+   paths/criteria, affected drift/evidence, and the recorded delta self-check.
+   Freeze that packet and dispatch each exact owning reviewer once,
+   fresh/read-only, limited to it — all its open fingerprints in that dispatch.
+   Do not rerun broad inventory or unaffected reviewers. Close the prior
+   fingerprint only with discriminating evidence plus an explicit
+   correction-created regression verdict on the touched invariants (acyclic
+   deps, traceability, contract proof, sizing) and every region depending on a
+   changed clause — enumerate dependents via the dep graph and traceability
+   refs, not only patched sites. Otherwise record one no-progress outcome. A
+   different Critical/Important invariant needs exact evidence and a new
+   fingerprint; a Suggestion, Nit, or FYI cannot keep recovery open. Reviewer
+   `Late:` rows on unchanged clauses follow the canonical
+   [late-finding rule](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve):
+   Critical with a failure path → new fingerprint; otherwise `eng-review.md`
+   `## Deferred findings` (mechanism rows become one proof row at step 6). A packet
+   marked `convergence_pressure` accepts an explicit, bounded declared
+   residual/limitation folded into the contract text as closure for a finding
+   marked as a refinement of an already-pinned clause; the recheck may re-raise
+   it only by naming a concrete failure path the declaration omits. A
+   `new_failure_mode` finding is never residual-eligible. A fold whose
+   findings are all `mechanism` kind or Suggestion-or-lower rechecks mechanically at the
+   materialization gate — anchors applied (a clean `state apply-bundle`), mirrors consistent, invariants
+   pass — without a dispatched reviewer; sub-Important findings already
+   cannot keep recovery open. Reconcile
+   shared artifact/readiness gates, then enter step 8 or the next repair.
+   Do not fall through to steps 2–7. Retain evidenced unchanged coverage; changed
+   global contract/uncertain impact requires full applicable review. Reopen historical
+   findings only for affected invariants/dependencies.
+2. **Challenge scope.** Apply review-axes §0; search accepted decisions.
+   Harden to the smallest contract-complete plan, using marked topology action.
+   Then verify bidirectional ID-and-meaning traceability across spec/plan/
+   tasks/test-plan/traceability, acceptance, terms, principles, anti-slop,
+   and conventions; every slice and test-plan row maps to a live requirement
+   and vice versa. Critical gaps/unexcepted principle breaches block. Record
+   rechecked result in `eng-review.md` §2 (Scope challenge).
+3. **Preflight Build entry.** Under `reference/artifacts.md`, verify exact
+   command/cwd/tool/version/prerequisite; output filters must preserve upstream
+   failure. Verify dependencies from authoritative source plus nearest manifest.
+   Run parser-sensitive syntax only in isolated fixtures. Remeasure mutable facts;
+   live evidence wins, conflict marks stale, and unmeasurable conflict is a gap.
+   Record complete SHA-256 provenance. Every behavioral mapping names a positive
+   discriminating assertion and decisive signal, never only exit zero.
+
+   For each consumptive action, bind every `reference/artifacts.md` Consumptive
+   action gates column; every fingerprint identifies one actionable seam; aliasing multiple
+   emit sites is a gap. Preflight observes but need not make future behavior pass,
+   except that a manifest/lockfile edit is dry-run now: before READY run
+   `devrites-engine check preconditions <slug>` (rows with `Run at` `vet`, including each
+   `dependency-dry-run` and preserve-baseline row). A failure folds into Plan repair; only an
+   owner-owned decision becomes a question, batched under the afk-hitl decision-chain rule.
+4. **Audit readiness.** Goal-backward map every requirement, criterion, NFR,
+   interaction, edge/prohibition, and decision row to one slice and executable
+   proof. Verify UX/spec/architecture alignment, contracts, dependency order,
+   slice independence/wiring, prerequisites, failure/observability/rollback, and
+   ownership. The plan's `Shared contract proof` names one reused boundary
+   artifact plus two consuming tests for every changed API/event/schema/provider-
+   consumer seam, or an explicit no-impact statement. Missing, one-sided,
+   duplicated-contract, vague, or non-consuming proof fails closed. Each slice
+   names a fast writer-safe check its wright can run; proof reachable only through
+   root-owned full gates is a `mechanism` finding.
+
+   Technical gaps are `NEEDS REPLAN` and Plan repair — each finding marks
+   itself `new_failure_mode` or names the already-pinned clause/fingerprint
+   it refines, making alias-detection and `convergence_pressure` eligibility
+   mechanical — and carries `kind: contract | mechanism`
+   (`review-axes.md` § Finding kind). Only `contract` findings open a Plan
+   repair; a `mechanism` finding is closed by one `test-plan.md` proof row
+   at step 6 and leaves readiness intact when nothing else is open.
+   Product/risk gaps are
+   `NEEDS CLARIFICATION` and Clarify. Neither becomes a Build qid.
+5. **Review axes.** Apply `review-axes.md` through `eng-lenses.md`. Fold verified
+   behavior-preserving technical findings; walk only human-owned decisions.
+   Profile gate ceiling and Reslice marked action remain authoritative.
+6. **Write outputs.** Produce every artifact in `reference/artifacts.md`. After
+   editing intent/decision/assumption/question owners, re-scan affected coverage,
+   assumptions, uncertainty, and gates. Keep state non-READY. Every scenario and
+   criterion needs positive, discriminating proof; every slice must be one-pass
+   implementable; developer plans (trigger `devex`) write the devex reviewer's
+   predicted scorecard to `devex.md`. Durable commands
+   are portable repository commands, not host wrappers — resolve them with
+   `devrites-engine detect commands` (Makefile/package.json/manifests, no
+   execution) and cite the resolved text verbatim; an `unresolved` slot means
+   name the concrete command in the plan, never guess one.
+   Once the `## Build-entry preflight` table is final, run
+   `devrites-engine gates scaffold <slug>` to seed `gates.md` (one pending gate
+   per `AC-###`; never clobber an existing ledger), then author each gate's
+   `CHECK`/`EXPECT`/`CWD` per artifacts.md §`gates.md` so every runnable oracle
+   is an approved preflight row. Run
+   `devrites-engine gates lint <slug> --strict` and resolve every finding before
+   READY; the readiness check refuses a missing or malformed ledger but does not
+   replace this oracle-quality gate.
+7. **Narrow recheck after edits.** A slice-bound recheck builds its bundle and
+   opens its wave with `--slice <SLICE-ID>` per affected slice (every 5 rechecks
+   per slice need a reslice review, as in Build). **Workflow Artifact bytes-only:**
+   after `OFFLINE_RECOVERY`, a correction leaving every admission/`WA-*` row
+   unchanged records `Workflow Artifact reviewed identity: <re-preflight identity
+   digest>` below the admission block; when `check drift` reports only
+   `reviewed-identity-only`, the reviewer is one fresh `devrites-code-reviewer` on
+   the prior-source→re-preflight diff against those rows (no drafter or plan
+   reviewer); green proceeds to step 8. Otherwise dispatch the exact plan reviewer once per
+   fold — one dispatch covering every open fingerprint, preserving
+   per correction/fingerprint accounting (each checked individually with its
+   accepted findings, changed paths/criteria, new identity, and recorded delta
+   self-check); it must return an explicit correction-created regression
+   verdict over touched invariants plus every dependent of each changed clause
+   (dep-graph and traceability lookup), not only fingerprint closure. Within one correction, no broad
+   third loop. If it changes plan, fold again. A closed input plus a distinct Critical/Important invariant returns
+   that new fingerprint as progress. Then close matrix and rerun ID/meaning audit.
+8. **Build readback and readiness.** Add a cited five-line readback to
+   `eng-review.md` (artifacts.md §7 rows 1–5): outcome/ACs; IN/OUT/must-NOT; UI direction and architecture/
+   critical flow; slice order/first slice; decisive proof/action-time gates. No implementer should need to invent product, architecture, or proof.
+   Contradiction, ownerlessness, or material ambiguity blocks via Clarify or Plan.
+
+   Write exactly one `Implementation readiness: READY`, `NEEDS CLARIFICATION`,
+   or `NEEDS REPLAN`. Root sets READY after every account, checklist,
+   preflight, and sweep is green, including the
+   [`spec-grammar.md`](../devrites-lib/reference/standards/spec-grammar.md) marker sweep whose
+   `marker sweep:` line is recorded in `eng-review.md`; a kept hit blocks READY. Write phase/next step and emit one
+   `Readiness inputs SHA-256` with
+   `devrites-engine check readiness --emit-binding <slug>`; normal readiness check
+   must pass, and it replays Build-entry `check slice` on every unbuilt slice, so
+   READY needs each to pass (fix failures in `/rite-plan`). READY also needs every
+   unbuilt slice's write set closed against the live tree (plan-reviewer
+   dimension 6), so frontier gaps fold in one Plan repair, not one per slice; an
+   affected recheck also closes every unbuilt slice and never defers a closure row. A `sequence_lookahead: yes` workspace also records one
+   `Predecessor readiness: <predecessor> <digest>` line from the predecessor's
+   `--emit-binding` hex; readiness re-checks it. Record the per-input drift baseline alongside it:
+   `devrites-engine check drift <slug> --record` — a later stale binding then
+   names the exact artifact that moved instead of "something changed". An `ADVISORY
+   proportion:` line names a slice whose proof outgrew its ACs: move its rows without a
+   `Proves` spec line to `Deferred hardening` before READY, never deepen them. Technical failure records reproduction, not qid. Human gap awaits
+   Clarify. Optional cross-model follows `reference/cross-model.md` (trigger `cross-model`).
+
+   With READY, no pending remediation, and a valid technical return cursor,
+   restore and consume the return cursor instead of defaulting to Build. Preserve
+   it through admitted remediation. Only a real stop reaches the human.
+9. **Stop at the Vet boundary.** Show Build readback, scope verdict, lowest axis,
+   closed gaps, preflight, action checkpoints, and critical failures. Recommend
+   Build only when READY.
+
+> Do not replace interactive review with artifacts, change acceptance through
+> hardening, score without source evidence, or ignore unexplained complexity.
+
+## Phase exit
+
+**Complete when:** `eng-review.md` records exactly one readiness verdict, readiness
+binding SHA-256 passes, and every required reviewer account is admitted.
+
+**Failing case:** READY written while a required reviewer returned `Outcome: gap` →
+not complete; restore NEEDS REPLAN or dispatch missing reviewer.

package/pack/generated/dsh/skills/rite-vet/reference/anti-patterns.md

@@ -0,0 +1,43 @@
+# /rite-vet: anti-patterns
+
+Read [universal anti-patterns](../../devrites-lib/reference/standards/anti-patterns.md).
+
+Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Phase rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "I'll write all the findings into `eng-review.md` and let the user read it." | Fold verified behavior-preserving findings together and recheck affected closure. Ask human-owned choices with recommendations and await answers. Recording alone resolves nothing; never silently change acceptance or mark unresolved choices READY. |
+| "The plan doesn't handle X: flag it." (without checking) | Quote the line first. If you can't quote where the plan handles X, you also can't be sure it doesn't: force confidence ≤4 and suppress. The "field/case doesn't exist" finding is the most common false positive; the verification gate exists to kill it. |
+| "It's an obvious fix. I'll just edit the plan." | Vet hardens verified plans; topology uses the marked action. |
+| "This dimension is thin but the others are strong: net it's fine." | The gate is the **floor**, not the average. A plan `broken` on test-coverage does not pass because it's `strong` on architecture. |
+| "I can see it's adequate. I'll note the band, the evidence is obvious." | Cite quoted evidence **before** the band; never score first and rationalize later. |
+| "8+ files but it all needs to change: proceed." | Apply `review-axes.md` §0: justify complexity against the smallest contract-complete alternative; fold technical reductions through the marked action. File count does not justify design or require a pause. Ask only for changed scope, behavior, or risk policy. |
+| "There's no test for this, but the user can add one later." | Coverage is designed **now**, before the code, so the build writes tests alongside it. A deferred test is a test that misses the boundary cases writing-it-now would expose. Regressions are non-negotiable. Critical, no question. |
+| "Performance looks fine." | "Looks fine" is not a measurement. A perf finding is "measure X against budget Y" or it's nothing: don't recommend speculative tuning, and don't wave past an N+1 you can quote. |
+| "Cross-model agrees, so apply it." | Consensus is a signal, not proof or approval. Verify the finding against source, then use the same technical-hardening or human-owned decision route; model agreement never authorizes a scope, acceptance, or policy change. |
+
+## Reslice classifier rationalizations
+
+**RSLICE-VET-001** — Slice/topology growth alone does not stop; fewer slices do not prove scope reduction; remediation does not grow product.
+
+## Red flags
+- `eng-review.md` / `test-plan.md` written but `plan.md` / `tasks.md` **not** hardened: the build
+  follows the plan, so the review changed nothing.
+- A finding raised with confidence ≥7 but **no quoted source line**, that defeats the verification gate.
+- Acceptance/product-behavior growth auto-applied in AFK, or an orthogonal human-owned gate that did not pause.
+- A failure-mode table with rows but no verdict column filled: a "no test + no handling + silent" row not marked Critical.
+- Repeating an exhausted causal failure under the shared no-progress rule in
+  [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md), or stopping a
+  distinct cause solely because the total review round exceeds three.
+- The reviewer / cross-model being handed the author's reasoning as independent
+  evidence (defeats the fresh-context point).
+- The skill writing code, implementing a slice, or running the build. That's `/rite-build`. Vet reviews and hardens the plan; it never implements.
+- Re-litigating the **spec's** scope/ambition, that was `/rite-temper`. Vet challenges *implementation* scope only.

package/pack/generated/dsh/skills/rite-vet/reference/artifacts.md

@@ -0,0 +1,248 @@
+# `eng-review.md` + `test-plan.md` templates + fold-back rules
+
+`eng-review.md` records review; `test-plan.md` drives Build. Fold accepted findings
+into `plan.md`/`tasks.md`; prose alone never changes Build.
+
+Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## `eng-review.md`: the record
+
+Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.
+
+```markdown
+# Eng review: <slug>
+Vetted: <iso>   Cross-model: ran (codex) | off
+Implementation readiness: <READY | NEEDS CLARIFICATION | NEEDS REPLAN>
+(`NEEDS REPLAN` is the eng-review field value; `NEEDS_REPLAN` with an underscore
+is the autocomplete/reply-contract routing token — do not conflate.)
+Readiness inputs SHA-256: <64 lowercase hex>
+
+## 1. Depth
+light | full (<trigger that escalated it>)     # every plan is vetted — light or full, never skipped (see depth.md)
+
+## 2. Scope challenge
+- Existing reuse: <findings adopted by the plan>
+- Minimum diff: <accepted | trimmed n; list in NOT-in-scope>
+- Complexity: ok | smell (<n files, m new services) → asked → <reduce|proceed, why>
+- Built-in / completeness / distribution: <flags, with source citations>
+
+## 2a. Build-entry preflight
+| Gate | Command + cwd | Tool/version | Prerequisite owner | Full provenance inputs | Fixture/smoke | Verdict |
+|---|---|---|---|---|---|---|
+| <test/browser/package> | <command · cwd> | <version> | <owner + item> | <tool/manifest/lockfile/config SHA-256> | <what ran> | pass/fail/blocked |
+
+## 2b. Implementation readiness
+| Surface | Requirement/decision | Boundary/wiring | Slice | Proof | Verdict |
+|---|---|---|---|---|---|
+| <journey/data/interface/ops> | <REQ/AC + coverage row> | <contract + key link> | <SLICE-###> | <test-plan row> | ready/gap |
+
+Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
+UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
+
+Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+One-shot evidence completeness: <n/a | pass: action + retained artifact + bounds/sanitization + injective boundary map + per-seam/collision/cleanup fixtures | gap: exact missing proof>
+
+## 3. Axis findings (floor-gated)
+| Axis | Floor band | Findings (sev · confidence) |
+|---|---|---|
+| Architecture | strong/adequate/thin/broken | Critical (9) … |
+| Plan code-quality | … | … |
+| Test-coverage design | … | see test-plan.md |
+| Performance | … | … |
+Suppressed (confidence ≤4, unverified): <count — one line each>
+
+## 4. Failure modes
+| New codepath/boundary | Realistic failure | Partial/unknown effect | Recovery owner/path | Proof? | Silent? | Verdict |
+|---|---|---|---|---|---|---|
+| <path> | timeout / duplicate / race / stale | <state/effect> | <owner/action> | y/n | y/n | ok / **CRITICAL gap** |
+
+## 5. Dependency safety
+<declared order is safe | exact dependency/order correction>
+
+## 6. Native reviewer accounts
+- `devrites-plan-reviewer`: <findings + resolution | evidence-based No-findings>
+- `devrites-strategy-reviewer`: <current Temper verdict | Not-applicable: low-stakes skip>
+- `devrites-devex-reviewer`: <findings + resolution | No-findings | Not-applicable: no developer surface>; predicted scorecard → `devex.md`
+- Recheck: <not-needed | one narrow recheck and result>
+- Cross-model (if --cross-model): <overlap / unique findings — informational until approved>
+- Final: floor = <band>; unresolved → <none | blocking qid>
+
+## 7. Completion summary
+- Outcome: <one sentence; REQ/AC refs>
+- Boundaries: <IN/OUT/must-NOT refs>
+- Design/flow: <UI/n-a; chosen seams/why; happy/error refs>
+- Delivery: <slice order + first>
+- Proof/gates: <test-plan rows; justified action-time gates>
+- Review: scope <accepted/reduced>; architecture <n>; quality <n>; coverage <x/y>,
+  gaps <n>, Critical regressions <n>; failure modes <n>, Critical gaps <n>.
+- Entry/records: preflight <pass/fail/blocked>; checkpoints <none/list>;
+  NOT-in-scope + existing written; plan <hardened | n Guard deltas>.
+```
+
+## `test-plan.md`: the build-readable coverage target
+
+Write/update `.devrites/work/<slug>/test-plan.md`. `/rite-build`'s slice-wright
+writes tests from it; `/rite-prove` walks it against `evidence.md`. Specify
+*what/where* to test, not implementation.
+
+```markdown
+# Test plan: <slug>
+From /rite-vet on <iso>. Runner + conventions: <detected framework + command>.
+
+## Build-entry preflight
+| Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture | Run at |
+|---|---|---|---|---|---|---|
+| <test/browser/package> | <exact command> | <path> | <exit/output> | <service/browser/credential owner> | <tool version + full SHA-256s> | vet / pre-dispatch SLICE-### / action |
+
+`check preconditions` runs `vet` rows (`--slice` runs `pre-dispatch` rows; `action` rows
+never run there) and passes on exit 0. A slice editing a manifest or lockfile needs a
+`dependency-dry-run SLICE-###` row at `vet`: apply the planned pin in an isolated copy, run
+the tidy/lock step, then the project's admission checks. Resource rows only read
+eligibility (swap, cpuset, env var present); they never measure or change the host.
+Link any disposable parser fixture. Preflight values are planning evidence, not post-build proof;
+Prove recaptures the observed command, candidate identity, and result.
+
+## Feature gates
+| Gate | Command | Cwd | Expected |
+|---|---|---|---|
+| <full suite / workspace lint / audit> | <exact command> | <path> | <exit/output> |
+
+Whole-repository rows only: Build runs them per landing
+([tiers](../../rite-build/reference/phase-contract.md#proof-tiers)), Prove on the final candidate.
+
+Commands in this durable artifact are portable repository commands: no RTK or local shell
+aliases, user-specific absolute paths, or temporary proof trees. Evidence records
+the command actually executed.
+
+## Consumptive action gates
+| Action | Why one-shot/consumptive | Retained artifact | Bounds + sanitization | Boundary map + collision proof | Terminal-path fixtures | Cleanup survival | Retry authority |
+|---|---|---|---|---|---|---|---|
+| <exact approved action or n/a> | <one attempt/quota/state/evidence deletion> | <durable operator-controlled path/schema> | <size/cardinality + known/unknown/malformed handling> | <every emit seam -> stable boundary ID; per-seam injection + alias mutant rejected> | <success/known/unknown/hostile> | <assertion> | <none/fresh human authorization> |
+
+Every behavioral row names a positive, discriminating assertion and the decisive output it
+produces. A command or expected exit zero alone is not a behavioral assertion; static gates
+prove only their named static criterion.
+
+## Coverage diagram
+<the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
+
+## Per-gap test requirements
+| ID | Path / flow | Test file (match conventions) | Asserts (input → expected) | Kind | Slice | Priority | Proves |
+|---|---|---|---|---|---|---|---|
+| T1 | <path> | <path/to.test> | <empty list → 200 + []> | unit / E2E / eval | <slice> | P1 / **Regression-Critical** | <AC/REQ/INV/PROH/DEC/EDGE ID or standard § + quoted line> |
+
+Every row's `Proves` quotes the spec line or standard rule it proves. A row that proves
+none is plan-invented hardening: move it to `Deferred hardening`.
+
+## Deferred hardening
+| ID | Hardening | Why no spec line needs it | Promote by |
+|---|---|---|---|
+| D1 | <proof or mechanism> | <reason> | <the spec line an owner would add> |
+
+Deferred rows, like a [deferred slice](../../rite-plan/reference/slicing.md#deferred-slice),
+are not built, proven, or gating in this feature; this table is their follow-up record.
+Nothing is deleted.
+
+## Interaction inventory (UI slices — every element + flow gets an asserting test)
+Enumerate every interactive element and user flow the feature exposes; one row each, none
+skipped. Level per [`testing.md`](../../devrites-lib/reference/standards/testing.md) "Completeness": elements/fields → unit/component, critical
+journeys → one E2E (never one-per-field). `/rite-build` must cover every row; `/rite-prove`
+fails any row with no passing result — an unverified element is a NO-GO, like an unproven criterion.
+```markdown
+| Element / flow | Kind (field/checkbox/select/radio/toggle/button/link/flow) | Level | Test file | Asserts (action → expected) |
+|---|---|---|---|---|
+| email field | field | unit | <form.test> | invalid → error; valid → accepted |
+| login | flow ★★★ | E2E | <login.e2e> | submit → dashboard |
+```
+
+Omit the whole section only for a slice with **no** interactive surface (pure backend/logic).
+
+## Acceptance → test map
+
+- <spec acceptance criterion> → <T1, T3>   # every criterion maps to ≥1 test
+
+For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements name both
+provider- and consumer-side asserting tests and state how each consumes the same canonical
+artifact. Reference the plan row; do not reproduce its contract table here.
+
+## `gates.md`: the acceptance ledger
+
+Write `.devrites/work/<slug>/gates.md` once the preflight table is final —
+`devrites-engine gates scaffold <slug>` seeds one pending gate per `AC-###` in
+`spec.md`; never clobber a ledger that already carries evidence. Grammar,
+evidence binding, and oracle rules live in
+[`gates.md`](../../devrites-lib/reference/standards/gates.md); the engine
+enforces them, so author to the contract, not around it:
+
+- One gate per required outcome; reuse `AC-###` ids so readiness coverage and
+  the ledger name the same set.
+- A runnable gate's `CHECK` must be a `## Build-entry preflight` `Command`
+  verbatim with a matching `Cwd` — a gate whose command is absent from the
+  preflight table can never execute, so add the row first.
+- `EXPECT` names a line only success can print; `gates lint <slug>` flags
+  tautological commands and weak expectations before build.
+- Manual gates (`EVIDENCE` only) are for judgment-bound outcomes; Prove
+  attests them, Seal still requires them checked.
+- Carry a `Tests/proof` row marked `RUN: writer` at define into its gate as
+  `RUN: writer`; never on a CHECK that needs an empty `git diff` or a driver.
+
+## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
+
+```markdown
+| Step / workstream | Modules touched (dir-level) | Depends on |
+|---|---|---|
+| API endpoints | controllers/, serializers/ | — |
+| Worker | jobs/, lib/queue/ | API endpoints |
+
+Lanes:  A: API → Worker (sequential, shared lib/)   ·   B: migration (independent)
+Order:  launch A + B in parallel worktrees → merge → C
+Conflicts: Lanes A and B both touch models/ — sequential or coordinate.
+```
+
+## Fold-back: the part the build follows
+
+Vet hardens the plan. Use the marked action before fold-back.
+
+- **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
+  - `plan.md` §Scope boundaries ← "NOT in scope" items.
+  - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
+  - `plan.md` §Applicability and system ownership ← corrected topology/data/integration
+    routing and each triggered standard's feature-specific output.
+  - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
+    (e.g. refactor-before-feature split).
+  - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.
+  - `tasks.md` slices ← added test requirements (point at `test-plan.md`), added error-handling /
+    failure-mode coverage, tightened slice scope, a split of a refactor+behavior slice into two.
+    Adjust a slice's `Gate:` upward when vet reveals higher stakes (e.g. an unflagged migration).
+  - Re-run the `plan.md` Readiness gate after edits; it must still pass.
+- **Reslice:** marked action only; no local predicate.
+- **`decisions.md`:** one ADR per material call: `context · decision · why-not-the-alternative ·
+  what-would-change-it`.
+- **`assumptions.md`:** every "we'll probably need X" demoted to an explicit assumption-to-verify,
+  never smuggled into scope as a fact.
+
+## Write discipline
+
+- **Single canonical writer.** The skill writes review/test-plan and edits plan/tasks;
+  `devrites-plan-reviewer` is **read-only** and returns findings + bands.
+- **No silent scope.** Growing acceptance without a decision, or dropping a criterion
+  without the Guard, is a defect.
+- Put `eng-review.md` + `test-plan.md` between `tasks.md` and `state.md`. Build/Prove
+  read test-plan as coverage; Review/Seal may consult eng-review for scope/failures.
+- Finish `test-plan.md`, fold-back, and rechecks first. Changes to `brief.md`, `spec.md`,
+  `decisions.md`, `assumptions.md`, or `questions.md` require revalidating the
+  affected decision-coverage rows, assumption audit, residual uncertainty, and closed gates.
+  `open` rows, an unowned material assumption, or an open blocking/escalating question routes
+  `/rite-clarify`/HITL. Re-read affected rows with current evidence; repeat the exact
+  plan-reviewer and applicable strategy/DevEx after edits. Root writes READY only after
+  the checklist. Normal readiness rejects missing/stale bindings; empty tables,
+  placeholders, non-passing preflight rows, or an
+  acceptance criterion with no meaningful test mapping remain native review blockers.
+  After the final recheck, emit the binding with `devrites-engine check readiness
+  --emit-binding <slug>` and replace its one exact line. Never refresh it without Vet.

package/pack/generated/dsh/skills/rite-vet/reference/cross-model.md

@@ -0,0 +1,19 @@
+# `--cross-model`: explicit outside integration
+
+This optional pass runs only when the user supplies `--cross-model` and a
+different-model plugin, MCP server, or other native integration is explicitly
+connected. DevRites does not discover aliases, invent a fallback model, or wrap
+availability.
+
+Give the integration the same immutable `spec.md`, `plan.md`, and `tasks.md`
+candidate, without author reasoning. Ask for evidence-backed findings on
+boundaries, scope/reuse, proof design, performance, reversibility, and failure
+modes. The integration must remain read-only.
+
+If no explicit integration is connected, record `requested but not configured`
+and continue with the native `devrites-plan-reviewer`; absence is neither a pass
+nor a blocker.
+
+Verify every returned finding against the project before accepting it. Record
+only the integration used and accepted evidence in `eng-review.md`; do not
+maintain availability aliases or outside-review telemetry.

package/pack/generated/dsh/skills/rite-vet/reference/depth.md

@@ -0,0 +1,59 @@
+# Depth calibration: always vet, scale the rigor (never skip)
+
+`/rite-vet` runs on **every** plan. Simple reversible work gets a **light pass**;
+big/risky work gets a **full pass**, never a skip. Standalone Vet and Autocomplete
+use these same depth rules.
+
+A four-section deep-dive on a one-file reversible plan is wasteful; rubber-stamping a
+migration-touching plan is dangerous. Match the effort to the stakes, but **always** leave a
+recorded engineering verdict and a coverage plan.
+
+Authority: `.dsh/skills/devrites-lib/reference/standards/acceptance-preserving-reslice.md`.
+
+<!-- BEGIN RESLICE ROUTE-TO-ACTION -->
+- `FOLD` → fold technical topology; invalidate Vet/readiness; affected Vet before Build.
+- `GUARD_AND_REPAIR` → no planning writes; Spec Drift Guard → Clarify → Plan repair → affected Vet.
+- `BLOCKED_INPUT` → no planning writes; exact diagnostic; recover input; reclassify.
+<!-- END RESLICE ROUTE-TO-ACTION -->
+
+## Full pass when ANY trips
+- **Irreversible-risk contact:** the plan touches anything on the [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md) irreversible-risk
+  list: destructive data migration, auth/authz boundary, public-API break, external-service
+  contract, filesystem destruction outside the workspace.
+- **Data model:** new/changed entities, relationships, or persistence shape.
+- **Cross-module blast radius:** the impact (from codebase-memory `trace_path` per
+  `../../devrites-lib/reference/standards/code-navigation.md`, or an honest estimate) crosses
+  module/service boundaries or has many dependents.
+- **Complexity:** `plan.md` touches **>8 files** or adds **>2 new services/modules/classes**.
+- **Multi-slice / multi-day work**, new dependency/pattern/design system. Slice count alone never creates a human pause.
+- **The user asked**, or `--full`.
+
+Full pass = §0 scope challenge + all four axes (each walked finding-by-finding) + the failure-mode
+table + dependency-safety review + the reviewer loop. See [`review-axes.md`](review-axes.md).
+
+## Light pass otherwise (the default for simple plans: still never a skip)
+When none of the full-pass triggers fire, run the **light pass**: a fast but real engineering
+check that still leaves a verdict and a coverage plan. In a handful of lines:
+- **§0 scope challenge, in brief:** confirm minimum diff + reuse (one line each); if a complexity
+  smell or missed reuse appears, escalate that to the full treatment.
+- **One-line scan per axis** (architecture / plan code-quality / test-coverage / performance):
+  "No issues" is a valid result, but you must look and say so per axis, not assume.
+- **Always** produce the acceptance→test map + any regression-Criticals in `test-plan.md`. This is
+  the part that makes "a correct engineering plan for *everything*" real. It never downgrades,
+  light or full.
+- Write the short `eng-review.md` (`Depth: light`) and harden `tasks.md` with the test requirements.
+
+A light-pass finding that turns out to be real **escalates that axis to full treatment** (walk it
+with the human, confidence-banded). Light means *less ceremony*, never *less honesty*.
+
+## In `/rite-autocomplete`
+Autocomplete runs `/rite-vet` after `/rite-define` on **every** feature: light or full per the
+triggers above, **never skipped**. Under the AFK gate ceiling:
+- **Auto-apply (no pause):** hardening findings: added test requirements, error-handling /
+  failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order fixes
+  (these never grow acceptance). Record the rationale in `decisions.md`.
+- **Topology findings:** marked action; slice count alone never pauses.
+- **Stops:** human-owned irreversible-risk findings pause. Technical recovery follows
+  [the canonical retry contract](../../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve),
+  with no depth-specific round limit; no-progress exhaustion blocks, never grants readiness.
+- **Cross-model** is off by default; it runs only if `--cross-model` was explicitly armed.