devrites 7.1.1 → 7.2.0

package/pack/generated/codex/skills/rite-seal/SKILL.md

@@ -11,8 +11,7 @@ user-invocable: true
 
 # $rite-seal: GO / NO-GO
 
-Verify final candidate in `seal.md`; `$rite-ship` owns authorized irreversible
-actions and close-out.
+Verify final candidate in `seal.md`; `$rite-ship` owns authorized irreversible actions/close-out.
 
 ## Authority
 
@@ -22,13 +21,12 @@ security, principles, documentation, observability, deprecation,
 definition-of-done, and [`verification-methods.md`](../devrites-lib/reference/standards/verification-methods.md)
 for coverage-denominator and evidence-status judgment.
 Load [`final-evidence.md`](reference/final-evidence.md) and
-[`go-no-go.md`](reference/go-no-go.md) for proof and verdict safety.
-Follow the shared
-[`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md) for
-the reviewed digest and artifact bindings.
+[`go-no-go.md`](reference/go-no-go.md) for proof/verdict safety.
+Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md)
+for reviewed digest/artifact bindings.
 
-The host runs/reconciles named read-only reviewers; engine checks invariants.
-**Standard** is default; **Full** broadens conditional axes per
+Host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** default; **Full** broadens conditional axes per
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
 
 ## Gate
@@ -36,7 +34,7 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | State | Verdict |
 |---|---|
 | Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
-| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**. Only a human answers `y`; unattended (AFK/autocomplete) keeps **N** and stops for a human if Important remains |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**, unattended keeps **N**. Only humans answer `y`; standalone AFK stops for a human if Important remains. Autocomplete repairs agent-owned findings, re-enters Seal; only human-owned risk acceptance stops for a human |
 | `Critical > 0` | **NO-GO** |
 | Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
 | `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
@@ -49,8 +47,8 @@ The host runs/reconciles named read-only reviewers; engine checks invariants.
 | `check regression` reports an unblessed loss vs the recorded progress baseline | **NO-GO** |
 | `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
 
-A judgment-only criterion needs the human eye; AFK records a validating question
-(`slice: seal`) and stops. Autocomplete never auto-picks it; only a human answers.
+Judgment-only criteria need humans. AFK records a validating question
+(`slice: seal`), stops; Autocomplete never auto-picks.
 
 ## Workflow
 
@@ -68,36 +66,33 @@ Follow [`reference/phase-contract.md`](reference/phase-contract.md)
 5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven roster accounts plus proof-runner and doubt-reviewer
    (each engineering lane its own account);
 6. write exactly one candidate binding, then run
-   `devrites-engine check seal <slug>` for structure and identity, never semantics,
-   and, when that check reports a stale readiness-input binding, run
-   `devrites-engine check drift <slug>` before returning to Vet so the repair
-   starts at the named changed, missing, or added input,
-   and `devrites-engine check regression <slug>` to confirm no recorded progress
-   fact was lost since the last checkpoint — `BLOCKED` is NO-GO; `unproven`
-   (no baseline) does not block — plus two separate runs of `devrites-engine check windows <slug>`,
+   `devrites-engine check seal <slug>` for structure/identity, never semantics.
+   For stale readiness-input bindings, run `devrites-engine check drift <slug>`
+   before returning to Vet; start repair at the named changed/missing/added input.
+   Run `devrites-engine check regression <slug>` for progress lost since last
+   checkpoint: `BLOCKED` is NO-GO; `unproven` (no baseline) does not block.
+   Run `devrites-engine check windows <slug>` twice,
    one with `--base <release-base>` and one with `--worktree` (the only mode that scans
    untracked files; never pass both flags in one command, the last one wins) so each deferral marker the feature diff introduced
    carries a `windows.md` waiver row ([`windows.md`](../devrites-lib/reference/standards/windows.md));
-   unwaived hits are NO-GO. The engine already refuses a `gates.md` ledger
-   that is malformed, unmet,
-   stale, unapproved, or abandoned — a seal-side `gates status` reading anything
-   but `all-met` means Prove's evidence is not current; return there, never
-   attest past it. Before the Seal wave, run `devrites-engine gates reverify <slug>
-   --transcripts` on the frozen candidate, so every gate has a transcript bound to
-   this digest for the proof runner. It likewise refuses a malformed `notes.md` or any anchor
-   graded other than `exact`: `devrites-engine note check <slug> --repair`
-   re-anchors `moved` notes; `stale`/`ambiguous`/`lost` ones are corrected or
-   removed before GO. Repeat each `note: unexecuted driver` line `check seal` prints in the GO/NO-GO reply.
-
-Corrections return through affected Prove/Review before restarting Seal under
+   unwaived hits are NO-GO. The engine rejects malformed, unmet, stale, unapproved, or abandoned
+   `gates.md` ledgers. Unless Seal-side `gates status` says `all-met`, return to
+   Prove: evidence is not current; never attest past it. Before Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate: bind every gate transcript to this
+   digest for the proof runner. It also rejects malformed `notes.md` or non-`exact` anchors:
+   `devrites-engine note check <slug> --repair` re-anchors `moved` notes;
+   fix/remove `stale`/`ambiguous`/`lost` notes before GO. Repeat each `note: unexecuted driver` line `check seal` prints in GO/NO-GO reply.
+
+Corrections pass affected Prove/Review before Seal restarts under
 [evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
 
-Only repository scripts/CI authorize commands; never guess.
+Only repo scripts/CI authorize commands; never guess.
 
 ## On GO
 
-Set `state.md` `Next step: $rite-ship` and stop. A GO is a verdict, not
-authorization to perform an irreversible action.
+Set `state.md` `Next step: $rite-ship`. Standalone Seal stops. Under active `$rite-autocomplete`, return internally to the caller
+for recorded sequence continuation or [Ship preflight](../rite-ship/reference/git-ship.md#before-type-go),
+no intermediate final reply. GO grants no irreversible-action authority.
 
 ## Output
 

package/pack/generated/codex/skills/rite-ship/SKILL.md

@@ -45,12 +45,16 @@ if absent, route to `$rite-spec <feature>`. Ship only with current **GO** in `se
 1a. **Health (advisory).** Apply `$rite-doctor` read-only; surface WARN/FAIL without
    repair. If ACTIVE is flagged, confirm the slug.
 2. **Prepare the exact Git candidate.** Follow
-   [`git-ship.md`](reference/git-ship.md): refuse out-of-manifest staged work; stage
-   exact manifest paths only after Seal GO; compare NUL-delimited staged state/path
-   sets, require identical index/worktree bytes, and rerun candidate/Seal checks.
-   From the verified index, build the exact project-conformant message/trailers,
-   branch, tag/PR, commands, and skips.
-2a. **Credential guard (HIGH blocks).** Scan staged blobs and any PR body. HIGH stops
+   [`git-ship.md`](reference/git-ship.md)'s read-only pre-GO ladder: inspect the
+   candidate and existing NUL-delimited staged state/path set, refuse out-of-manifest
+   staged work, and rerun candidate/Seal checks. Do not stage or collapse checkpoints
+   before fresh literal `GO`. From the verified candidate, disclose the exact proposed
+   staging/collapse commands, project-conformant message/trailers, branch, tag/PR,
+   commands, and skips; the existing index need not yet equal the candidate.
+2a. **Credential guard (HIGH blocks).** Before type-GO, run only read-only scans of
+   existing staged blobs and the proposed PR body. This is not a final candidate-clean
+   claim; after literal `GO` and exact staging, repeat the full staged scan before commit.
+   HIGH stops
    and requires rotation/redaction; MEDIUM needs confirmation recorded in `ship.md`;
    LOW is FYI.
    ```bash
@@ -71,7 +75,10 @@ if absent, route to `$rite-spec <feature>`. Ship only with current **GO** in `se
    Literal `GO` proceeds once; anything else records cancellation in `ship.md` and
    stops. Any command/scope/branch/message/tag/PR change or retry needs a fresh prompt;
    native approval is still required.
-4. On GO, commit; verify committed state/path set and exact candidate digest; then push →
+4. On literal GO plus native approval, follow `git-ship.md`'s post-GO ladder:
+   disclosed collapse/staging, staged scope/byte comparisons, candidate/Seal revalidation,
+   and full staged secret scan BEFORE commit. Then commit; verify committed state/path
+   set and exact candidate digest; then push →
    tag/PR as applicable via `git-ship.md`. Record SHA and push state in `ship.md` before
    push (git-ship 7a); a push/tag/PR failure stops, and a rerun resumes at push under
    fresh type-GO. Capture branch, tag/PR URL. Mismatch stops before push/tag; retry

package/pack/generated/codex/skills/rite-temper/SKILL.md

@@ -11,10 +11,10 @@ user-invocable: true
 
 # $rite-temper: review scope and risk before planning
 
-Review the readied spec for ambition, scope, pre-mortem risk and unnecessary surface. Fold accepted decisions into the canonical contract before
-`$rite-define`. This step is optional for small work and skips low-stakes specs, but
-`$rite-autocomplete` always invokes it. **Read the active workspace first**; if there
-is no readied `spec.md`, tell the user to run `$rite-spec`. Review depth follows
+Review readied spec ambition, scope, pre-mortem risk, and excess surface. Fold
+accepted decisions into the canonical contract before `$rite-define`. Optional for
+small work; skips low-stakes specs; `$rite-autocomplete` always invokes it.
+**Read active workspace first**; no readied `spec.md` → `$rite-spec`. Depth follows
 [`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md);
 the required exact strategy reviewer never changes with profile.
 
@@ -28,24 +28,24 @@ that needs more than the default pre-mortem) selected by the section's risk). Lo
 the spec applicability map triggers that risk family.
 
 ## Operating rules
-- **Raise outcome ambition without expanding the solution unnecessarily.** Solve the
-  underlying problem without adding speculative capability or abstraction.
+- **Raise outcome ambition, not excess solution surface.** Solve the underlying
+  problem without speculative capability/abstraction.
 - **Route every scope change through the Spec Drift Guard.** A scope change takes effect
   only when `spec.md` records the confirmed decision. Growth (`expand`, extra
   acceptance) needs a resolved human `questions.md` qid, so an unattended run holds it
   open. Irreversible-risk still pauses.
-- **Apply maximum caution to hard-to-reverse changes.** Auth, migration, public API, and
-  data-model changes always pause under the irreversible-risk list.
-- **Honest verdict.** Never round "needs work" up to "ready"; record every scope call's *why*.
-- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) decision ownership; only human-owned calls
-  enter the interactive walk.
-- **You write; the reviewer judges.** You are the single canonical writer (`strategy.md` +
-  the spec edits); the reviewer agent is read-only.
-- **Require spec-quality checklists for significant features.** Before hardening,
-  confirm `checklists/<domain>.md` exist and pass ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
-  scope expansion you fold in **adds its own** rows (new Success/Acceptance criteria get
-  checklist rows too). A folded expansion with an unquantified criterion is a CRITICAL
-  failure that reopens the readiness gate.
+- **Maximum caution:** auth, migration, public API, and data-model changes need
+  full review and explicit rollback. Pause only for [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal data-model change.
+- **Honest verdict.** Never round "needs work" to "ready"; record each scope call's *why*.
+- **Search before asking.** Apply [`afk-hitl.md`](../devrites-lib/reference/standards/afk-hitl.md) ownership;
+  only human-owned calls enter the interactive walk.
+- **You write; reviewer judges.** Sole canonical writer: `strategy.md` + spec edits;
+  reviewer is read-only.
+- **Significant features require spec-quality checklists.** Before hardening,
+  require passing `checklists/<domain>.md` ([`spec-checklists.md`](../rite-spec/reference/spec-checklists.md)); a
+  folded scope expansion **adds its own** rows, including new Success/Acceptance
+  criteria. An unquantified folded criterion is a CRITICAL failure reopening readiness.
 
 ## Workflow
 0. **Read `.agents/skills/devrites-lib/reference/standards/core.md`**, then

package/pack/generated/codex/skills/rite-temper/reference/scope-modes.md

@@ -1,7 +1,6 @@
 # Scope modes + the two passes
 
-The heart of `$rite-temper`: two ordered passes (heat, then quench), converging on exactly
-one scope mode. Ambition is a **generative** move followed by a **required convergence**: the
+`$rite-temper`: two ordered passes (heat, then quench), converging on one scope mode. Ambition is a **generative** move followed by a **required convergence**: the
 divergence is never the spec; the converged sweet spot is.
 
 ## Pass 1: FORWARD (heat: raise ambition on the outcome)
@@ -41,11 +40,11 @@ Mode selection is the first convergence move. Record the chosen mode + rationale
 | **REDUCE-TO-MVP** | Over-scoped: second-system bloat, ~all must-haves, gold-plating | Hammer scope to the Minimum Usable Subset; move the rest to Non-goals with one-line reasons + revisit notes | Strongest YAGNI alignment. Cutting acceptance is **still a spec change**: record it via the Guard, never a silent trim |
 
 ## Bound ambition by reversibility
-The bigger the bet, the more it must be reversible. Irreversible-risk areas (auth, migrations,
-public API, data model) get the **opposite** of ambition: maximum conservatism, explicit
-rollback, and they **always pause** regardless of mode (the [`afk-hitl.md`](../../devrites-lib/reference/standards/afk-hitl.md) irreversible-risk
-list is honored verbatim). Size big bets so that if the whole thing vanished tomorrow, you'd be
-fine.
+Bigger bets need more reversibility. Auth, migrations, public API, and data-model
+changes need maximum conservatism, full review, and explicit rollback.
+Pause only for actual [canonical irreversible-risk items](../../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+or unresolved human-owned decisions, not an already-approved reversible internal
+data-model change. Size bets to tolerate their disappearance tomorrow.
 
 ## Effort foresight (frame it now, not "later")
 While choosing scope, surface the late-stage questions early: *"What will surprise us at

package/pack/generated/codex/skills/rite-upgrade/SKILL.md

@@ -99,8 +99,13 @@ references, and only current phase contracts needed for the observed gap.
    - a missing/malformed strict manifest, missing/malformed/mismatched evidence binding,
      a browser-binding defect when that file exists, or current candidate-check failure
      → `$rite-prove`;
-   - candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still deferred by
-     an old Ship-era workspace → `$rite-polish`;
+   - required candidate-affecting capability-ledger, `DESIGN.md`, or ADR rollups still
+     deferred by an old Ship-era workspace → `gap`: no admitted route. STOP with an
+     explicit `$rite-polish` handoff for separate user authorization; never invoke
+     those rollup writes inside Upgrade. After authorization outside Upgrade, normal
+     affected Prove → Review → Seal applies;
+   - workspace-only Polish refresh → `$rite-polish` only when its exact paths remain
+     within the admitted gate artifacts and no candidate-affecting rollup is required;
    - a missing, stale, or mismatched review binding → `$rite-review`;
    - a missing, stale, or mismatched seal binding or failed Seal gate → `$rite-seal`.
 

package/pack/generated/codex/skills/rite-vet/SKILL.md

@@ -11,10 +11,10 @@ user-invocable: true
 
 # $rite-vet: review the plan before build
 
-Vet every plan's scope, architecture, quality, proof, performance, failures and writer
-safety. Fold cited technical findings; design Build tests. Temper owns product;
-Vet owns implementation; current `$ARGUMENTS` (`--full`) feeds the depth triggers in
-`reference/depth.md`; profiles never remove the exact plan-reviewer gate
+Vet each plan: scope, architecture, quality, proof, performance, failures, writer
+safety. Fold cited technical findings; design Build tests. Temper owns product,
+Vet implementation. Current `$ARGUMENTS` (`--full`) feeds `reference/depth.md`
+triggers; profiles never remove the exact plan-reviewer gate
 ([orchestration-profiles.md](../devrites-lib/reference/orchestration-profiles.md)).
 
 ## Rules
@@ -41,21 +41,23 @@ plan declares a root-authored executable workflow file, read
 
 ## Invariants
 
-- Review implementation, not ambition. Challenge creep, complexity, proof, and
-  risk without changing accepted product scope.
-- Root owns decisions/writes/readiness; reviewers judge without route policy.
-  Cite findings/confidence; suppress
-  unverified or confidence ≤4 findings under `review-axes.md`.
-  Lens arrows in `eng-lenses.md` are heuristics; band findings only under the
-  four `review-axes.md` names.
-- Auth, migration, public API, and data-model changes use maximum caution and the
-  irreversible-risk stop. Project principles never become trade-offs.
+- Review implementation, not ambition. Challenge creep/complexity/proof/risk
+  without changing accepted product scope.
+- Root owns decisions/writes/readiness; reviewers judge, not route. Cite
+  findings/confidence; suppress unverified or confidence ≤4 findings per
+  `review-axes.md`. `eng-lenses.md` arrows are heuristics; use only the four
+  `review-axes.md` band names.
+- Auth, migration, public API, and data-model changes need maximum caution,
+  full review, and explicit rollback. Pause only for
+  [canonical irreversible-risk items](../devrites-lib/reference/standards/afk-hitl.md#irreversible-risk-list-always-pause)
+  or unresolved human-owned decisions, not an already-approved reversible internal
+  data-model change. Project principles never become trade-offs.
 - **Governance-protected paths** (`.devrites/**`, pack skill/agent trees,
-  `NOTICE.md` generator regions, CI/hook config named in repo docs) require explicit
-  human approval before plan slices may edit them. A slice touching a protected path
-  without approval → Vet **NEEDS CLARIFICATION**.
-- Use the lowest axis band; never average or round thin to ready. Search before
-  asking and resolve reversible technical choices. Ask only human-owned choices.
+  `NOTICE.md` generator regions, documented CI/hook config) require explicit
+  human approval before plan slices edit them; absent approval → Vet
+  **NEEDS CLARIFICATION**.
+- Use lowest axis band; never average/round thin to ready. Search; resolve
+  reversible technical choices; ask only human-owned.
 - Preserve a valid technical return cursor. Agent-owned `NEEDS REPLAN` returns
   internally to its caller, not to the human; on a direct invocation there is
   no caller, so Vet becomes it — save a return cursor
@@ -76,18 +78,16 @@ plan declares a root-authored executable workflow file, read
    assumptions, and state. Require approved Plan and `Decision coverage: CLEAR`;
    otherwise stop for Define or Clarify. Check placement (`get_architecture`),
    blast radius (`trace_path`), and reuse (`search_graph`) per [`code-navigation.md`](../devrites-lib/reference/standards/code-navigation.md).
-1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Every initial
-   pass records an engineering verdict and test-plan coverage. A valid Recovery
-   recheck retains prior depth and enters 1b.
-1a. **Independent initial pass.** Freeze candidate and dispatch the exact fresh
-   read-only plan reviewer — plus developer-experience reviewer for developer
-   surfaces (trigger `devex`) and the current strategy reviewer after significant
-   Temper — in
-   parallel under `../devrites-lib/reference/parallel-dispatch.md`; they are
-   independent read-only passes on one frozen candidate. Missing
-   required account blocks. Run root steps 2–4, including step 3's preflight
-   commands, on the same frozen candidate while the wave is out; reconcile the
-   accounts when they return.
+1. **Select depth.** Apply `reference/depth.md` exactly; never skip. Initial passes
+   record engineering verdict and test-plan coverage. Valid Recovery rechecks
+   retain prior depth; enter 1b.
+1a. **Independent initial pass.** Freeze candidate; dispatch exact fresh read-only
+   plan reviewer, plus developer-experience reviewer for developer surfaces
+   (trigger `devex`) and current strategy reviewer after significant Temper, in
+   parallel under `../devrites-lib/reference/parallel-dispatch.md`: independent
+   read-only passes on one frozen candidate. Missing required account blocks.
+   Meanwhile run root steps 2–4, including step 3 preflight commands, on that
+   candidate; reconcile returned accounts.
 1b. **Recovery recheck.** Require valid return cursor, accepted prior finding,
    exact fingerprint/reproduction, repaired candidate identity, changed
    paths/criteria, affected drift/evidence, and the recorded delta self-check.
@@ -118,14 +118,13 @@ plan declares a root-authored executable workflow file, read
    Do not fall through to steps 2–7. Retain evidenced unchanged coverage; changed
    global contract/uncertain impact requires full applicable review. Reopen historical
    findings only for affected invariants/dependencies.
-2. **Challenge scope.** Apply review-axes §0 and search accepted decisions.
+2. **Challenge scope.** Apply review-axes §0; search accepted decisions.
    Harden to the smallest contract-complete plan, using marked topology action.
    Then verify bidirectional ID-and-meaning traceability across spec/plan/
    tasks/test-plan/traceability, acceptance, terms, principles, anti-slop,
    and conventions; every slice and test-plan row maps to a live requirement
-   and vice versa. Critical gaps and
-   unexcepted principle breaches block; record the challenge result in `eng-review.md`
-   §2 (Scope challenge) after recheck.
+   and vice versa. Critical gaps/unexcepted principle breaches block. Record
+   rechecked result in `eng-review.md` §2 (Scope challenge).
 3. **Preflight Build entry.** Under `reference/artifacts.md`, verify exact
    command/cwd/tool/version/prerequisite; output filters must preserve upstream
    failure. Verify dependencies from authoritative source plus nearest manifest.

package/pack/generated/devin/agents/devrites-upgrade-planner.md

@@ -41,7 +41,10 @@ rules cannot fail.
 - `repairable`: each defect is neutral, preservation-safe, and owned by Clarify,
   Plan repair, Converge, Vet, Prove, Polish, Review, or Seal.
 - `unsupported`: cursor/topology is unofficial; propose no rewrite.
-- `gap`: evidence/contracts are insufficient. Missing input or unverifiable current rules produce `gap`, never `current` or `repairable`.
+- `gap`: evidence/contracts are insufficient or the required delta has no admitted
+  preservation-safe route. Missing input or unverifiable current rules produce `gap`,
+  never `current` or `repairable`. Required candidate-affecting rollup writes also
+  produce `gap`.
 
 ## Rules
 
@@ -55,9 +58,14 @@ rules cannot fail.
   slices beyond the feature ceiling to Plan course-correct (`MVP cut` + named
   continuation sequence); built slices and their evidence stay.
 - For released post-Build work, route a strict-manifest, evidence/browser-binding, or
-  candidate-check defect to Prove; an old Ship-era candidate rollup to Polish; a
-  review-binding defect to Review; and a seal-binding or Seal-gate defect to Seal.
-  Include only applicable owners, ordered Prove, Polish, Review, Seal. Never infer scope
+  candidate-check defect to Prove; a workspace-only Polish refresh to Polish only
+  within Upgrade's admitted gate artifacts; a review-binding defect to Review; and a
+  seal-binding or Seal-gate defect to Seal. Required candidate-affecting capability-ledger,
+  `DESIGN.md`, or ADR rollups are outside admission: return `gap` with an explicit
+  `/rite-polish` handoff for separate user authorization, no writable paths and no admitted route.
+  Never recommend invoking those writes inside Upgrade. After authorization
+  outside Upgrade, normal affected Prove → Review → Seal applies.
+  Include only applicable admitted owners, ordered Prove, Polish, Review, Seal. Never infer scope
   or treat an old pass as current proof. A Prove repair is admissible only when legacy
   scope inputs are present and agree unambiguously; ambiguous candidate scope produces
   `gap` with no route.

package/pack/generated/devin/skills/devrites-debug-recovery/SKILL.md

@@ -54,6 +54,21 @@ has no clear next move. Optional slug selects the active workspace; defaults to
    gone, hypothesis recorded. Classify the failure.
    See [cleanup-and-classify.md](reference/cleanup-and-classify.md).
 
+## Caller-owned records and routing
+
+The controlling root accepts and persists all recovery records in `decisions.md`,
+`evidence.md`, and `## Dead ends` before the next admission/attempt. This rule governs
+all loaded recovery steps, including cleanup and regression instructions. A leaf
+returns the complete class/rationale, proposed routing, hypothesis/probe, baseline,
+exact failure/evidence, causal fingerprint, attempt number and failed idea/dead ends,
+and human predicate in its existing result fields (`gates`, `dead_ends`,
+`follow_ups`, or `Escalation` as applicable); no new result schema is required.
+A leaf never writes `.devrites/**`, changes phase, invokes agents, or commits through
+recovery. Only the controlling root routes to owning rites and supplies later attempts
+with accepted records. Product/test edits remain inside the caller's exact allowed
+paths; recovery never widens them. Commit/PR wording is a returned proposal for the
+authorized owner, not authority to commit.
+
 ## Hard rules
 
 - Quote exact signal-bearing error text with typed redactions (not paraphrase); apply
@@ -80,8 +95,9 @@ has no clear next move. Optional slug selects the active workspace; defaults to
 <!-- workflow-artifact-adapter: {"module":"devrites-lib/reference/standards/workflow-artifacts.md","entry":"durable active failure or ambiguous admitted state","action":"OFFLINE_RECOVERY; correct offline, re-preflight, narrow Vet, retry only under cap","return":"saved caller or exact Plan/Vet route"} -->
 - **Classify before routing** with
   [cleanup-and-classify.md](reference/cleanup-and-classify.md).
-- **Durably record class and rationale** in `decisions.md` and the applicable
-  `evidence.md` or `## Dead ends` entry.
+- **Durably record class and rationale** through [Caller-owned records and routing](#caller-owned-records-and-routing):
+  root persists `decisions.md` and the applicable `evidence.md` or `## Dead ends`
+  entry; leaves return the full payload for root acceptance.
 - **One causal fingerprint, counted by the caller.** Normalize the root cause as
   `<affected boundary>: <failed invariant/failure mechanism>` and bind its minimal
   reproduction plus decisive signal rather than hashing symptom text.
@@ -99,5 +115,6 @@ has no clear next move. Optional slug selects the active workspace; defaults to
   human-only access becomes a human gate; otherwise return the spent strategy and
   reproduction to the caller, which escalates or parks per the
   [retry contract](../devrites-lib/reference/standards/afk-hitl.md#retry-cap-no-progress-loops-and-self-resolve);
-  never request attempt four of the same strategy. While budget remains, coupled failure requiring behavior change routes
-  `/rite-plan repair` inline; behavior-neutral rerouting uses `unblock` inline.
+  never request attempt four of the same strategy. While budget remains, the controlling
+  root routes coupled failure requiring behavior change to `/rite-plan repair` inline;
+  behavior-neutral rerouting uses `unblock` inline. Leaves return proposed routes only.

package/pack/generated/devin/skills/devrites-debug-recovery/reference/cleanup-and-classify.md

@@ -1,5 +1,10 @@
 # Cleanup + classify
 
+All recording and routing below follows
+[`SKILL.md` § Caller-owned records and routing](../SKILL.md#caller-owned-records-and-routing):
+root accepts/persists the full payload and owns transitions; leaves return proposals
+and evidence only, never workspace writes, agent launches, or commits.
+
 ## Classify one causal fingerprint
 
 Fingerprint the diagnosis, not its symptom. Reuse it until evidence disproves it; then
@@ -19,8 +24,9 @@ required before the next consumptive execution pause. Fresh authorization never
 pauses offline diagnosis or correction from retained evidence; never ask for a
 blind retry.
 
-Record class/routing in `decisions.md` and each failed attempt in `evidence.md`
-or `## Dead ends`. Apply the causal-fingerprint and three-attempt rules in
+Root records class/routing in `decisions.md` and each failed attempt in `evidence.md`
+or `## Dead ends`; leaves return the complete record for root acceptance/persistence
+before the next admission. Apply the causal-fingerprint and three-attempt rules in
 [`SKILL.md`](../SKILL.md) Hard rules; record baseline, exact failure,
 hypothesis/probe, attempt number, and any human predicate.
 
@@ -31,4 +37,5 @@ hypothesis/probe, attempt number, and any human predicate.
 - [ ] Regression test passes (or absence of seam is documented).
 - [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix).
 - [ ] Throwaway harnesses deleted (or moved to a clearly marked debug location).
-- [ ] The correct hypothesis is stated in `evidence.md` + the commit/PR message: next debugger learns.
+- [ ] Root persists the correct hypothesis in `evidence.md`; leaves return it plus
+      proposed commit/PR wording for the authorized owner, without committing.

package/pack/generated/devin/skills/devrites-debug-recovery/reference/regression-test.md

@@ -10,10 +10,13 @@ confidence.
 
 ## No correct seam? That itself is the finding
 
-Note it in `evidence.md` and append a follow-up in the active feature's
-`decisions.md` (or run `/rite-plan repair` if the spec is affected): the
-codebase architecture is preventing this class of failure from being locked
-down. Frame it as a *deepening opportunity* ("this module needs a seam at <X>
+Follow [`SKILL.md` § Caller-owned records and routing](../SKILL.md#caller-owned-records-and-routing):
+root notes it in `evidence.md` and appends a follow-up in the active feature's
+`decisions.md` (or routes `/rite-plan repair` if the spec is affected). A leaf
+returns the complete finding, evidence, and proposed route for root acceptance and
+persistence; it never writes the workspace or invokes the rite. The codebase
+architecture is preventing this class of failure from being locked down. Frame it as
+a *deepening opportunity* ("this module needs a seam at <X>
 so this failure can be regression-tested") so the next `/rite-plan` repair or
 architecture cleanup pass has a concrete target.
 

package/pack/generated/devin/skills/devrites-lib/reference/reply-contract.md

@@ -1,8 +1,7 @@
 # DevRites completion reply contract
 
-Use the host's normal response. Do not run a progress renderer, emit session
-telemetry, assign a health score, or repeat state already visible in the durable
-artifact.
+Use normal host responses. No progress renderer, session telemetry, health score,
+or repetition of durable artifact state.
 
 Keep the reply compact and evidence-backed:
 
@@ -21,16 +20,17 @@ Next: <one recommended action>
 Record: <primary durable artifact path>
 ```
 
-`Changed:` is the complete write set, not a highlight reel: every file written
-or edited this turn — workspace artifact and project source alike — appears
-there or inside one named grouped entry, so a reviewer can `git diff` exactly
-those paths. `Record:` then names the single durable artifact a later session
-reads first.
+`Changed:` lists every file written/edited this turn (workspace and source),
+individually or in one named group, so reviewers can `git diff` those paths.
+`Record:` names the single durable artifact the next session reads first.
 
-Mid-flight replies — the turns between completion states — obey the same economy:
+Active `/rite-autocomplete` consumes green checkpoints/`next_action` internally.
+Continue execution or tool progress; never end with a text-only final reply between green phases.
 
-- **Restate position.** The reader cannot hold "step 3 of 5" between turns; name it
-  (`step N of M` / `state: <where things stand>`) rather than asking them to remember.
+Standalone HITL mid-flight replies follow the same economy:
+
+- **Restate position** (`step N of M` / `state: <where things stand>`); do not rely
+  on the reader remembering it between turns.
 - **One next action, doable now.** `Next:` names one concrete action completable in
   under two minutes — a command, a file to open, a yes/no decision. "Want me to
   continue?" is a stall, not an action.