devrites 7.1.2 → 7.2.1

package/pack/generated/dsh/skills/rite-review/reference/five-axis-review.md

@@ -0,0 +1,66 @@
+# Five-axis review: tests first, then six axes
+
+The dispatched `devrites-code-reviewer` checks tests first, then correctness, readability,
+architecture, maintainability, and standards under one severity scale (Critical / Important / Suggestion / Nit / FYI).
+The `/rite-review` inline lead **reconciles** the returned report against the Spec
+axis. It does not re-run these axes itself. This file is the shared definition of
+what "full code-review discipline" covers; use it to judge whether the agent's report
+is complete, and to scope anything the agent could not (e.g. UI-only lenses below).
+
+## 0. Tests (first)
+- Do tests exist for the changed behavior, and do they prove the acceptance criteria?
+- Would they fail if the code were wrong? (No assertion-free or tautological tests.)
+- Edge cases: empty, boundary, error, permission-denied, concurrency.
+- Applicable data/integration/topology cases use a risk-capable boundary; no
+  risk-erasing mock, one-tenant isolation claim, or one-root proof for another root.
+
+## 1. Correctness
+- Does it do what the spec says? Off-by-one, null/undefined, error paths, race
+  conditions, incorrect assumptions about inputs.
+- Does it handle the states the slice promised (loading/empty/error for UI)?
+- Does retry/interruption converge without duplicate effects; do partial/unknown external
+  outcomes, migrations, old/new versions, tenant scope, and rollback follow the accepted plan?
+
+## 2. Readability
+- Can the next engineer understand it without the author? Naming, function length,
+  nesting depth, comments that explain *why* not *what*.
+- Structural smells: a conditional **bolted onto an unrelated flow** (wants its own
+  helper/state/policy: a design smell, not a nit); **repeated conditionals on the same
+  shape** (a missing model or dispatcher).
+
+## 3. Architecture
+- Right seam/boundary? Coupling and cohesion. Does it fit existing patterns or
+  introduce a competing one? Is the abstraction earned (not premature)?
+- Does a refactor **reduce** complexity or just **relocate** it? Count the concepts a
+  reader must hold; a "cleaner" version that leaves that count unchanged isn't cleaner.
+- Is feature-specific logic **leaking into a shared module** instead of its owning layer?
+  Is a **type boundary** left implicit by a gratuitous `any`/cast or a silent fallback?
+- **Name the remedy, not just the smell:** replace a conditional chain with a typed
+  dispatcher, separate orchestration from business logic, move feature logic to its owning
+  package, delete a pass-through wrapper, split a large file. Prefer the move that removes
+  moving pieces over one that re-centralizes the same complexity.
+- Are repository/deployable roots, canonical contract and mutable-state owners, shared
+  resources, and synchronous/asynchronous consistency boundaries preserved without a cycle?
+
+## 4. Security
+- Trust boundaries, input validation, authz checks, secrets handling. Hand off to
+  `devrites-audit security` when input/auth/data/integration is in scope.
+
+## 5. Performance
+- Obvious N+1s, unnecessary work in hot paths, payload sizes. Hand off to
+  `devrites-audit perf` when perf is relevant: **measure before claiming**.
+
+## 6. Maintainability
+- Tests, docs/comments where needed, no dead code added, no TODOs left, consistent
+  with project conventions.
+
+## Frontend axes (if UI)
+- UX flow matches neighbors; all interaction states; a11y (focus, labels, contrast,
+  keyboard); responsive; design-system alignment (no drift, no anti-AI-slop).
+
+## Sizing & speed
+Prefer reviewing roughly one slice / ~100 lines of meaningful change at a time. Larger
+diffs hide defects: recommend splitting rather than rubber-stamping. Watch **file size,
+not just diff size**: a small diff that pushes an already-large file further past a healthy
+boundary wants decomposition (extract helpers / split modules) *first*: decompose, then
+add.

package/pack/generated/dsh/skills/rite-review/reference/nielsen-heuristics.md

@@ -0,0 +1,126 @@
+# Nielsen's 10 usability heuristics: DevRites scoring rubric
+
+A structured UX rubric for `/rite-review` when the feature touches UI. Score each
+heuristic on a **0-4** scale; the per-heuristic scores feed the UX axis of the
+multi-axis review and shape the severity labels on UX findings.
+
+**Score honestly.** 4 means *genuinely excellent*, not "good enough", not "no
+findings". 3 is "good with minor gaps". 2 is "partial: significant gaps". 0-1 is a
+Critical / Important.
+
+## 1. Visibility of system status
+Users know what's happening, when, and where.
+- Loading indicators on async operations.
+- Confirmation when actions complete (save, submit, delete).
+- Progress on multi-step flows.
+- Current location in nav (active state, breadcrumbs).
+- Inline form validation, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No feedback. | Critical actions lack feedback. | Most actions have feedback; gaps. | Consistent feedback; minor lag/lateness. | Anticipates uncertainty; reassures throughout. |
+
+## 2. Match between system and the real world
+The UI speaks the user's language and follows real-world conventions.
+- Domain vocabulary the *user* shares, not the team's internal names.
+- Familiar metaphors where they help (cart, inbox, draft).
+- Information ordered the way the user thinks about it, not the way the DB stores it.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Jargon throughout. | Mostly internal vocabulary. | Mixed: some user terms, some internal. | Clear user terms; a couple of leaks. | Reads like the user's own words. |
+
+## 3. User control and freedom
+Easy escape, undo, and back-out from any state.
+- Cancel / close / back on every modal, route, and form.
+- Undo on destructive operations (delete, archive, reset).
+- No dead-end states ("Error: refresh the page" with no recovery).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Users trapped in states. | Limited escape on key flows. | Most flows reversible; gaps on destructive ops. | Good escape + undo on most flows. | Confident exploration possible everywhere. |
+
+## 4. Consistency and standards
+Internal consistency (this feature matches the project) + external consistency (the
+project matches platform / web norms).
+- Same concept named the same way across screens.
+- Same affordance (button vs link vs row) means the same thing across screens.
+- Platform conventions respected (browser back, focus rings, native controls where appropriate).
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Inconsistent vocabulary + affordances. | Major drift from neighbours. | Mostly aligned; visible drift. | Well-aligned; minor inconsistencies. | Indistinguishable from the rest of the product. |
+
+## 5. Error prevention
+Designed so the user *can't* make the error in the first place.
+- Confirmations on destructive operations.
+- Disabled / hidden actions when they're not valid.
+- Smart defaults; constrained inputs (date pickers vs free text).
+- Field formats validated as you type, not just on submit.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Many error-prone flows. | Some preventable errors still possible. | Common errors prevented; edge cases slip. | Most errors prevented before they occur. | Errors are genuinely rare; the easy path is the safe path. |
+
+## 6. Recognition rather than recall
+Show options; don't force the user to remember them.
+- Visible choices rather than free-text "type the command".
+- Recently-used values surfaced.
+- Labels persist (don't disappear after focus).
+- Context (where the user is, what they were doing) survives navigation.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Heavy recall required. | Critical flows demand recall. | Mixed: some visible, some hidden. | Mostly recognition; minor recall asks. | Pure recognition; nothing the user needs is hidden. |
+
+## 7. Flexibility and efficiency of use
+Novices and experts both productive.
+- Keyboard shortcuts on power flows; visible affordances for everyone else.
+- Sensible defaults for the common case; depth available when needed.
+- Saved views / templates / bulk actions on tasks done repeatedly.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| One-size-fits-all; no acceleration. | Limited shortcuts; novice-only. | Some efficiency for experts; uneven. | Strong shortcut + default story; small gaps. | Both populations measurably fast. |
+
+## 8. Aesthetic and minimalist design
+Every element earns its place. No decorative noise.
+- One primary action per screen / surface.
+- Visual hierarchy carries the eye to the next step.
+- Decoration in service of meaning, not for its own sake.
+- Whitespace used as a tool, not because the page felt empty.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cluttered; no hierarchy. | Visible noise / competing actions. | Generally clean; some clutter. | Strong hierarchy; minor noise. | Every pixel deliberate; nothing extraneous. |
+
+## 9. Help users recognize, diagnose, and recover from errors
+Error states are designed, not afterthoughts.
+- Errors named in user language ("Your card was declined") not codes ("Stripe 4002").
+- A concrete next step ("Try a different card" + "Use PayPal instead").
+- Inline location: the error appears next to the field / action that caused it.
+- No blame: the message describes the situation, not the user.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| Cryptic codes / silent failures. | Errors visible but unhelpful. | Some errors recoverable; others stranded. | Most errors actionable; minor gaps. | Every error has a clear cause + clear next step. |
+
+## 10. Help and documentation
+Users can find what they need without leaving the surface.
+- Inline hints on novel patterns.
+- Search-friendly help for deeper questions.
+- No help is needed for the common path, and that's documented as a goal.
+
+| 0 | 1 | 2 | 3 | 4 |
+|---|---|---|---|---|
+| No in-product help. | Help exists but hidden / stale. | Help exists; quality uneven. | Good inline help; reachable docs. | Help feels native; users barely need it. |
+
+## Reporting
+
+In `/rite-review` output, surface heuristics scoring **≤2**, plus any 3 with a specific
+noted gap, as findings; every score feeds the UX axis. Each surfaced finding gets a
+severity label per [`SKILL.md`](../SKILL.md).
+
+The rubric is descriptive, not gating. A score of 2 on aesthetic-minimalist isn't
+an automatic NO-GO; the `rite-seal` gate is `Critical == 0`, not "every heuristic
+≥ 3".

package/pack/generated/dsh/skills/rite-review/reference/performance-checklist.md

@@ -0,0 +1,99 @@
+# Performance checklist (baseline for the perf reviewer)
+
+The minimum baseline `devrites-performance-reviewer` checks against, in feature scope. It
+is a checklist, not a mandate: flag what the diff touches or what a measurement
+flags, never a project-wide sweep. The philosophy lives in
+[`standards/performance.md`](../../devrites-lib/reference/standards/performance.md) (measure first). This file is the
+concrete what-to-look-for.
+
+## Core Web Vitals targets
+
+| Metric | Good | Needs work | Poor |
+|---|---|---|---|
+| LCP: Largest Contentful Paint | ≤ 2.5s | ≤ 4.0s | > 4.0s |
+| INP: Interaction to Next Paint | ≤ 200ms | ≤ 500ms | > 500ms |
+| CLS: Cumulative Layout Shift | ≤ 0.1 | ≤ 0.25 | > 0.25 |
+
+A CWV value only counts when it carries a source: `Field (CrUX)`, `Lab (Lighthouse)`, or
+`Trace (DevTools)`. No source → it's a Source-mode hypothesis, not a measurement.
+
+## Frontend (only when the feature is UI-facing)
+
+Identify the framework first; apply only its idioms.
+
+- **Images:** modern format (WebP/AVIF); responsive `srcset`/`sizes`; explicit
+  `width`/`height` to reserve space (CLS); below-the-fold `loading="lazy"`; the LCP image
+  gets `fetchpriority="high"` and is **not** lazy-loaded.
+- **JavaScript:** initial bundle stays small (≈200KB gzipped is the usual line); code-split
+  routes and heavy features; no blocking script in `<head>` without `defer`/`async`; break
+  long tasks (>50ms) so the main thread stays free (the main INP lever); `memo`/`useMemo`/
+  `useCallback` only where profiling shows a win, not wrapped over everything.
+- **CSS:** critical CSS not render-blocking; no per-render CSS-in-JS runtime cost in prod.
+- **Fonts:** 2-3 families max; WOFF2; self-hosted where possible; preload the LCP font;
+  `font-display: swap`; subset with `unicode-range`.
+- **Rendering:** no layout thrashing (batch reads, then writes); animate `transform`/
+  `opacity` only; virtualize long lists; `content-visibility: auto` for off-screen sections;
+  check bfcache eligibility and restoration in supported browsers. Avoid `unload`
+  handlers, but preserve sensitive-data cache policy: `Cache-Control: no-store`
+  eligibility varies by browser and conditions. Never remove a security control
+  for a performance score; test account-switch and restored-page behavior.
+- **CLS attribution:** name the initiator (content inserted above, late
+  validation message, font swap), not only the shifted element, and exercise the
+  post-load state; a navigation-only run misses it. A CLS change is layout stability,
+  never reported as speed or latency. **Failing case:** space reserved on the shifted
+  card while the banner inserted above still causes the shift.
+
+## Backend (every feature, UI or not)
+
+- No N+1 queries; eager-load / join / batch instead.
+- Compare query plans and representative measurements before/after adding an
+  index; account for write and storage costs, not just filter/sort columns.
+- Before raising connection caps, count pools across processes and instances,
+  inspect held connections and transactions, and compare aggregate demand with
+  database capacity.
+- List endpoints paginate: never an unbounded `SELECT *`.
+- Consider caching or hoisting measured repeated work only when its freshness
+  and sensitive-data contract allows it. Keys include every varying input and
+  principal when results differ; bound eviction and coalesce concurrent misses
+  where needed. Distinguish genuine negative results from origin failures; never
+  cache an outage as absence.
+- Responses compressed (gzip/brotli); bulk operations instead of a loop of single calls.
+
+## Network
+
+- Static assets cached with a long `max-age` + content hashing.
+- Known origins `preconnect`-ed; no unnecessary redirects; HTTP/2 or HTTP/3 where available.
+
+## AI-codegen perf smells (fold into the area above, not a separate finding category)
+
+- State duplicated instead of lifted; effects with over-broad deps that re-run needlessly.
+- Sequential `await`s where `Promise.all` / parallel fetch fits, only after
+  authorization: a reorder never starts a private fetch before the auth check.
+  **Failing case:** after a "waterfall fix" an unauthenticated request reaches the
+  private fetch → Critical.
+- Over-fetching "just in case"; redundant calls a dedup would collapse.
+- Defensive memoization wrapping cheap components: cost with no benefit.
+
+## Modern APIs to consider (one-liners: reach for these, don't gate on them)
+
+`scheduler.yield()` to keep input responsive in long loops · Speculation Rules for
+prefetch/prerender · View Transitions on SPA navigation · Long Animation Frames (LoAF) for
+production INP attribution · `fetchpriority` on critical non-image resources.
+
+## Measurement commands (name these in Source mode; don't run installs in review)
+
+```bash
+# Lighthouse (lab)
+npx lighthouse <url> --output json --output-path ./report.json
+# or via the Chrome DevTools MCP CLI, no install:
+npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json > report.json
+
+# Bundle size
+npx vite-bundle-visualizer        # Vite
+npx webpack-bundle-analyzer stats.json   # webpack
+
+# Field data: CrUX / PageSpeed Insights (real users, p75) — needs an API key
+```
+
+Field is what real users experienced; lab is one synthetic run. Don't present one as the
+other.

package/pack/generated/dsh/skills/rite-review/reference/performance-review.md

@@ -0,0 +1,14 @@
+# Performance review (feature-scoped)
+
+Apply only when a stated budget or visible regression risk makes performance relevant.
+The canonical measurement, pitfall, optimization, and scope rules live in
+[`performance.md`](../../devrites-lib/reference/standards/performance.md); apply every
+one before filing a performance finding.
+
+The agent runs **Source mode** (static scan, findings tagged `potential` + the verify
+command) or **Measured mode** (real CWV numbers → a source-labeled scorecard). Baseline
+checks + measurement commands: [`performance-checklist.md`](performance-checklist.md).
+
+## Labels
+A perf issue that breaches a stated budget is **Important** or **Critical**; a
+speculative micro-optimization is a **Suggestion** at most.

package/pack/generated/dsh/skills/rite-review/reference/security-review.md

@@ -0,0 +1,44 @@
+# Security review (feature-scoped)
+
+Use the canonical [parallel-dispatch roster trigger](../../devrites-lib/reference/parallel-dispatch.md#roster),
+including dependency and integration changes. A dependency-only diff still requires
+`devrites-security-auditor`; a docs-only diff with no matching surfaces records
+`Not-applicable: no relevant paths in diff`. Delegates to `devrites-audit security`.
+
+## OWASP-Top-10-oriented checks
+
+This is the **single-sourced OWASP-web checklist** both `/rite-review` and the
+`devrites-security-auditor` agent apply (trust-boundary + the OWASP **LLM** Top 10 live in
+[`standards/security.md`](../../devrites-lib/reference/standards/security.md)). Keep the enumeration here; don't restate it.
+
+- **Injection:** parameterized queries; no string-built SQL/shell/HTML; validate &
+  encode at boundaries.
+- **Broken access control:** every sensitive action checks authz server-side; no
+  trusting client-supplied IDs/roles/tenant; no IDOR, cross-tenant read/write/cache/search,
+  confused-deputy path, or privilege change without re-authorization.
+- **Auth / session:** secure session handling; no credentials in code/logs; correct
+  password/token handling.
+- **Sensitive data:** PII/secrets not logged or returned; encryption where required;
+  least data exposed.
+- **SSRF / external calls:** validate/allowlist outbound URLs; timeouts; don't reflect
+  untrusted input into requests.
+- **Misconfiguration:** safe defaults; debug off; CORS scoped; security headers as the
+  project uses them.
+- **Files / request integrity:** resolved paths remain below the allowed root across
+  traversal/encoding/symlink/archive cases; state-changing browser requests use the
+  framework's forgery protection; CORS is not treated as CSRF defense.
+- **Vulnerable dependencies:** new/updated deps audited; no known-vuln versions added.
+- **Integrity / deserialization:** safe non-executable parsing with type/size/depth limits;
+  untrusted data cannot instantiate executable objects.
+
+## Trust boundary
+Apply the three-tier discipline (untrusted → boundary → trusted) per the canonical rule
+in [`standards/security.md`](../../devrites-lib/reference/standards/security.md#trust-boundary-three-tiers). A value
+that skips the boundary tier is a finding.
+
+## Rules
+- Findings labeled Critical/Important/Suggestion. A real auth/data-exposure issue is
+  **Critical** → NO-GO until fixed.
+- Secrets management: never commit secrets; use the project's secret mechanism.
+- Don't expand into a project-wide security audit: feature scope. Record out-of-scope
+  risks as follow-ups.

package/pack/generated/dsh/skills/rite-seal/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: rite-seal
+description: Decide GO/NO-GO for an active feature; /rite-ship owns commit, push, tag, and close.
+argument-hint: "[feature-slug] [--full]"
+user-invocable: true
+---
+
+<!-- loads: {"always":["devrites-lib/reference/standards/core.md","devrites-lib/reference/standards/code-navigation.md","devrites-lib/reference/standards/code-index.md","devrites-lib/reference/candidate-integrity.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md","devrites-lib/reference/standards/verification-methods.md","rite-seal/reference/phase-contract.md","rite-seal/reference/final-evidence.md","rite-seal/reference/go-no-go.md","rite-seal/reference/risk-and-rollback.md","rite-seal/reference/seal-template.md","rite-seal/reference/output.md","rite-seal/reference/anti-patterns.md"],"triggers":{"agents":["devrites-lib/reference/standards/agents.md"],"browser":["devrites-lib/reference/standards/browser-proof-checklist.md"],"code-review":["devrites-lib/reference/standards/code-review.md"],"deprecation":["devrites-lib/reference/standards/deprecation.md"],"documentation":["devrites-lib/reference/standards/documentation.md"],"dod":["devrites-lib/reference/standards/definition-of-done.md"],"observability":["devrites-lib/reference/standards/observability.md"],"principles":["devrites-lib/reference/standards/principles.md"],"security":["devrites-lib/reference/standards/security.md"],"testing":["devrites-lib/reference/standards/testing.md"]},"workspace":["brief.md","spec.md","state.md","decisions.md","assumptions.md","questions.md","decision-coverage.md","architecture.md","plan.md","tasks.md","traceability.md","eng-review.md","test-plan.md","gates.md","evidence.md","touched-files.md","review.md","seal.md"],"workspaceByRole":{"code-reviewer":["spec.md","plan.md","tasks.md","test-plan.md","architecture.md","decisions.md","state.md","evidence.md","touched-files.md","review.md"],"devex-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","devex.md","review.md"],"doubt-reviewer":["spec.md","plan.md","tasks.md","state.md","decisions.md","review.md"],"frontend-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"performance-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"proof-runner":["spec.md","test-plan.md","tasks.md","gates.md","evidence.md","state.md"],"security-auditor":["spec.md","plan.md","tasks.md","state.md","touched-files.md","evidence.md","review.md"],"simplifier-reviewer":["spec.md","plan.md","tasks.md","state.md","touched-files.md","review.md"],"spec-reviewer":["brief.md","spec.md","decision-coverage.md","questions.md","decisions.md","assumptions.md","state.md","review.md"],"test-analyst":["spec.md","tasks.md","test-plan.md","state.md","evidence.md","review.md"]},"rootOnly":["devrites-lib/reference/standards/code-index.md","devrites-lib/reference/orchestration-profiles.md","devrites-lib/reference/parallel-dispatch.md"]} -->
+> Read-set manifest: `devrites-engine context --skills-root .dsh/skills <slug> --phase seal` bundles every file named below into one deduplicated read. Trigger names map to the conditional rules in the sections that follow.
+
+
+# /rite-seal: GO / NO-GO
+
+Verify final candidate in `seal.md`; `/rite-ship` owns authorized irreversible actions/close-out.
+
+## Authority
+
+Read [`core.md`](../devrites-lib/reference/standards/core.md) plus only
+final-diff-relevant standards: agents, code-review, testing, browser-proof-checklist,
+security, principles, documentation, observability, deprecation,
+definition-of-done, and [`verification-methods.md`](../devrites-lib/reference/standards/verification-methods.md)
+for coverage-denominator and evidence-status judgment.
+Load [`final-evidence.md`](reference/final-evidence.md) and
+[`go-no-go.md`](reference/go-no-go.md) for proof/verdict safety.
+Follow [`candidate-integrity.md`](../devrites-lib/reference/candidate-integrity.md)
+for reviewed digest/artifact bindings.
+
+Host runs/reconciles named read-only reviewers; engine checks invariants.
+**Standard** default; **Full** broadens conditional axes per
+[`devrites-lib/reference/orchestration-profiles.md`](../devrites-lib/reference/orchestration-profiles.md).
+
+## Gate
+
+| State | Verdict |
+|---|---|
+| Acceptance proven, deterministic checks pass, no unresolved drift or human gate, `Critical == 0`, `Important == 0` | **GO** |
+| Same, but `Important > 0` | Ask `Important findings remain. Proceed to seal? [y/N]`; default **N**, unattended keeps **N**. Only humans answer `y`; standalone AFK stops for a human if Important remains. Autocomplete repairs agent-owned findings, re-enters Seal; only human-owned risk acceptance stops for a human |
+| `Critical > 0` | **NO-GO** |
+| Any acceptance criterion, resolved prohibition, or declared key link lacks proof | **NO-GO** |
+| `gates status` is not `all-met` — an unmet, stale, unapproved, or abandoned ledger gate remains | **NO-GO** |
+| Evidence is stale, or native diff review plus the exact test analyst finds weakened tests | **NO-GO: Critical** |
+| Any exact required reviewer account is missing or silent | **NO-GO** |
+| Any deferred finding (`touched-files.md` `## Review trail`, `eng-review.md` `## Deferred findings`) lacks a `review.md` verdict | **NO-GO** |
+| Any `gate: validating` question remains open | **NO-GO** |
+| Material UI acceptance lacks or fails required browser proof | **NO-GO** |
+| Unresolved drift, unsafe migration/removal, or unapproved principle violation remains | **NO-GO** |
+| `check regression` reports an unblessed loss vs the recorded progress baseline | **NO-GO** |
+| `check windows` reports a deferral marker the change introduced without a `windows.md` waiver | **NO-GO** |
+
+Judgment-only criteria need humans. AFK records a validating question
+(`slice: seal`), stops; Autocomplete never auto-picks.
+
+## Workflow
+
+Follow [`reference/phase-contract.md`](reference/phase-contract.md)
+([`risk-and-rollback.md`](reference/risk-and-rollback.md),
+[`seal-template.md`](reference/seal-template.md),
+[`anti-patterns.md`](reference/anti-patterns.md)):
+
+1. read workspace and final diff;
+2. recheck the canonical candidate/bindings and approved repository/CI proof;
+3. admit every valid same-candidate Review account; dispatch remaining required exact roles under
+   `../devrites-lib/reference/parallel-dispatch.md` in one wave, proof-runner included, on the same frozen candidate,
+   code review through its § Engineering lanes;
+4. reconcile their read-only verdicts against source and immutable evidence;
+5. draft GO/NO-GO `seal.md` with acceptance, tests, decisions, and seven roster accounts plus proof-runner and doubt-reviewer
+   (each engineering lane its own account);
+6. write exactly one candidate binding, then run
+   `devrites-engine check seal <slug>` for structure/identity, never semantics.
+   For stale readiness-input bindings, run `devrites-engine check drift <slug>`
+   before returning to Vet; start repair at the named changed/missing/added input.
+   Run `devrites-engine check regression <slug>` for progress lost since last
+   checkpoint: `BLOCKED` is NO-GO; `unproven` (no baseline) does not block.
+   Run `devrites-engine check windows <slug>` twice,
+   one with `--base <release-base>` and one with `--worktree` (the only mode that scans
+   untracked files; never pass both flags in one command, the last one wins) so each deferral marker the feature diff introduced
+   carries a `windows.md` waiver row ([`windows.md`](../devrites-lib/reference/standards/windows.md));
+   unwaived hits are NO-GO. The engine rejects malformed, unmet, stale, unapproved, or abandoned
+   `gates.md` ledgers. Unless Seal-side `gates status` says `all-met`, return to
+   Prove: evidence is not current; never attest past it. Before Seal wave, run `devrites-engine gates reverify <slug>
+   --transcripts` on the frozen candidate: bind every gate transcript to this
+   digest for the proof runner. It also rejects malformed `notes.md` or non-`exact` anchors:
+   `devrites-engine note check <slug> --repair` re-anchors `moved` notes;
+   fix/remove `stale`/`ambiguous`/`lost` notes before GO. Repeat each `note: unexecuted driver` line `check seal` prints in GO/NO-GO reply.
+
+Corrections pass affected Prove/Review before Seal restarts under
+[evidence validity](../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+
+Only repo scripts/CI authorize commands; never guess.
+
+## On GO
+
+Set `state.md` `Next step: /rite-ship`. Standalone Seal stops. Under active `/rite-autocomplete`, return internally to the caller
+for recorded sequence continuation or [Ship preflight](../rite-ship/reference/git-ship.md#before-type-go),
+no intermediate final reply. GO grants no irreversible-action authority.
+
+## Output
+
+Use [`reference/output.md`](reference/output.md).

package/pack/generated/dsh/skills/rite-seal/reference/anti-patterns.md

@@ -0,0 +1,29 @@
+# rite-seal: anti-patterns
+
+Load this when standing the final GO/NO-GO decision, or when tempted to round
+NO-GO up to GO. (The irreversible push/tag/deploy and its type-GO gate now live in
+`/rite-ship`: see that skill's anti-patterns for the type-GO discipline.)
+
+Pack-wide rationalizations + red flags (incl. user-wants-it-bypass-gate):
+see [standards/anti-patterns.md](../../devrites-lib/reference/standards/anti-patterns.md).
+
+## Phase-specific rationalizations
+
+| Excuse | Rebuttal |
+|---|---|
+| "All Important findings are minor; just GO." | `Important > 0` triggers an interactive y/N: do not bypass the prompt, present it. |
+| "User clearly wants this to ship." | Ship is evidence-driven, not consent-driven. With a Critical open the verdict stays NO-GO and `seal.md` records the user's override request; the user may accept named Important risks at the y/N prompt, but no request turns an open Critical or failed gate into GO. |
+| "Drift is small; resolve it inline and seal." | Unresolved drift = NO-GO, no exceptions. Route through `/rite-plan` to repair, then seal. |
+| "Reviewer findings overlap; average them away." | Surface disagreements explicitly. Averaging hides where the reviewers disagree. |
+| "Carry the old reviewer verdicts though the diff changed." | If the diff changed since `/rite-review`, re-run the Spec + Code axes: don't carry stale verdicts forward. |
+| "The wright was confident in a material decision. GO without independent review." | Confidence is not independent evidence. Ask the exact `devrites-doubt-reviewer` to test a boundary / data-model / auth / public-API / migration claim, reconcile its result against source, and record the verdict in `decisions.md`; unresolved irreversible risk is NO-GO. |
+
+## Red Flags
+
+- About to write `Verdict: GO` while any `Critical` finding is open.
+- Writing `Next step` as anything other than `/rite-ship` after a GO verdict.
+- Reviewer subagents spawned with the author's reasoning attached (defeats the fresh-context point).
+- `seal.md` written before walking *every* acceptance criterion one by one.
+- A NO-GO rounded up to GO "to be agreeable".
+- Unresolved drift, unresolved questions, or pending tasks, and you're sealing anyway.
+- A stood irreversible-risk decision (auth / public-API / migration) has no recorded independent `devrites-doubt` verdict, and you are sealing GO anyway.

package/pack/generated/dsh/skills/rite-seal/reference/final-evidence.md

@@ -0,0 +1,41 @@
+# Final evidence check
+
+Map spec promises to valid observed proof.
+
+## Acceptance
+
+For each AC/REQ/scenario/key link, exact `devrites-proof-runner` maps immutable
+results and exact `devrites-spec-reviewer` checks implementation and proof
+against its meaning. Bug fixes require original-symptom proof; self-report,
+inspection alone, and generic "tests pass" do not count.
+
+Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s positive, discriminating proof](../../devrites-lib/reference/standards/testing.md#positive-discriminating-proof),
+including invalid-result exclusions and static/textual criterion boundaries.
+Unproven behavior: NO-GO.
+
+## Cross-check
+
+Require built slices, resolved or accepted findings, no drift/open validating
+question, required UI/boundary proof, and an exact doubt verdict per stood decision.
+Reconcile the final diff with the spec applicability map. Every triggered topology,
+data, integration, security, and delivery owner needs its relevant observed failure/
+recovery evidence or an evidence-backed dismissal; a generic green suite cannot close it.
+
+## Candidate binding and test integrity
+
+Run `devrites-engine check candidate <slug>` and require its digest to match the
+single evidence/review bindings and browser binding when present. Diff tests,
+dispatch exact `devrites-test-analyst`; apply
+[evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity)
+to approved proof, then require unchanged digest/sources. Deleted/skipped/focused/
+weakened/tautological tests are Critical.
+
+After recording verdicts in `seal.md`, run:
+
+```bash
+devrites-engine check seal "<slug>"
+```
+
+This checks structure and exact candidate bindings, never acceptance, test
+quality, doubt, or review. Apply [[`testing.md`](../../devrites-lib/reference/standards/testing.md)'s safe perturbation](../../devrites-lib/reference/standards/testing.md#safe-perturbation)
+for its mandatory critical/regression cases and any additional project/test-plan requirement.

package/pack/generated/dsh/skills/rite-seal/reference/go-no-go.md

@@ -0,0 +1,32 @@
+# GO / NO-GO
+
+[`../SKILL.md`](../SKILL.md) owns gates. Draft native acceptance, test, doubt,
+and seven reviewer accounts in `seal.md`; then run
+`devrites-engine check seal <slug>` for structure/freshness.
+
+## NO-GO
+
+NO-GO on unproven acceptance/prohibitions/key links, red repository checks,
+stale proof, drift/open validating questions, Critical code/security, unsafe
+rollback, or an unapproved principle violation. Also block:
+- missing/adverse exact proof, spec, or test verdict;
+- deleted/skipped/focused/tautological/weakened tests;
+- missing/silent required review or invalid conditional account;
+- a stood decision without reconciled exact doubt verdict;
+- an unblessed loss vs the recorded progress baseline (`check regression` `BLOCKED`);
+- opted-in mutation missing/below threshold (otherwise optional).
+
+## GO
+
+GO needs fresh acceptance, green proof, resolved drift/human gates, acceptable
+security/data/rollback risk, every account, and no Critical.
+
+When only Important findings remain, ask:
+
+```text
+Important findings remain. Proceed to seal? [y/N]
+```
+
+Default NO-GO. `y` accepts named Important risks only, never Critical/missing proof.
+Only a human answers `y`: an unattended (AFK/autocomplete) run keeps N and, if Important
+findings remain after its recovery, stops for the human.

package/pack/generated/dsh/skills/rite-seal/reference/output.md

@@ -0,0 +1,5 @@
+# rite-seal output
+
+Use the shared [GO or NO-GO reply contract](../../devrites-lib/reference/reply-contract.md).
+
+Do not imply anything shipped. `/rite-seal` decides; `/rite-ship` executes.

package/pack/generated/dsh/skills/rite-seal/reference/phase-contract.md

@@ -0,0 +1,56 @@
+# rite-seal phase contract
+
+1. **Read.** Resolve the explicit slug or `.devrites/ACTIVE`, require its
+   `state.md`, then read required workspace artifacts, conditional
+   browser/design/devex evidence, and final diff.
+2. **Recheck identity and real proof.** Run
+   `devrites-engine check candidate <slug>` and require its exact digest to match
+   the single evidence/review bindings and the browser binding when present.
+   Apply [`spec-grammar.md`](../../devrites-lib/reference/standards/spec-grammar.md)'s Native grammar re-read checklist and
+   [evidence validity](../../devrites-lib/reference/candidate-integrity.md#evidence-validity).
+   Run required `test-plan.md` commands unless valid observed proof already satisfies
+   them under that contract. Rerun the
+   candidate check afterward and require the identical digest and no source
+   mutation. Capture command, cwd, exit, decisive output, and identity.
+   Missing/red/mismatched blocks; unavailable is `cannot_verify`, never pass.
+Steps 3–6 share one dispatch wave: launch every role they still need
+(proof-runner, test-analyst, doubt-reviewer, roster) together, admit valid
+same-candidate Review accounts instead, and do the root work of steps 4–6 while
+the wave runs.
+
+3. **Judge acceptance.** Dispatch exact `devrites-proof-runner` on immutable
+   proof; admit valid same-candidate `devrites-spec-reviewer` evidence from Review
+   or dispatch that exact reviewer. Reconcile every
+   AC/REQ/scenario/key link by ID and meaning; missing/stale/self-attested/mismatched is NO-GO.
+4. **Judge tests.** Diff baseline/candidate tests for deletion, skip/focus,
+   tautology, or weakening; admit the same-candidate `devrites-test-analyst` account
+   from Review or dispatch that exact analyst. Missing or
+   adverse account, or green tests not asserting mapped behavior, is Critical.
+5. **Resolve gates.** Open blocking/escalating/validating questions and drift
+   block. Each stood decision needs a reconciled exact `devrites-doubt-reviewer` verdict.
+   Every deferred finding (`touched-files.md` `## Review trail`, `eng-review.md`
+   `## Deferred findings`) needs its `review.md` verdict; a row without one blocks.
+6. **Risk and native review.** Apply [`risk-and-rollback.md`](risk-and-rollback.md)
+   and the [`review roster`](../../devrites-lib/reference/parallel-dispatch.md) on
+   the candidate. Admit each result through
+   [`result admission`](../../devrites-lib/reference/standards/agents.md#result-admission).
+   `## Reviewer Accounts` preserves the seven roster roles, each engineering lane as its own account, plus
+   `devrites-proof-runner` and, when any decision stood, `devrites-doubt-reviewer`; gap/missing/malformed blocks;
+   conditional `Not-applicable` names why.
+7. **Route corrections.** Reconcile cited findings/disagreements, but do not
+   edit the candidate or manifest in Seal. Route an accepted correction through
+   one bounded wright, update the manifest, run affected Prove, complete a fresh
+   Review under evidence validity, then restart Seal on the new digest.
+8. **Draft/check.** Write `seal.md` from
+   [`seal-template.md`](seal-template.md) with the GO/NO-GO rationale, acceptance map,
+   test-analysis account, stood-decision verdicts, all seven roster reviewer accounts plus proof-runner and doubt-reviewer,
+   and exactly one `Candidate SHA-256: <64 lowercase hex>` line. Then run:
+   ```bash
+   devrites-engine check seal "<slug>"
+   devrites-engine check regression "<slug>"
+   ```
+   Structure/bindings only: blocks exit `3`, invalid state `2`. A regression
+   `BLOCKED` is NO-GO; `unproven` (no baseline) does not block. GO sets
+   `Next step: /rite-ship`; NO-GO names the fix. No commit/push/tag/publish/deploy/close.
+
+Apply [`anti-patterns.md`](anti-patterns.md); never average away disagreement.