DevRites is a repository-local workflow for building software with Claude Code or Codex. It turns a feature request into a spec, a sliced plan, working code, recorded proof, a release decision, and an explicit ship step.
The work lives under .devrites/, not in chat history. A later session or a
different agent can read the same plan, decisions, state, and evidence before it
continues.
The core path is:
SPEC -> CLARIFY -> [TEMPER] -> DEFINE -> VET -> BUILD -> PROVE -> POLISH -> REVIEW -> SEAL -> SHIP
Clarify is mandatory but adaptive, so it asks no questions when the contract is complete. Temper adds an optional strategic review. Vet is the only final readiness phase before Build.
Seal decides whether the feature is ready without changing git. Ship owns the
final commit, push, and tag, and it requires a typed GO confirmation.
Unattended runs may create local WIP checkpoint commits along the way, but only
Ship collapses and pushes them.
Status: v3.2.1: see CHANGELOG.md for release notes.
Run this from the root of your project. Node.js 18 or later is required.
npx devrites@latest
The installer adds project-local support for Claude Code and Codex. It does not
write skills, agents, or hooks to ~/.claude or ~/.codex.
In Claude Code:
/rite-spec add-csv-export
In Codex:
$rite-spec add-csv-export
DevRites investigates the repository, asks about gaps, and writes the feature
spec under .devrites/work/add-csv-export/. For an existing codebase that needs
an onboarding pass first, use /rite-adopt in Claude Code or $rite-adopt in
Codex.
Use /rite-status in Claude Code or $rite-status in Codex. Status reads the
active workspace and reports the current phase, open questions, evidence, and
next command.
Claude Code supports both /rite <verb> and /rite-<verb>. Codex uses the same
forms with $: $rite <verb> and $rite-<verb>. The menu and direct forms run
the same skill.
| # | Stage | Direct command | What happens |
|---|---|---|---|
| 1 | Spec | /rite-spec <feature> | Inspects the request and codebase, asks about product gaps, and writes spec.md. |
| 2 | Clarify | /rite-clarify | Checks the whole feature for missing decisions before planning. It asks no questions when everything is clear. |
| 3 | Temper | /rite-temper | Challenges scope and failure modes before Define. It is optional for small work and always runs in /rite-autocomplete. |
| 4 | Define | /rite-define | Turns the approved spec into architecture, a plan, traceability, and vertical task slices. |
| 5 | Vet | /rite-vet | Reviews every plan before implementation. The review depth scales with the risk. |
| 6 | Build | /rite-build | Implements and verifies one slice, then stops. Run it again for each remaining slice. |
| 7 | Converge | /rite-converge | Runs only when recovery is needed. It compares the code with the recorded intent, adds missing slices, and sends the changed plan back to Vet. |
| 8 | Prove | /rite-prove | Runs the completed feature's tests, build, runtime checks, and browser proof when the feature has a UI. |
| 9 | Polish | /rite-polish | Cleans up the touched code and normalizes the UI when needed. |
| 10 | Review | /rite-review | Reviews the completed feature against its spec and engineering standards. |
| 11 | Seal | /rite-seal | Writes the final GO or NO-GO decision without changing git. |
| 12 | Ship | /rite-ship | On GO, asks for typed confirmation, performs the approved git actions, and archives the workspace. |
| n/a | Upgrade (conditional) | /rite-upgrade [slug] | Brings an active unfinished workspace onto the current planning contract without rewriting completed work or evidence. Build readiness sends stale workspaces here automatically. |
Some work needs a different route:
/rite-quick handles a small,
reversible change without creating a full feature workspace./rite-autocomplete runs
the lifecycle unattended. With --ship, it auto-confirms the final typed
GO; without that flag, it stops and waits for you./rite-upgrade [slug] is a
maintenance route for an active workspace planned under older DevRites
rules. It is not a mandatory lifecycle phase./rite shows the command menu.devrites-engine update refreshes the installed engine and pack.
devrites-engine migrate normalizes workspace layout and structural state.
Neither replaces /rite-upgrade, which reconciles unfinished planning
semantics while preserving completed work.
The command map covers every command, trigger, input, and output. The worked examples show normal features, plan drift, UI work, backend work, and mid-flight handoffs.
Each feature gets a directory under .devrites/work/<slug>/. Shipped
workspaces move intact to .devrites/archive/<slug>/ so future work can inspect
the original decisions and proof.
.devrites/
ACTIVE # active feature slug
AFK # optional unattended-mode configuration
principles.md # project rules that gate the workflow
conventions.md # observed project patterns
learnings.md # recurring lessons and known false positives
work/<slug>/
brief.md
spec.md
decision-coverage.md
architecture.md
plan.md
tasks.md
eng-review.md
test-plan.md
state.md
decisions.md
questions.md
traceability.md
evidence.md
review.md
seal.md
ship.md
archive/<slug>/
Some phases add focused artifacts such as strategy.md, design-brief.md,
browser-evidence.md, polish-report.md, drift.md, or handoff.md. See the
workspace contract for the full state model.
CLEAR and READY artifacts; marker
text alone does not pass./rite-build implements one vertical slice and records
its proof before returning control. Before dispatching the sole writer, the
root writes an exact .wright-allowlist. Reconciliation and integrity gates
use the same pre-slice baseline.drift.md. Build handles objective implementation and tool failures with
bounded recovery; it uses
/rite-plan repair only when the
durable plan is wrong, and asks you only for a real product or risk decision.GO.Project principles in .devrites/principles.md take precedence over learned
conventions and the bundled engineering standards. A feature can record a
deliberate exception instead of silently ignoring a project rule.
When DevRites needs a decision, it presents ranked options, records the chosen
answer in the workspace, and continues. If the current turn must stop, the
question remains in questions.md; answer it later with
/rite-resolve <qid> "<answer>".
Codex uses the equivalent $rite-resolve form.
Create .devrites/AFK to let permitted gates select their recommended option
and continue:
max_slices: 10
allow_gates: [advisory]
The workflow treats this file as configuration and never rewrites it.
max_slices seeds the remaining budget in the active feature's state.md; the
engine decrements that state after each built slice. Delete .devrites/AFK to
return to HITL.
AFK still pauses for product, scope, or policy choices, irreversible risk,
and access or actions available only to a human. Agents use bounded recovery
for red tests, type or lint errors, runtime failures, and missing technical
coverage. If that recovery budget runs out, they record a technical blocker
instead of asking a question. The full pause and gate contract is in
afk-hitl.md.
# Install in the current project
npx devrites@latest
# Install elsewhere or preview the changes
npx devrites@latest --target /path/to/project
npx devrites@latest --dry-run
# Update or remove an existing installation
npx devrites@latest update
npx devrites@latest uninstall
Useful install flags:
| Flag | Effect |
|---|---|
--target DIR | Use another project directory. |
--dry-run | Show planned file operations without changing anything. |
--force | Replace or remove foreign or customized managed files. The installer still rejects symlinks and path escapes. |
--no-codex | Skip .agents, .codex, and AGENTS.md integration. |
--no-agents | Skip the review agents. |
--no-skills | Skip skills and their bundled standards. |
--no-binary | Do not keep the shared devrites-engine binary in a user or system bin directory. |
--short-aliases=all | Add /define, /build, /prove, and /seal aliases. |
Run npx devrites@latest --help for the full option list.
If Node.js is not available, use the bootstrap script. It needs curl and
tar.
# Install the latest release in the current project
curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | bash
# Install in another project
curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | bash -s -- --target /path/to/project
# Preview without writing files
curl -fsSL https://raw.githubusercontent.com/ViktorsBaikers/DevRites/main/install.sh | bash -s -- --dry-run
The installer records every managed project file and its SHA-256 in
.claude/devrites.manifest. Before an update or uninstall changes anything, it
checks every managed path. It preserves customized files and tells the user to
retry with --force before making any changes; legacy manifests without hashes
also require --force.
--force --dry-run lists the exact destructive actions. Marker-merged files
keep user content outside the DevRites block, and .devrites/ runtime state
remains in place. The installer refuses symlinks, junctions, and paths that
escape the target.
The optional shared devrites-engine binary is the only artifact installed
outside the project. Before replacement, the release binary at its staged path
must report the requested version. After installation, the binary at its final
path must report that version in a new process. The installer keeps a backup in
the same directory until the second check passes. On failure, it restores the
previous binary or removes a bad first install.
Claude Code receives skills under .claude/skills/, agents under
.claude/agents/, and DevRites hooks merged into .claude/settings.json.
Existing settings remain in place.
Codex receives the same skills under .agents/skills/, custom agents under
.codex/agents/, hooks under .codex/hooks.json, and a marked guidance block
in AGENTS.md. Existing AGENTS.md content remains in place. Codex users
invoke skills with $rite, $rite-spec, or /skills and should review project
hooks through /hooks.
DevRites is installed through npm or the Bash bootstrap. It is not distributed through Claude Code or Codex plugin stores.
The pack ships 44 skills: 32 public and 12 internal. The public surface contains
the rite menu and 31 rite-* workflows and utilities. Eleven devrites-*
specialists load when a matching task needs them; devrites-lib carries the
shared contracts and engineering standards.
Eighteen fresh-context agents ship with the pack. Seventeen are read-only,
including the evidence scout, plan drafter, proof runner, reviewers, judges,
upgrade planner, and retrospector. devrites-slice-wright is the only
source/test writer.
The authoritative skills catalogue lists every skill and agent. The flow diagrams show routing, reviewer fan-out, and namespace boundaries.
The stack-agnostic standards live under
.claude/skills/devrites-lib/reference/standards/. Every workflow loads the
small core first, then only the standards needed for that phase. Project
conventions override generic advice, and .devrites/principles.md overrides
both. The standards index
maps each rule file to the phases that use it.
For UI work, Spec records the visual direction and required states in
design-brief.md. Build follows the project's existing design system, while
Prove collects runtime and browser evidence. The guidance checks WCAG 2.2 AA
and, when performance is measurable, targets LCP at or below 2.5 seconds, INP
at or below 200 milliseconds, and CLS at or below 0.1. Full-stack work starts
with the API and data contract, then builds a vertical slice through the UI.
DevRites works without extra tools. If available, codegraph or graphify can answer structural questions, and Playwright MCP can collect browser evidence. Chrome DevTools MCP can add Lighthouse and performance traces. DevRites detects these tools but does not install them.
Installed host artifacts stay in the project. The npm shim prefers an explicitly
configured engine or a local engine/devrites-engine. If neither is available,
it can download a checksummed release binary or build a temporary engine from
the local Go source before falling back to devrites-engine on PATH. Use
--no-binary or DEVRITES_NO_BINARY=1 to avoid keeping a shared binary outside
the project. devrites-engine update also prefers the checksummed platform
release and builds from source only as a fallback. It does not read Git metadata
from the target project.
Workflow state is read through the engine rather than shell injection. The
installer never writes defaultMode: bypassPermissions. Skills use networked
research only through host tools you invoke or configure.
Read SECURITY.md for the threat model, managed deployment
guidance, and private reporting instructions.
bin/ npm CLI shim
engine/ Go control plane and tests
pack/.claude/ canonical skills, agents, hooks, and standards
pack/generated/ generated host payloads; do not edit by hand
scripts/ validation, generation, install, and release tooling
tests/ repository-level shell tests
docs/ architecture, usage, command, and contributor guides
evals/ routing and behavioral evaluation fixtures
For local development:
npm install
npm run validate
npm test
(cd engine && go test ./... -count=1)
Canonical pack changes belong in pack/.claude/. Rebuild host payloads with
bash scripts/build-host-artifacts.sh instead of editing pack/generated/.
See CONTRIBUTING.md for the development workflow and review
requirements.
Please read the contribution guide and
code of conduct before opening a change. Maintainer
ownership is documented in CODEOWNERS, and third-party notices
are in NOTICE.md.
DevRites is source-available software for personal use with Claude Code and
Codex. Distribution, modified distribution, fork mirrors, and commercial or
organizational use require approval. Read LICENSE for the full
terms.
FAQs
DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI
The npm package devrites receives a total of 254 weekly downloads. As such, devrites popularity was classified as not popular.
We found that devrites demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.
Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.