{
  "$comment": "DevRites keeps the root orchestration context source-read-only. Native subagents own specialist execution; only devrites-slice-wright may edit source. Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
  "permissions": {
    "defaultMode": "plan",
    "allow": [
      "Bash(devrites-engine check candidate *)",
      "Bash(devrites-engine check readiness *)",
      "Bash(devrites-engine check seal *)",
      "Bash(devrites-engine check diff-scope *)",
      "Bash(devrites-engine check task-graph *)",
      "Bash(devrites-engine check path-disjoint *)",
      "Bash(devrites-engine check indexes *)",
      "Bash(devrites-engine check skill-trust *)",
      "Bash(devrites-engine check slice *)",
      "Bash(devrites-engine check regression *)",
      "Bash(devrites-engine check windows *)",
      "Bash(devrites-engine check dup *)",
      "Bash(devrites-engine check drift *)",
      "Bash(devrites-engine orient *)",
      "Bash(devrites-engine next *)",
      "Bash(devrites-engine handoff *)",
      "Bash(devrites-engine context *)",
      "Bash(devrites-engine metrics *)",
      "Bash(devrites-engine dispatch *)",
      "Bash(devrites-engine claim *)",
      "Bash(devrites-engine note *)",
      "Bash(devrites-engine observe *)",
      "Bash(devrites-engine detect *)",
      "Bash(devrites-engine migrate *)",
      "Bash(devrites-engine parallel status *)",
      "Bash(devrites-engine parallel select *)",
      "Bash(devrites-engine parallel create *)",
      "Bash(devrites-engine parallel record-green *)",
      "Bash(devrites-engine parallel integrate *)",
      "Bash(devrites-engine parallel abort *)",
      "Bash(devrites-engine parallel cleanup *)",
      "Bash(devrites-engine parallel lease-read *)",
      "Bash(devrites-engine parallel lease-write *)",
      "Bash(devrites-engine parallel lease-clear *)",
      "Bash(devrites-engine state resolve *)",
      "Bash(devrites-engine state merge-manifest *)",
      "Bash(devrites-engine state close *)",
      "Bash(devrites-engine gates scaffold *)",
      "Bash(devrites-engine gates status *)",
      "Bash(devrites-engine gates run *)",
      "Bash(devrites-engine gates reverify *)",
      "Bash(devrites-engine gates lint *)",
      "Bash(devrites-engine gates attest *)",
      "Bash(devrites-engine gates abandon *)",
      "mcp__codegraph__*",
      "mcp__codebase-memory-mcp__*",
      "mcp__codebase-memory__*",
      "mcp__code-review-graph__*",
      "mcp__graphify__*",
      "Bash(codegraph *)",
      "Bash(graphify *)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git show *)",
      "Bash(git rev-parse *)",
      "Bash(git merge-base *)",
      "Edit(.devrites/**)",
      "Write(.devrites/**)",
      "Bash(devrites-engine secret-scan)",
      "Bash(devrites-engine secret-scan *)",
      "Bash(devrites-engine open-visual *)",
      "Bash(devrites-engine version)"
    ]
  }
}