{
  "$comment": "DevRites keeps the root orchestration context source-read-only by instruction; no permission mode enforces it. These allow rules cover the engine, read-only git, the codebase-memory-mcp code index and .devrites/ workspace edits. Native subagents own specialist execution; only devrites-slice-wright may edit source in the lifecycle (fast-builder writes for /rite-fast; overhaul-* agents keep every tool). Its task lists exact project-relative paths, and the root rejects any returned diff outside that contract.",
  "permissions": {
    "allow": [
      "Bash(devrites-engine check candidate *)",
      "Bash(devrites-engine check readiness *)",
      "Bash(devrites-engine check seal *)",
      "Bash(devrites-engine check diff-scope *)",
      "Bash(devrites-engine check task-graph *)",
      "Bash(devrites-engine check path-disjoint *)",
      "Bash(devrites-engine check indexes *)",
      "Bash(devrites-engine check skill-trust *)",
      "Bash(devrites-engine check slice *)",
      "Bash(devrites-engine check regression *)",
      "Bash(devrites-engine check windows *)",
      "Bash(devrites-engine check dup *)",
      "Bash(devrites-engine check anchors *)",
      "Bash(devrites-engine check perturb *)",
      "Bash(devrites-engine check drift *)",
      "Bash(devrites-engine check preconditions *)",
      "Bash(devrites-engine orient *)",
      "Bash(devrites-engine next *)",
      "Bash(devrites-engine handoff *)",
      "Bash(devrites-engine recall *)",
      "Bash(devrites-engine context *)",
      "Bash(devrites-engine metrics *)",
      "Bash(devrites-engine dispatch *)",
      "Bash(devrites-engine candidate freeze *)",
      "Bash(devrites-engine packet *)",
      "Bash(devrites-engine claim *)",
      "Bash(devrites-engine note *)",
      "Bash(devrites-engine observe *)",
      "Bash(devrites-engine detect *)",
      "Bash(devrites-engine migrate *)",
      "Bash(devrites-engine parallel status *)",
      "Bash(devrites-engine parallel select *)",
      "Bash(devrites-engine parallel add *)",
      "Bash(devrites-engine parallel create *)",
      "Bash(devrites-engine parallel record-green *)",
      "Bash(devrites-engine parallel integrate *)",
      "Bash(devrites-engine parallel abort *)",
      "Bash(devrites-engine parallel cleanup *)",
      "Bash(devrites-engine parallel lease-read *)",
      "Bash(devrites-engine parallel lease-write *)",
      "Bash(devrites-engine parallel lease-clear *)",
      "Bash(devrites-engine state resolve *)",
      "Bash(devrites-engine state merge-manifest *)",
      "Bash(devrites-engine state apply-bundle *)",
      "Bash(devrites-engine state set *)",
      "Bash(devrites-engine state append *)",
      "Bash(devrites-engine state close *)",
      "Bash(devrites-engine gates scaffold *)",
      "Bash(devrites-engine gates status *)",
      "Bash(devrites-engine gates run *)",
      "Bash(devrites-engine gates reverify *)",
      "Bash(devrites-engine gates lint *)",
      "Bash(devrites-engine gates precheck *)",
      "Bash(devrites-engine gates attest *)",
      "Bash(devrites-engine gates abandon *)",
      "Bash(devrites-engine overhaul *)",
      "mcp__codebase-memory-mcp__*",
      "Bash(codebase-memory-mcp cli *)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git show *)",
      "Bash(git rev-parse *)",
      "Bash(git merge-base *)",
      "Edit(/.devrites/**)",
      "Bash(devrites-engine secret-scan)",
      "Bash(devrites-engine secret-scan *)",
      "Bash(devrites-engine open-visual *)",
      "Bash(devrites-engine --help)",
      "Bash(devrites-engine help)",
      "Bash(devrites-engine help *)",
      "Bash(devrites-engine check --help)",
      "Bash(devrites-engine state --help)",
      "Bash(devrites-engine parallel --help)",
      "Bash(devrites-engine gates --help)",
      "Bash(devrites-engine version)"
    ]
  }
}