devrites 6.0.0 → 6.0.2

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.0.2](https://github.com/ViktorsBaikers/DevRites/compare/v6.0.1...v6.0.2) (2026-10-14)
+
+### Fixed
+
+* **installer:** drop gh attestation requirement from installers ([ff27b58](https://github.com/ViktorsBaikers/DevRites/commit/ff27b58f569dffdc956ce4a4c759cb6427abc9bd))
+
+## [6.0.1](https://github.com/ViktorsBaikers/DevRites/compare/v6.0.0...v6.0.1) (2026-10-14)
+
+### Fixed
+
+* **skills:** route .devrites writes to workflow artifacts ([#102](https://github.com/ViktorsBaikers/DevRites/issues/102)) ([8bb83b2](https://github.com/ViktorsBaikers/DevRites/commit/8bb83b21ef80cbcde3788e434830e38217297e31))
+
 ## [6.0.0](https://github.com/ViktorsBaikers/DevRites/compare/v5.14.4...v6.0.0) (2026-10-10)
 
 ### ⚠ BREAKING CHANGES

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.0.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.0.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.0.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.0.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -51,11 +51,6 @@ This is the latest published release; `main` may contain unreleased work.
 install and run DevRites. Development in this repository (`npm ci`, which
 `.npmrc` runs with `engine-strict=true`) needs Node.js 22.22.2 or later within
 22.x, or 24.15 or later; Node 23.x and 24.0 through 24.14 fail with `EBADENGINE`.
-`gh` (GitHub CLI) must also be installed and authenticated, not merely
-installed, because DevRites verifies the build-provenance attestation of every
-release asset it downloads. Run `gh auth login` once, then `gh auth status` to
-confirm. See [Install, update, and remove](#install-update-and-remove) for
-which routes fail without it and which fall back to a local build.
 
 ```bash
 npx devrites@latest
@@ -315,8 +310,7 @@ Run `npx devrites@latest --help` for common flags and
 <br>
 
 Download the release-owned installer and its checksum before executing it. It
-needs `curl`, `gzip`, and `tar`, plus `gh` (GitHub CLI) installed and
-authenticated (`gh auth login`).
+needs `curl`, `gzip`, and `tar`.
 
 ```bash
 bootstrap_dir="$(mktemp -d)"
@@ -349,8 +343,6 @@ project_dir="$PWD"
     exit 1
   fi
   [ "$got" = "$want" ] || { echo 'error: install.sh checksum mismatch' >&2; exit 1; }
-  command -v gh >/dev/null 2>&1 || { echo 'error: gh (GitHub CLI) is required and was not found' >&2; exit 1; }
-  gh attestation verify install.sh --repo ViktorsBaikers/DevRites --signer-workflow ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main || { if gh auth status >/dev/null 2>&1; then echo 'error: install.sh attestation verification failed: no build provenance from ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main' >&2; else echo 'error: gh is not authenticated; run gh auth login' >&2; fi; exit 1; }
 
   # Choose one Node-free operation:
   bash ./install.sh --target "$project_dir"  # install into the directory you ran this from
@@ -403,59 +395,19 @@ proof. `devrites-engine migrate` owns deterministic v5 schema normalization.
 See the [CLI contract](docs/cli.md) and
 [ADR-0029](docs/adr/0029-v5-workspace-schema-and-native-migration.md).
 
-Every release asset is verified with `gh attestation verify` before it is
-decompressed, extracted, or executed, so `gh` must be installed and
-authenticated (`gh auth login`). Without that, the Bash bootstrap (`install.sh`
-fetched with `curl`) and `devrites-engine update` are fatal: they stop with no
-fallback. `npx devrites@latest` instead falls back to compiling the shipped
-`engine/` with `go build` when Go is installed, and the engine acquisition in
-`scripts/install-lib.sh` (used by `install.sh` from a clone or an extracted
-bundle) has its own fallback of the same kind.
-
-Release binaries and installers ship with SHA-256 sidecars and
-build-provenance attestations. Verify a download with both
-`shasum -a 256 -c <file>.sha256` and
+Every release asset is checked against its exact-filename SHA-256 sidecar
+before it is decompressed, extracted, or executed. The installers do not need
+GitHub CLI and do not run `gh attestation verify`.
+
+Release binaries and installers also ship with build-provenance attestations.
+The `.sha256` sidecar is fetched from the same origin as the artifact, so it is
+a corruption check, not a provenance one. To check provenance yourself, run
 `gh attestation verify <file> -R ViktorsBaikers/DevRites --signer-workflow ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`
-before it runs; the checksum alone is not enough (see the verified Bash
-bootstrap above).
-Pin the signer workflow, because valid provenance shows where a build ran
-but does not show that the intended publishing step produced it. See
+on the downloaded file before it runs. This step is optional. Pin the signer
+workflow, because valid provenance shows where a build ran but does not show
+that the intended publishing step produced it. See
 [docs/release.md](docs/release.md).
 
-Read a failure as "prove provenance or stop", not as a verdict about your
-build. The bootstrap checks `gh` itself, exits 1 before `install.sh` runs, and
-prints the cause. It says `error: gh (GitHub CLI) is required and was not
-found` when `gh` is absent. When `gh` is present but logged out (`gh auth
-status` fails) it says `error: gh is not authenticated; run gh auth login`.
-Only when `gh` is logged in and still rejects the attestation does it say
-`error: install.sh attestation verification failed: no build provenance from
-ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`. After that,
-`install.sh` verifies the release bundle `devrites-<tag>.tar.gz` and reports the
-same three causes as `attestation verification failed: gh (GitHub CLI) is
-required and was not found`, `attestation verification failed: gh is not
-authenticated ...; run 'gh auth login' and retry`, and `attestation verification
-failed: no build provenance from <signer>`. The engine binary is acquired
-separately: the bundled installer (`scripts/install-lib.sh`) and the npm route
-report `attestation verification failed (gh must be installed and
-authenticated)` for any of these causes, discard the downloaded binary, and
-fall back to other sources. The bundled installer builds from the bundle's
-`engine/` source when `go` is available, then tries an already-installed
-`devrites-engine`, and only when none works does `install.sh` exit 1 with
-`could not acquire devrites-engine` followed by that cause. `npx devrites@latest` repeats the combined message
-before exiting 127 when no other engine is available. `devrites-engine update` reports `gh (GitHub CLI) is
-required and must be authenticated for attestation verification` when `gh` is
-absent, and `attestation verification failed for <asset>` whenever a present
-`gh` rejects the asset, logged out or not.
-
-There is no flag to skip, disable, or bypass attestation verification. The
-`.sha256` sidecar is fetched from the same origin as the artifact, so a
-substituted origin supplies a digest that matches its own payload, which is why
-the sidecar is a corruption check and not a provenance one. If you cannot run
-`gh auth login`, install Go and use `npx devrites@latest`, or clone this
-repository and run `bash install.sh`: both compile `engine/` locally when the
-download is refused, with `cd engine && go build -o devrites-engine .` as the
-manual equivalent.
-
 </details>
 
 ## Hosts
@@ -527,10 +479,9 @@ traces. DevRites detects these tools but does not install them.
 
 - Installed host artifacts stay in the project. Use `--no-binary` or
   `DEVRITES_NO_BINARY=1` to avoid keeping a shared binary outside it.
-- npm, Bash, and `devrites-engine update` all require checksummed release
-  assets that also pass `gh attestation verify`, pinned to
-  `ViktorsBaikers/DevRites` and signer workflow
-  `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main` (see
+- npm, Bash, and `devrites-engine update` all require release assets that
+  match their SHA-256 sidecars. Build-provenance attestations can be checked
+  manually with `gh attestation verify` (see
   [Install, update, and remove](#install-update-and-remove)). Remote fetches use HTTPS at every redirect hop, are bounded in size,
   and never fall back to an unchecked raw file, source archive, tag, or default
   branch.

package/SECURITY.md

@@ -119,23 +119,20 @@ and `.codex/config.toml` without replacing unrelated user settings. The shared
 `devrites-engine` executable is the only allowed artifact outside the project.
 It is installed to `DEVRITES_BIN_DIR`, a writable `~/.local/bin`, or a writable
 `/usr/local/bin`; `--no-binary` / `DEVRITES_NO_BINARY=1` skips it. The bootstrap
-and direct updater may fetch the release bundle and checksummed engine assets,
-each of which must also pass `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`).
+and direct updater may fetch the release bundle and checksummed engine assets.
 They never invoke `sudo` or edit shell startup files.
 
 The documented Node-free boundary downloads the release-owned `install.sh` and
-its exact-name sidecar, then requires both the checksum and the build-provenance
-attestation (`gh attestation verify`, pinned to `ViktorsBaikers/DevRites` and
-signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`)
-to pass before execution, as in the README "verified Bash bootstrap"; mutable
+its exact-name sidecar, then requires the checksum to pass before execution, as
+in the README "verified Bash bootstrap"; mutable
 default-branch scripts are not recommended. Legacy local and extracted shim invocations remain compatible, but
 their exact-release guarantee begins at that verified asset. A piped shim never
 treats current-directory siblings as its bundle.
 
 Network acquisition accepts only an exact SemVer release asset and its mandatory
-exact-filename SHA-256 sidecar, and every release asset must also pass
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass). Every redirect hop must remain HTTPS, private
+exact-filename SHA-256 sidecar. Installers do not run `gh attestation verify`;
+release assets carry build-provenance attestations that users may verify
+manually (see [docs/release.md](docs/release.md)). Every redirect hop must remain HTTPS, private
 temporary-directory creation must succeed, and unchecked raw/source/default-
 branch fallbacks are absent. Representative in-stream ceilings are 1 MiB for
 release metadata, 4 KiB for a sidecar, and 64 MiB for an archive or binary, with
@@ -154,8 +151,7 @@ and [ADR-0028](docs/adr/0028-self-contained-engine-update.md) own the rationale.
 With `npx devrites@latest`, the CLI (`bin/devrites.mjs`) calls
 `devrites-engine` directly instead of running `install.sh`. The bundled host
 payload is pinned to the requested npm package version. The shim first tries the
-matching exact-release binary, which must pass its mandatory SHA-256 sidecar and
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`),
+matching exact-release binary, which must pass its mandatory SHA-256 sidecar,
 then a package-local Go build, and then an existing engine. Remote responses are
 byte-bounded and every redirect is checked before following it. It has no
 runtime npm dependencies. The same project and shared-binary boundaries apply

package/bin/devrites.mjs

@@ -190,14 +190,6 @@ async function downloadEngine() {
     rmSync(`${out}.sha256`, { force: true });
     return null;
   }
-  const signer = `${repo}/.github/workflows/ci.yml@refs/heads/main`;
-  const attestation = spawnSync('gh', ['attestation', 'verify', out, '--repo', repo, '--signer-workflow', signer], { stdio: 'ignore', timeout: 120_000 });
-  if (attestation.error || attestation.status !== 0) {
-    acquisitionFailure = `release ${tag} asset ${name}: attestation verification failed (gh must be installed and authenticated)`;
-    rmSync(out, { force: true });
-    rmSync(`${out}.sha256`, { force: true });
-    return null;
-  }
   try {
     chmodSync(out, 0o755);
   } catch {

package/docs/architecture.md

@@ -154,8 +154,7 @@ consume only local source, payload, and binary candidates.
 
 Direct `devrites-engine update` uses the separate `engine/internal/release`
 boundary to resolve the latest stable release and acquire its checksummed bundle
-and platform engine, each also checked with `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated). It then invokes the downloaded engine with local paths, so
+and platform engine. It then invokes the downloaded engine with local paths, so
 the candidate validates its own payload schema. `update --check` resolves only
 release metadata and downloads no assets. Engine `--to` and `--pre` selectors do
 not exist.
@@ -164,9 +163,7 @@ The shell entrypoints
 (`bin/devrites.mjs`) remain equivalent acquisition adapters. They acquire and
 verify the exact-release bundle or binary, then pass local paths and user flags
 through to the deterministic engine operation. All network paths require exact SemVer,
-HTTPS-only redirects, exact-filename SHA-256 sidecars, a `gh attestation verify`
-pass for every release asset (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-see [Install, update, and remove](../README.md#install-update-and-remove)), private temporary
+HTTPS-only redirects, exact-filename SHA-256 sidecars, private temporary
 directories, bounded transfers, and full archive preflight. They provide no
 unchecked raw, source-archive, tag, or default-branch fallback.
 

package/docs/cli.md

@@ -76,11 +76,7 @@ Run `devrites-engine update` in an installed project to resolve the latest
 stable release and update the project pack plus shared engine binary. The
 command downloads the release bundle and platform engine, verifies both exact
 filenames against their SHA-256 sidecars, then hands the extracted candidate to
-the downloaded engine. Each release asset must also pass `gh attestation verify`,
-pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`,
-so `gh` must be installed and authenticated, with no bypass (see
-[Install, update, and remove](../README.md#install-update-and-remove)). This
-avoids asking an old engine to validate a newer payload schema.
+the downloaded engine. This avoids asking an old engine to validate a newer payload schema.
 
 `devrites-engine update --check` resolves and compares release metadata without
 downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
@@ -100,9 +96,8 @@ comparison without changing the installation. Use
 retaining the shared `devrites-engine` binary.
 
 If an older direct engine reports `missing codex/hooks.json` or asks for
-`--source-dir`, run `npx devrites@latest update`, or use a release `install.sh` that is both
-checksum-verified and attestation-verified (pinned repo and signer workflow, see
-the verified Bash bootstrap under
+`--source-dir`, run `npx devrites@latest update`, or use a release `install.sh` that is
+checksum-verified (see the verified Bash bootstrap under
 [README Install, update, and remove](../README.md#install-update-and-remove))
 and run `bash ./install.sh update` once to install a release with the
 self-contained updater.
@@ -271,9 +266,7 @@ commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
 Install, update application, and uninstall remain manifest-owned local
 operations. Direct engine update, shell, and npm may acquire a release candidate;
 all remote acquisition uses exact SemVer, HTTPS-only redirect hops, mandatory
-exact-filename SHA-256 sidecars, a `gh attestation verify` check of every release
-asset (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass), private temporary
+exact-filename SHA-256 sidecars, private temporary
 directories, and byte/archive bounds, with no unchecked raw/source/default-branch
 fallback. Update accepts
 `--check` to compare the installed manifest version with the latest stable

package/docs/command-map.md

@@ -74,8 +74,7 @@ Scans cap captured input at 64 MiB and entries/findings at 4,096; findings expos
 metadata only and source or limit errors fail closed.
 
 Direct `devrites-engine update` acquires the latest exact-release pack and
-platform binary, each verified by SHA-256 sidecar and `gh attestation verify`
-(`gh` installed and authenticated), then hands local paths to the downloaded engine. Shell/npm may
+platform binary, each verified by SHA-256 sidecar, then hands local paths to the downloaded engine. Shell/npm may
 perform the same acquisition before invoking the local path. `--check` compares
 the installed version with latest release metadata without downloading assets;
 engine release selectors are unsupported.

package/docs/release.md

@@ -31,9 +31,8 @@ the missing host payload before handing that local candidate to the engine. The
 engine itself only validates and copies host payloads; it never generates them.
 The npm entrypoint, verified release installer, and direct engine updater acquire
 only an exact-SemVer release bundle or platform binary with its mandatory
-exact-filename SHA-256 sidecar, and each such asset must also pass
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass).
+exact-filename SHA-256 sidecar. They do not run `gh attestation verify`; that
+check is an optional manual step (below).
 
 Verify a downloaded engine binary from a GitHub Release:
 
@@ -45,7 +44,8 @@ curl -q -LO "https://github.com/ViktorsBaikers/DevRites/releases/download/v<vers
 
 Every release artifact also carries a GitHub artifact attestation (build
 provenance generated inside the release job, bound to the artifact digest).
-Verify it, pinning the signer workflow so an attestation minted from any other
+The installers do not check it, and GitHub CLI is not needed to install.
+To verify it manually, pin the signer workflow so an attestation minted from any other
 workflow path in this repository is rejected — provenance proves where a build
 ran, not that the publishing step was the intended one:
 
@@ -80,8 +80,7 @@ or path breach before extraction (at most 10,000 members, 4,096-byte paths, and
 256 MiB expanded files). Metadata is capped at 1 MiB, sidecars at 4 KiB,
 archives/binaries at 64 MiB, and the Node adapter follows at most five redirects.
 There is no raw, source-archive, tag, or default-branch acquisition fallback;
-exact-release guarantees begin at the checksummed release `install.sh` asset that
-also passes `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`).
+exact-release guarantees begin at the checksummed release `install.sh` asset.
 The Go release boundary may acquire the latest stable candidate; the downloaded
 engine then supplies local paths to the manifest-owned update core. Engine
 `update --check` resolves release metadata but downloads no assets. `--to` and

package/engine/internal/release/release.go

@@ -16,7 +16,6 @@ import (
 	"net/netip"
 	"net/url"
 	"os"
-	"os/exec"
 	"path"
 	"path/filepath"
 	"regexp"
@@ -98,7 +97,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 	bundleName := "devrites-" + tag + ".tar.gz"
 	bundleURL := base + "/" + bundleName
 	bundlePath := filepath.Join(tmp, bundleName)
-	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644, repository); err != nil {
+	if err := downloadVerified(ctx, bundleURL, bundlePath, bundleName, 0o644); err != nil {
 		return fail(fmt.Errorf("download release bundle: %w", err))
 	}
 	source, err := extractBundle(bundlePath, tmp, tag)
@@ -108,7 +107,7 @@ func Acquire(ctx context.Context, repository, tag string) (Candidate, func(), er
 
 	engineURL := base + "/" + binaryName
 	enginePath := filepath.Join(tmp, binaryName)
-	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755, repository); err != nil {
+	if err := downloadVerified(ctx, engineURL, enginePath, binaryName, 0o755); err != nil {
 		return fail(fmt.Errorf("download engine binary: %w", err))
 	}
 	return Candidate{
@@ -185,7 +184,7 @@ func fetchJSON(ctx context.Context, rawURL string, out any) error {
 	return nil
 }
 
-func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode, repository string) error {
+func downloadVerified(ctx context.Context, rawURL, destination, filename string, mode fs.FileMode) error {
 	if err := download(ctx, rawURL, destination, maxAssetBytes, mode); err != nil {
 		return err
 	}
@@ -223,15 +222,6 @@ func downloadVerified(ctx context.Context, rawURL, destination, filename string,
 	if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), hex.EncodeToString(want)) {
 		return fmt.Errorf("checksum mismatch for %s", filename)
 	}
-	signer := repository + "/.github/workflows/ci.yml@refs/heads/main"
-	// #nosec G204 -- fixed gh argv; repository is matched by repositoryPattern (leading alphanumeric, so never a flag) in Acquire and destination is an absolute path under the engine-created temp dir
-	cmd := exec.CommandContext(ctx, "gh", "attestation", "verify", destination, "--repo", repository, "--signer-workflow", signer)
-	if _, err := cmd.CombinedOutput(); err != nil {
-		if errors.Is(err, exec.ErrNotFound) {
-			return errors.New("gh (GitHub CLI) is required and must be authenticated for attestation verification")
-		}
-		return fmt.Errorf("attestation verification failed for %s: %w", filename, err)
-	}
 	return nil
 }
 

package/engine/internal/release/release_test.go

@@ -33,7 +33,9 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 		bundleName: bundle,
 		binaryName: engine,
 	}
-	installAttestationStandIn(t, bundle, engine)
+	if runtime.GOOS == "windows" {
+		t.Skip("positive-control engine is a shell script")
+	}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/repos/owner/repo/releases/latest" {
 			_, _ = fmt.Fprintf(w, `{"tag_name":%q}`, tag)
@@ -81,12 +83,12 @@ func TestLatestAndAcquireVerifiedRelease(t *testing.T) {
 	cmd := exec.Command(candidate.EnginePath)
 	cmd.Env = append(os.Environ(), "MARKER="+marker)
 	if err := cmd.Run(); err == nil {
-		t.Fatal("attested engine exited successfully; want positive-control exit 23")
+		t.Fatal("acquired engine exited successfully; want positive-control exit 23")
 	} else if exit, ok := err.(*exec.ExitError); !ok || exit.ExitCode() != 23 {
-		t.Fatalf("attested engine exit = %v, want 23", err)
+		t.Fatalf("acquired engine exit = %v, want 23", err)
 	}
 	if got, err := os.ReadFile(marker); err != nil || string(got) != "success" {
-		t.Fatalf("attested engine marker = %q, %v", got, err)
+		t.Fatalf("acquired engine marker = %q, %v", got, err)
 	}
 	cleanup()
 	if _, err := os.Stat(root); !os.IsNotExist(err) {
@@ -111,199 +113,6 @@ func TestValidTag(t *testing.T) {
 	}
 }
 
-func TestAcquireRejectsOriginSubstitution(t *testing.T) {
-	const tag = "v4.1.0"
-	trusted := testBundle(t, tag, map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-	})
-	attacker := testBundle(t, tag, map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "attacker\n",
-	})
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	installAttestationStandIn(t, trusted, []byte("trusted engine"))
-	assets := map[string][]byte{"devrites-" + tag + ".tar.gz": attacker, binaryName: []byte("attacker engine")}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		name := filepath.Base(r.URL.Path)
-		assetName := strings.TrimSuffix(name, ".sha256")
-		asset, ok := assets[assetName]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		if strings.HasSuffix(name, ".sha256") {
-			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-			return
-		}
-		_, _ = w.Write(asset)
-	}))
-	defer server.Close()
-	oldWeb := webBaseURL
-	webBaseURL = server.URL
-	t.Cleanup(func() { webBaseURL = oldWeb })
-
-	_, _, err = Acquire(context.Background(), "owner/repo", tag)
-	if err == nil || !strings.Contains(err.Error(), "attestation verification failed") {
-		t.Fatalf("Acquire error = %v, want attestation refusal despite a matching origin checksum", err)
-	}
-}
-
-func TestAcquireRejectsSingleAssetSubstitution(t *testing.T) {
-	const tag = "v4.1.0"
-	files := map[string]string{
-		"package.json": `{"version":"4.1.0"}`,
-		"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-	}
-	trustedBundle := testBundle(t, tag, files)
-	files["pack/generated/claude/skills/rite/SKILL.md"] = "attacker\n"
-	attackerBundle := testBundle(t, tag, files)
-	trustedEngine, attackerEngine := []byte("trusted engine"), []byte("attacker engine")
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	for _, tc := range []struct {
-		name, refusedAsset string
-		bundle, engine     []byte
-	}{
-		{"engine only", binaryName, trustedBundle, attackerEngine},
-		{"bundle only", "devrites-" + tag + ".tar.gz", attackerBundle, trustedEngine},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			installAttestationStandIn(t, trustedBundle, trustedEngine)
-			assets := map[string][]byte{"devrites-" + tag + ".tar.gz": tc.bundle, binaryName: tc.engine}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				name := filepath.Base(r.URL.Path)
-				assetName := strings.TrimSuffix(name, ".sha256")
-				asset, ok := assets[assetName]
-				if !ok {
-					http.NotFound(w, r)
-					return
-				}
-				if strings.HasSuffix(name, ".sha256") {
-					_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-					return
-				}
-				_, _ = w.Write(asset)
-			}))
-			defer server.Close()
-			oldWeb := webBaseURL
-			webBaseURL = server.URL
-			t.Cleanup(func() { webBaseURL = oldWeb })
-
-			_, cleanup, err := Acquire(context.Background(), "owner/repo", tag)
-			if err == nil {
-				cleanup()
-				t.Fatal("Acquire accepted a release with one unattested asset")
-			}
-			want := "attestation verification failed for " + tc.refusedAsset
-			if !strings.Contains(err.Error(), want) {
-				t.Fatalf("Acquire error = %v, want %q", err, want)
-			}
-		})
-	}
-}
-
-func installAttestationStandIn(t *testing.T, trusted ...[]byte) {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("attestation stand-in and positive-control engine are shell scripts")
-	}
-	dir := t.TempDir()
-	var hashes strings.Builder
-	for _, data := range trusted {
-		fmt.Fprintf(&hashes, "%x\n", sha256.Sum256(data))
-	}
-	allowed := filepath.Join(dir, "allowed-digests")
-	if err := os.WriteFile(allowed, []byte(hashes.String()), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	gh := filepath.Join(dir, "gh")
-	script := `#!/bin/sh
-[ "$1" = attestation ] && [ "$2" = verify ] && [ "$4" = --repo ] && [ "$5" = owner/repo ] && [ "$6" = --signer-workflow ] && [ "$7" = owner/repo/.github/workflows/ci.yml@refs/heads/main ] || exit 64
-got=$(shasum -a 256 "$3" | awk '{print $1}') || exit 65
-grep -Fxq "$got" "$ATTESTED_DIGESTS"
-`
-	if err := os.WriteFile(gh, []byte(script), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
-	t.Setenv("ATTESTED_DIGESTS", allowed)
-}
-
-func TestAttestationStandInIsStrict(t *testing.T) {
-	trusted := []byte("trusted engine")
-	installAttestationStandIn(t, trusted, []byte("other"))
-	dir := t.TempDir()
-	good := filepath.Join(dir, "good")
-	bad := filepath.Join(dir, "bad")
-	if err := os.WriteFile(good, trusted, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(bad, []byte("attacker engine"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	const signer = "owner/repo/.github/workflows/ci.yml@refs/heads/main"
-	run := func(file, repo, workflow string) error {
-		return exec.Command("gh", "attestation", "verify", file, "--repo", repo, "--signer-workflow", workflow).Run()
-	}
-	if err := run(good, "owner/repo", signer); err != nil {
-		t.Fatalf("stand-in rejected the pinned request: %v", err)
-	}
-	if run(good, "other/repo", signer) == nil {
-		t.Error("stand-in accepted a wrong repo")
-	}
-	if run(good, "owner/repo", "owner/repo/.github/workflows/other.yml@refs/heads/main") == nil {
-		t.Error("stand-in accepted a wrong signer workflow")
-	}
-	if run(bad, "owner/repo", signer) == nil {
-		t.Error("stand-in accepted an unattested digest")
-	}
-}
-
-func TestAcquireRejectsMissingAttestationVerifier(t *testing.T) {
-	const tag = "v4.1.0"
-	binaryName, err := platformBinaryName()
-	if err != nil {
-		t.Skip(err)
-	}
-	assets := map[string][]byte{
-		"devrites-" + tag + ".tar.gz": testBundle(t, tag, map[string]string{
-			"package.json": `{"version":"4.1.0"}`,
-			"pack/generated/claude/skills/rite/SKILL.md": "rite\n",
-		}),
-		binaryName: []byte("engine"),
-	}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		name := filepath.Base(r.URL.Path)
-		assetName := strings.TrimSuffix(name, ".sha256")
-		asset, ok := assets[assetName]
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		if strings.HasSuffix(name, ".sha256") {
-			_, _ = fmt.Fprintf(w, "%x  %s\n", sha256.Sum256(asset), assetName)
-			return
-		}
-		_, _ = w.Write(asset)
-	}))
-	defer server.Close()
-	oldWeb := webBaseURL
-	webBaseURL = server.URL
-	t.Cleanup(func() { webBaseURL = oldWeb })
-	t.Setenv("PATH", t.TempDir())
-
-	_, _, err = Acquire(context.Background(), "owner/repo", tag)
-	if err == nil || !strings.Contains(err.Error(), "gh (GitHub CLI) is required") {
-		t.Fatalf("Acquire error = %v, want refusal when gh is not installed", err)
-	}
-}
-
 func TestAcquireRejectsChecksumMismatch(t *testing.T) {
 	const tag = "v4.1.0"
 	bundleName := "devrites-" + tag + ".tar.gz"

package/install.sh

@@ -13,8 +13,6 @@ DEVRITES_REPO="${DEVRITES_REPO:-ViktorsBaikers/DevRites}"
 DEVRITES_REF="${DEVRITES_REF:-}"
 
 BOOTSTRAP_DIR=""
-RUN_JOB=""
-RUN_WATCH=""
 BOOTSTRAP_MAX_METADATA=1048576
 BOOTSTRAP_MAX_SIDECAR=4096
 BOOTSTRAP_MAX_ARCHIVE=67108864
@@ -140,114 +138,6 @@ verify_sha256() {
   [ -n "$want" ] && [ -n "$got" ] && [ "$got" = "$want" ]
 }
 
-# Runs a command for at most $1 seconds with output discarded. Past the limit it
-# is sent SIGTERM and, if it is still alive two seconds later, SIGKILL. A command
-# stopped this way sets RUN_TIMED_OUT=1 and returns 124; any other failure keeps
-# the command's own status, so a crash is never mistaken for a timeout. Same
-# watchdog idea as scripts/install-lib.sh dr_run_bounded, which is not available
-# until the bundle is verified and extracted. The timeout marker lives in
-# $BOOTSTRAP_DIR, which the EXIT trap removes, so a run without that directory
-# fails closed; stop_bounded ends a command and watchdog still in flight when the
-# bootstrap is interrupted.
-run_bounded() {
-  limit="$1"; shift
-  RUN_TIMED_OUT=0
-  [ -n "$BOOTSTRAP_DIR" ] || return 125
-  fired="$(mktemp "$BOOTSTRAP_DIR/bound.XXXXXX" 2>/dev/null)" || return 125
-  "$@" >/dev/null 2>&1 </dev/null &
-  job=$!
-  RUN_JOB=$job
-  {
-    trap 'kill "$nap"; exit 0' TERM
-    sleep "$limit" & nap=$!; wait "$nap"
-    kill -0 "$job" || exit 0
-    echo 1 >"$fired"
-    kill "$job"
-    sleep 2 & nap=$!; wait "$nap"
-    kill -9 "$job"
-  } >/dev/null 2>&1 </dev/null &
-  watch=$!
-  RUN_WATCH=$watch
-  wait "$job" 2>/dev/null
-  rc=$?
-  kill "$watch" >/dev/null 2>&1
-  wait "$watch" 2>/dev/null
-  RUN_JOB=""; RUN_WATCH=""
-  if [ "$rc" -ne 0 ] && [ -s "$fired" ]; then
-    RUN_TIMED_OUT=1
-    rc=124
-  fi
-  rm -f "$fired"
-  return "$rc"
-}
-
-stop_bounded() {
-  # A signal can land after a job is forked but before its PID is recorded, so
-  # every background job is ended, not only the recorded ones. run_bounded is the
-  # only place this script backgrounds anything.
-  for pid in $(jobs -p); do
-    [ "$pid" = "$RUN_WATCH" ] || kill -9 "$pid" >/dev/null 2>&1
-  done
-  [ -z "$RUN_WATCH" ] || kill "$RUN_WATCH" >/dev/null 2>&1
-  RUN_JOB=""; RUN_WATCH=""
-}
-
-# The checksum sidecar above travels with the tarball it vouches for: it is
-# fetched from "$url.sha256", one suffix away from the artifact's own origin. An
-# attacker who substitutes the release origin therefore supplies both the
-# payload and a digest that matches it, and the digest check passes. The
-# release job already mints the proof that does not travel with the artifact --
-# a build-provenance attestation signed by that job's OIDC identity and bound to
-# the artifact digest (.github/workflows/ci.yml, 'Attest release artifacts').
-# Verify it here, pinned to the repository and to the signer workflow, so an
-# attestation minted by any other workflow in this repository is rejected too.
-#
-# There is deliberately no bypass for a missing verifier: without gh there is no
-# proof of origin, and the sidecar is not a substitute for one.
-#
-# The lookup is bounded: DEVRITES_ATTEST_TIMEOUT is a whole number of seconds
-# (1 to 99999, default 120). Anything else is ignored with a warning and the
-# default applies, so a bad value can never remove the bound. The follow-up
-# `gh auth status` is bounded by 30 seconds or that limit, whichever is shorter.
-# A timeout, a crash and a plain rejection each fail closed and are reported as
-# what they are.
-verify_attestation() {
-  file="$1"
-  signer="$DEVRITES_REPO/.github/workflows/ci.yml@refs/heads/main"
-  ATTESTATION_FAILURE=""
-  if ! command -v gh >/dev/null 2>&1; then
-    ATTESTATION_FAILURE="attestation verification failed: gh (GitHub CLI) is required and was not found"
-    return 1
-  fi
-  attest_limit=120
-  case "${DEVRITES_ATTEST_TIMEOUT:-}" in
-  "") ;;
-  *[!0-9]* | 0* | [0-9][0-9][0-9][0-9][0-9][0-9]*)
-    echo "warning: ignoring invalid DEVRITES_ATTEST_TIMEOUT '$DEVRITES_ATTEST_TIMEOUT' (expected whole seconds, 1 to 99999); using $attest_limit" >&2
-    ;;
-  *) attest_limit="$DEVRITES_ATTEST_TIMEOUT" ;;
-  esac
-  auth_limit=30
-  [ "$attest_limit" -lt "$auth_limit" ] && auth_limit="$attest_limit"
-  verify_rc=0
-  run_bounded "$attest_limit" gh attestation verify "$file" --repo "$DEVRITES_REPO" \
-    --signer-workflow "$signer" || verify_rc=$?
-  if [ "$verify_rc" -ne 0 ]; then
-    if [ "$RUN_TIMED_OUT" -eq 1 ]; then
-      ATTESTATION_FAILURE="attestation verification timed out after ${attest_limit}s; check connectivity or raise DEVRITES_ATTEST_TIMEOUT and retry"
-    elif [ "$verify_rc" -ge 128 ]; then
-      ATTESTATION_FAILURE="attestation verification failed: gh exited with status $verify_rc"
-    elif run_bounded "$auth_limit" gh auth status; then
-      ATTESTATION_FAILURE="attestation verification failed: no build provenance from $signer"
-    elif [ "$RUN_TIMED_OUT" -eq 1 ]; then
-      ATTESTATION_FAILURE="attestation verification timed out: gh auth status did not answer within ${auth_limit}s; check connectivity or raise DEVRITES_ATTEST_TIMEOUT and retry"
-    else
-      ATTESTATION_FAILURE="attestation verification failed: gh is not authenticated (attestation lookup requires a GitHub login); run 'gh auth login' and retry"
-    fi
-    return 1
-  fi
-}
-
 preflight_archive() {
   archive_path="$1"
   tag="$2"
@@ -324,7 +214,7 @@ bootstrap_bundle() {
     exit 1
   }
   umask "$old_umask"
-  trap 'stop_bounded; exit 1' HUP INT TERM
+  trap 'exit 1' HUP INT TERM
   trap 'rm -rf "$BOOTSTRAP_DIR"' EXIT
   if [ -n "$DEVRITES_REF" ]; then
     tag="$(normalize_release_tag "$DEVRITES_REF")" || {
@@ -361,11 +251,6 @@ bootstrap_bundle() {
     echo "error: release $tag asset $asset: checksum failed." >&2
     exit 1
   }
-  verify_attestation "$archive" || {
-    rm -f "$archive" "$sidecar"
-    echo "error: release $tag asset $asset: ${ATTESTATION_FAILURE:-attestation verification failed}." >&2
-    exit 1
-  }
   uncompressed="$BOOTSTRAP_DIR/devrites-$tag.tar"
   bounded_decompress "$archive" "$uncompressed" "$BOOTSTRAP_MAX_UNCOMPRESSED" || {
     rm -f "$archive" "$sidecar"

package/pack/.claude/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/.claude/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/pack/generated/claude/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/generated/claude/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/pack/generated/codex/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/generated/codex/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/pack/generated/devin/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/generated/devin/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/pack/generated/omp/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/generated/omp/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/pack/generated/pi/skills/devrites-lib/reference/standards/agents.md

@@ -68,6 +68,8 @@ rejected result, stop, or a launch refused with no handle — run
 `devrites-engine claim release --session <id> --id <claim-id>`. Claims expire
 by TTL only as crash recovery; `claim list` shows who holds what. Claims are
 advisory coordination, never a substitute for the one-writer-per-worktree rule.
+Claims cover product paths only; root-authored `.devrites/**` files use
+[`workflow-artifacts.md`](workflow-artifacts.md) admission instead.
 Expiry is not proof the holder stopped: size `claim add --ttl <minutes>` to the
 expected write (engine max 240) and re-add before it lapses; before writing, also
 read `claim list --all` — a foreign `expired` claim on overlapping paths whose

package/pack/generated/pi/skills/rite-build/reference/wright-dispatch.md

@@ -75,7 +75,9 @@ Same-worktree (non-isolated) dispatch claims before writing: `devrites-engine
 claim add --session <id> <task-paths>`; retain its returned `<claim-id>`, then run
 `devrites-engine claim check --session <id> <task-paths>` — a held claim from a
 live foreign session releases the retained claim and stops the dispatch, per
-[`agents.md`](../../devrites-lib/reference/standards/agents.md). Ask the host
+[`agents.md`](../../devrites-lib/reference/standards/agents.md). `.devrites/**`
+is never a task path; see [Workflow Artifact admission](../../devrites-lib/reference/standards/workflow-artifacts.md).
+Ask the host
 for the exact writer in fresh context and wait. Track it through the
 launch barrier — `devrites-engine dispatch <slug> open --phase build --wave
 <slice-id> --role slice-wright`, then `start` with the host handle, `seal`, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code, Codex, omp, pi, and Devin CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",

package/scripts/install-lib.sh

@@ -100,20 +100,6 @@ dr_verify_checksum() {
   [ "$_dr_got" = "$_dr_want" ]
 }
 
-# Runs a command for at most $1 seconds with output discarded; a timeout is a failure.
-dr_run_bounded() {
-  _dr_limit="$1"; shift
-  "$@" >/dev/null 2>&1 </dev/null &
-  _dr_job=$!
-  { trap 'kill "$_dr_nap"; exit 0' TERM; sleep "$_dr_limit" & _dr_nap=$!; wait "$_dr_nap" && kill "$_dr_job"; } >/dev/null 2>&1 </dev/null &
-  _dr_watch=$!
-  wait "$_dr_job" 2>/dev/null
-  _dr_rc=$?
-  kill "$_dr_watch" >/dev/null 2>&1
-  wait "$_dr_watch" 2>/dev/null
-  return "$_dr_rc"
-}
-
 dr_download_engine() {
   _dr_source_dir="$1"
   _dr_repo="$2"
@@ -138,8 +124,6 @@ dr_download_engine() {
   dr_bounded_download "$_dr_url" "$_dr_engine_out" 67108864 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: ${DR_DOWNLOAD_FAILURE:-download} failed"; return 1; }
   dr_bounded_download "$_dr_url.sha256" "$_dr_engine_out.sha256" 4096 || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset.sha256: ${DR_DOWNLOAD_FAILURE:-download} failed"; rm -f "$_dr_engine_out"; return 1; }
   dr_verify_checksum "$_dr_engine_out" "$_dr_engine_out.sha256" "$_dr_asset" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: checksum failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
-  _dr_signer="$_dr_repo/.github/workflows/ci.yml@refs/heads/main"
-  command -v gh >/dev/null 2>&1 && dr_run_bounded "${DR_ATTEST_TIMEOUT:-120}" gh attestation verify "$_dr_engine_out" --repo "$_dr_repo" --signer-workflow "$_dr_signer" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: attestation verification failed (gh must be installed and authenticated)"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
   chmod +x "$_dr_engine_out" || { DR_ACQUIRE_FAILURE="release $_dr_tag asset $_dr_asset: executable preparation failed"; rm -f "$_dr_engine_out" "$_dr_engine_out.sha256"; return 1; }
 }