devrites 6.0.1 → 6.0.3

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [6.0.3](https://github.com/ViktorsBaikers/DevRites/compare/v6.0.2...v6.0.3) (2026-10-14)
+
+### Changed
+
+* **devrites:** cut rite-build time without weakening gates ([#104](https://github.com/ViktorsBaikers/DevRites/issues/104)) ([64133ca](https://github.com/ViktorsBaikers/DevRites/commit/64133ca070947c3e9b170f1ee978302d63937c03))
+
+### Fixed
+
+* **no-release:** accept --help after dispatch subcommand ([#103](https://github.com/ViktorsBaikers/DevRites/issues/103)) ([532ce43](https://github.com/ViktorsBaikers/DevRites/commit/532ce4324ae155f891345f825cbd2e04dd37ae85))
+
+## [6.0.2](https://github.com/ViktorsBaikers/DevRites/compare/v6.0.1...v6.0.2) (2026-10-14)
+
+### Fixed
+
+* **installer:** drop gh attestation requirement from installers ([ff27b58](https://github.com/ViktorsBaikers/DevRites/commit/ff27b58f569dffdc956ce4a4c759cb6427abc9bd))
+
 ## [6.0.1](https://github.com/ViktorsBaikers/DevRites/compare/v6.0.0...v6.0.1) (2026-10-14)
 
 ### Fixed

package/README.md

@@ -31,7 +31,7 @@ history can't lose it. After you clear the conversation, switch hosts, or hand
 the feature to another engineer, the next session reads the same plan,
 decisions, and evidence before it continues.
 
-**Status:** [`v6.0.1`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.0.1): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v6.0.3`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v6.0.3): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -51,11 +51,6 @@ This is the latest published release; `main` may contain unreleased work.
 install and run DevRites. Development in this repository (`npm ci`, which
 `.npmrc` runs with `engine-strict=true`) needs Node.js 22.22.2 or later within
 22.x, or 24.15 or later; Node 23.x and 24.0 through 24.14 fail with `EBADENGINE`.
-`gh` (GitHub CLI) must also be installed and authenticated, not merely
-installed, because DevRites verifies the build-provenance attestation of every
-release asset it downloads. Run `gh auth login` once, then `gh auth status` to
-confirm. See [Install, update, and remove](#install-update-and-remove) for
-which routes fail without it and which fall back to a local build.
 
 ```bash
 npx devrites@latest
@@ -315,8 +310,7 @@ Run `npx devrites@latest --help` for common flags and
 <br>
 
 Download the release-owned installer and its checksum before executing it. It
-needs `curl`, `gzip`, and `tar`, plus `gh` (GitHub CLI) installed and
-authenticated (`gh auth login`).
+needs `curl`, `gzip`, and `tar`.
 
 ```bash
 bootstrap_dir="$(mktemp -d)"
@@ -349,8 +343,6 @@ project_dir="$PWD"
     exit 1
   fi
   [ "$got" = "$want" ] || { echo 'error: install.sh checksum mismatch' >&2; exit 1; }
-  command -v gh >/dev/null 2>&1 || { echo 'error: gh (GitHub CLI) is required and was not found' >&2; exit 1; }
-  gh attestation verify install.sh --repo ViktorsBaikers/DevRites --signer-workflow ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main || { if gh auth status >/dev/null 2>&1; then echo 'error: install.sh attestation verification failed: no build provenance from ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main' >&2; else echo 'error: gh is not authenticated; run gh auth login' >&2; fi; exit 1; }
 
   # Choose one Node-free operation:
   bash ./install.sh --target "$project_dir"  # install into the directory you ran this from
@@ -403,59 +395,19 @@ proof. `devrites-engine migrate` owns deterministic v5 schema normalization.
 See the [CLI contract](docs/cli.md) and
 [ADR-0029](docs/adr/0029-v5-workspace-schema-and-native-migration.md).
 
-Every release asset is verified with `gh attestation verify` before it is
-decompressed, extracted, or executed, so `gh` must be installed and
-authenticated (`gh auth login`). Without that, the Bash bootstrap (`install.sh`
-fetched with `curl`) and `devrites-engine update` are fatal: they stop with no
-fallback. `npx devrites@latest` instead falls back to compiling the shipped
-`engine/` with `go build` when Go is installed, and the engine acquisition in
-`scripts/install-lib.sh` (used by `install.sh` from a clone or an extracted
-bundle) has its own fallback of the same kind.
-
-Release binaries and installers ship with SHA-256 sidecars and
-build-provenance attestations. Verify a download with both
-`shasum -a 256 -c <file>.sha256` and
+Every release asset is checked against its exact-filename SHA-256 sidecar
+before it is decompressed, extracted, or executed. The installers do not need
+GitHub CLI and do not run `gh attestation verify`.
+
+Release binaries and installers also ship with build-provenance attestations.
+The `.sha256` sidecar is fetched from the same origin as the artifact, so it is
+a corruption check, not a provenance one. To check provenance yourself, run
 `gh attestation verify <file> -R ViktorsBaikers/DevRites --signer-workflow ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`
-before it runs; the checksum alone is not enough (see the verified Bash
-bootstrap above).
-Pin the signer workflow, because valid provenance shows where a build ran
-but does not show that the intended publishing step produced it. See
+on the downloaded file before it runs. This step is optional. Pin the signer
+workflow, because valid provenance shows where a build ran but does not show
+that the intended publishing step produced it. See
 [docs/release.md](docs/release.md).
 
-Read a failure as "prove provenance or stop", not as a verdict about your
-build. The bootstrap checks `gh` itself, exits 1 before `install.sh` runs, and
-prints the cause. It says `error: gh (GitHub CLI) is required and was not
-found` when `gh` is absent. When `gh` is present but logged out (`gh auth
-status` fails) it says `error: gh is not authenticated; run gh auth login`.
-Only when `gh` is logged in and still rejects the attestation does it say
-`error: install.sh attestation verification failed: no build provenance from
-ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`. After that,
-`install.sh` verifies the release bundle `devrites-<tag>.tar.gz` and reports the
-same three causes as `attestation verification failed: gh (GitHub CLI) is
-required and was not found`, `attestation verification failed: gh is not
-authenticated ...; run 'gh auth login' and retry`, and `attestation verification
-failed: no build provenance from <signer>`. The engine binary is acquired
-separately: the bundled installer (`scripts/install-lib.sh`) and the npm route
-report `attestation verification failed (gh must be installed and
-authenticated)` for any of these causes, discard the downloaded binary, and
-fall back to other sources. The bundled installer builds from the bundle's
-`engine/` source when `go` is available, then tries an already-installed
-`devrites-engine`, and only when none works does `install.sh` exit 1 with
-`could not acquire devrites-engine` followed by that cause. `npx devrites@latest` repeats the combined message
-before exiting 127 when no other engine is available. `devrites-engine update` reports `gh (GitHub CLI) is
-required and must be authenticated for attestation verification` when `gh` is
-absent, and `attestation verification failed for <asset>` whenever a present
-`gh` rejects the asset, logged out or not.
-
-There is no flag to skip, disable, or bypass attestation verification. The
-`.sha256` sidecar is fetched from the same origin as the artifact, so a
-substituted origin supplies a digest that matches its own payload, which is why
-the sidecar is a corruption check and not a provenance one. If you cannot run
-`gh auth login`, install Go and use `npx devrites@latest`, or clone this
-repository and run `bash install.sh`: both compile `engine/` locally when the
-download is refused, with `cd engine && go build -o devrites-engine .` as the
-manual equivalent.
-
 </details>
 
 ## Hosts
@@ -527,10 +479,9 @@ traces. DevRites detects these tools but does not install them.
 
 - Installed host artifacts stay in the project. Use `--no-binary` or
   `DEVRITES_NO_BINARY=1` to avoid keeping a shared binary outside it.
-- npm, Bash, and `devrites-engine update` all require checksummed release
-  assets that also pass `gh attestation verify`, pinned to
-  `ViktorsBaikers/DevRites` and signer workflow
-  `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main` (see
+- npm, Bash, and `devrites-engine update` all require release assets that
+  match their SHA-256 sidecars. Build-provenance attestations can be checked
+  manually with `gh attestation verify` (see
   [Install, update, and remove](#install-update-and-remove)). Remote fetches use HTTPS at every redirect hop, are bounded in size,
   and never fall back to an unchecked raw file, source archive, tag, or default
   branch.

package/SECURITY.md

@@ -119,23 +119,20 @@ and `.codex/config.toml` without replacing unrelated user settings. The shared
 `devrites-engine` executable is the only allowed artifact outside the project.
 It is installed to `DEVRITES_BIN_DIR`, a writable `~/.local/bin`, or a writable
 `/usr/local/bin`; `--no-binary` / `DEVRITES_NO_BINARY=1` skips it. The bootstrap
-and direct updater may fetch the release bundle and checksummed engine assets,
-each of which must also pass `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`).
+and direct updater may fetch the release bundle and checksummed engine assets.
 They never invoke `sudo` or edit shell startup files.
 
 The documented Node-free boundary downloads the release-owned `install.sh` and
-its exact-name sidecar, then requires both the checksum and the build-provenance
-attestation (`gh attestation verify`, pinned to `ViktorsBaikers/DevRites` and
-signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`)
-to pass before execution, as in the README "verified Bash bootstrap"; mutable
+its exact-name sidecar, then requires the checksum to pass before execution, as
+in the README "verified Bash bootstrap"; mutable
 default-branch scripts are not recommended. Legacy local and extracted shim invocations remain compatible, but
 their exact-release guarantee begins at that verified asset. A piped shim never
 treats current-directory siblings as its bundle.
 
 Network acquisition accepts only an exact SemVer release asset and its mandatory
-exact-filename SHA-256 sidecar, and every release asset must also pass
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass). Every redirect hop must remain HTTPS, private
+exact-filename SHA-256 sidecar. Installers do not run `gh attestation verify`;
+release assets carry build-provenance attestations that users may verify
+manually (see [docs/release.md](docs/release.md)). Every redirect hop must remain HTTPS, private
 temporary-directory creation must succeed, and unchecked raw/source/default-
 branch fallbacks are absent. Representative in-stream ceilings are 1 MiB for
 release metadata, 4 KiB for a sidecar, and 64 MiB for an archive or binary, with
@@ -154,8 +151,7 @@ and [ADR-0028](docs/adr/0028-self-contained-engine-update.md) own the rationale.
 With `npx devrites@latest`, the CLI (`bin/devrites.mjs`) calls
 `devrites-engine` directly instead of running `install.sh`. The bundled host
 payload is pinned to the requested npm package version. The shim first tries the
-matching exact-release binary, which must pass its mandatory SHA-256 sidecar and
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`),
+matching exact-release binary, which must pass its mandatory SHA-256 sidecar,
 then a package-local Go build, and then an existing engine. Remote responses are
 byte-bounded and every redirect is checked before following it. It has no
 runtime npm dependencies. The same project and shared-binary boundaries apply

package/bin/devrites.mjs

@@ -190,14 +190,6 @@ async function downloadEngine() {
     rmSync(`${out}.sha256`, { force: true });
     return null;
   }
-  const signer = `${repo}/.github/workflows/ci.yml@refs/heads/main`;
-  const attestation = spawnSync('gh', ['attestation', 'verify', out, '--repo', repo, '--signer-workflow', signer], { stdio: 'ignore', timeout: 120_000 });
-  if (attestation.error || attestation.status !== 0) {
-    acquisitionFailure = `release ${tag} asset ${name}: attestation verification failed (gh must be installed and authenticated)`;
-    rmSync(out, { force: true });
-    rmSync(`${out}.sha256`, { force: true });
-    return null;
-  }
   try {
     chmodSync(out, 0o755);
   } catch {

package/docs/adr/0034-workflow-artifact-byte-corrections-get-code-review.md

@@ -0,0 +1,60 @@
+# ADR-0034: Workflow Artifact byte corrections get code review, not a plan loop
+
+- **Status:** Accepted
+- **Date:** 2026-10-15
+
+## Context
+
+A Workflow Artifact is a root-authored executable file under `.devrites/` that
+proves a slice (for example a native UI test launcher). Vet admits its design:
+paths, modes, behavior/interface/fixture rows, and the proof command. The root
+authors the bytes in a disposable preflight after Vet `READY`. The source handle
+derives from the readiness binding (ADR-0027), so promoting corrected bytes
+needs a new binding, and only Vet may record one.
+
+In practice every bug fix in such a script ran `/rite-plan repair` (plan-drafter)
+plus an affected `/rite-vet` (plan-reviewer). The plan reviewer then reviewed
+Python cleanup and rollback code. One measured feature spent 36% of agent time
+after Build started in Plan and Vet. All 144 of its Plan/Vet waves served one
+slice's proof harness, for example four consecutive archive-policy repair/Vet
+pairs for close and rollback bugs.
+
+## Decision
+
+- A correction that leaves every admission row and `WA-*` reference row
+  unchanged is a technical fix. It follows `OFFLINE_RECOVERY` and never
+  `/rite-plan repair`.
+- The root records the corrected bytes' identity digest as one exact
+  `test-plan.md` line below the admission block:
+  `Workflow Artifact reviewed identity: <64 lowercase hex>`.
+- `devrites-engine check drift` keeps a second digest of `test-plan.md` with
+  only that exact line shape removed. When it is the only change across all
+  readiness inputs, the drift is reported as `reviewed-identity-only`.
+- In that case narrow `/rite-vet` dispatches one fresh `devrites-code-reviewer`
+  on the prior-source→re-preflight diff against the unchanged admission rows,
+  instead of a plan drafter and plan reviewer. Fold and recheck follow the
+  canonical retry contract. Green review lets Vet record the new binding as
+  usual (ADR-0027 still applies; the engine never refreshes it).
+- Any other drift, including a malformed identity line, keeps the existing
+  narrow recheck by the plan reviewer.
+
+This narrows ADR-0027's "semantic review" for this one case to an independent
+code review of the exact bytes. The Workflow Artifact module, source-handle
+derivation, routes, and golden values are unchanged.
+
+## Consequences
+
+- The reviewed bytes are now bound into a readiness input. Before this, Vet
+  approved the design but never the exact corrected bytes.
+- A contract change to a Workflow Artifact still goes through Plan and Vet.
+- Slice-bound Vet rechecks also count toward the per-slice round cap
+  (`dispatch open --slice`), so a harness that keeps failing forces a recorded
+  reslice or simpler-proof review.
+
+## Alternatives considered
+
+| Option | Why not |
+|---|---|
+| Derive the source handle from the identity digest | Changes the protocol's crypto, golden values, and the reference model test, for the same saving. |
+| Let the engine refresh the binding after review | ADR-0027 keeps binding renewal a Vet act; the engine stays thin. |
+| Keep plan-reviewer for byte fixes | Measured cost above; a plan reviewer is the wrong specialist for code defects. |

package/docs/adr/README.md

@@ -72,10 +72,11 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0024](0024-native-policy-offline-installer-boundary.md) | Native policy and offline installer boundary | Accepted in part; offline engine-update clause superseded by 0028 | `tests/native-orchestration-contract-test.sh`, `tests/phase-gate-routing-test.sh`, `tests/install-smoke.sh`, `tests/host-artifacts-test.sh` |
 | [0025](0025-evidence-gated-workspace-upgrades.md) | Evidence-gated semantic workspace upgrades | Accepted; no-migrator scope superseded by 0029 | `tests/phase-gate-routing-test.sh`, `tests/host-artifacts-test.sh` |
 | [0026](0026-content-bound-proof-and-bounded-inputs.md) | Content-bound proof and bounded inputs | Accepted | `engine/internal/lib/candidate_test.go`, `engine/internal/lib/evidencefresh_test.go`, `engine/internal/gate/gate_test.go`, `engine/root_routing_test.go`, `engine/tests/parity_githelpers_test.go`, `tests/native-orchestration-contract-test.sh`, `tests/phase-gate-routing-test.sh`, `tests/install-smoke.sh`, `tests/update-smoke.sh`, `tests/npx-pack-smoke.sh`, `tests/release-tarball-test.sh` |
-| [0027](0027-content-bound-build-readiness.md) | Content-bound build readiness | Accepted; AC ID map amended 2026-09-04 | `engine/tests/adr_0027_readiness_binding_test.go`, `engine/internal/state/acceptance_test.go` |
+| [0027](0027-content-bound-build-readiness.md) | Content-bound build readiness | Accepted; AC ID map amended 2026-09-04; semantic review narrowed by 0034 for Workflow Artifact byte fixes | `engine/tests/adr_0027_readiness_binding_test.go`, `engine/internal/state/acceptance_test.go` |
 | [0028](0028-self-contained-engine-update.md) | Self-contained engine update | Accepted | `engine/internal/install/install_test.go`, `engine/internal/release/release_test.go`, `engine/tests/meta_test.go` |
 | [0029](0029-v5-workspace-schema-and-native-migration.md) | v5 workspace schema and native migration | Accepted | `engine/internal/state/workspaceschema_test.go`, `engine/tests/parity_resolve_test.go`, `engine/tests/parity_closeout_test.go` |
 | 0030 | Reserved number; no ADR is published under it | Unpublished | none |
 | [0031](0031-overhaul-agents-keep-every-tool.md) | `/overhaul` ships its own agents that keep every tool | Accepted; scopes the one-writer clauses of 0010/0015/0017/0018/0019 to `devrites-*` specialists | `scripts/validate-agent-composition.py`, `tests/codex-agent-generation-test.sh` |
 | [0032](0032-single-lint-gate-and-cached-pr-tests.md) | One engine lint gate, and PR tests that reuse main's results | Accepted | `tests/validation-governance-test.sh` |
 | [0033](0033-rite-fast-own-agents.md) | `/rite-fast` ships its own agents and its own writer | Accepted; adds `fast-builder` as a writer outside the `devrites-*` one-writer rule | `scripts/validate-agent-composition.py`, `tests/rite-fast-contract-test.sh` |
+| [0034](0034-workflow-artifact-byte-corrections-get-code-review.md) | Workflow Artifact byte corrections get code review, not a plan loop | Accepted; narrows 0027's semantic review for contract-preserving Workflow Artifact byte fixes | `engine/internal/lib/drift_test.go` |

package/docs/architecture.md

@@ -154,8 +154,7 @@ consume only local source, payload, and binary candidates.
 
 Direct `devrites-engine update` uses the separate `engine/internal/release`
 boundary to resolve the latest stable release and acquire its checksummed bundle
-and platform engine, each also checked with `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated). It then invokes the downloaded engine with local paths, so
+and platform engine. It then invokes the downloaded engine with local paths, so
 the candidate validates its own payload schema. `update --check` resolves only
 release metadata and downloads no assets. Engine `--to` and `--pre` selectors do
 not exist.
@@ -164,9 +163,7 @@ The shell entrypoints
 (`bin/devrites.mjs`) remain equivalent acquisition adapters. They acquire and
 verify the exact-release bundle or binary, then pass local paths and user flags
 through to the deterministic engine operation. All network paths require exact SemVer,
-HTTPS-only redirects, exact-filename SHA-256 sidecars, a `gh attestation verify`
-pass for every release asset (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-see [Install, update, and remove](../README.md#install-update-and-remove)), private temporary
+HTTPS-only redirects, exact-filename SHA-256 sidecars, private temporary
 directories, bounded transfers, and full archive preflight. They provide no
 unchecked raw, source-archive, tag, or default-branch fallback.
 

package/docs/cli.md

@@ -76,11 +76,7 @@ Run `devrites-engine update` in an installed project to resolve the latest
 stable release and update the project pack plus shared engine binary. The
 command downloads the release bundle and platform engine, verifies both exact
 filenames against their SHA-256 sidecars, then hands the extracted candidate to
-the downloaded engine. Each release asset must also pass `gh attestation verify`,
-pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`,
-so `gh` must be installed and authenticated, with no bypass (see
-[Install, update, and remove](../README.md#install-update-and-remove)). This
-avoids asking an old engine to validate a newer payload schema.
+the downloaded engine. This avoids asking an old engine to validate a newer payload schema.
 
 `devrites-engine update --check` resolves and compares release metadata without
 downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
@@ -100,9 +96,8 @@ comparison without changing the installation. Use
 retaining the shared `devrites-engine` binary.
 
 If an older direct engine reports `missing codex/hooks.json` or asks for
-`--source-dir`, run `npx devrites@latest update`, or use a release `install.sh` that is both
-checksum-verified and attestation-verified (pinned repo and signer workflow, see
-the verified Bash bootstrap under
+`--source-dir`, run `npx devrites@latest update`, or use a release `install.sh` that is
+checksum-verified (see the verified Bash bootstrap under
 [README Install, update, and remove](../README.md#install-update-and-remove))
 and run `bash ./install.sh update` once to install a release with the
 self-contained updater.
@@ -271,9 +266,7 @@ commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
 Install, update application, and uninstall remain manifest-owned local
 operations. Direct engine update, shell, and npm may acquire a release candidate;
 all remote acquisition uses exact SemVer, HTTPS-only redirect hops, mandatory
-exact-filename SHA-256 sidecars, a `gh attestation verify` check of every release
-asset (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass), private temporary
+exact-filename SHA-256 sidecars, private temporary
 directories, and byte/archive bounds, with no unchecked raw/source/default-branch
 fallback. Update accepts
 `--check` to compare the installed manifest version with the latest stable

package/docs/command-map.md

@@ -74,8 +74,7 @@ Scans cap captured input at 64 MiB and entries/findings at 4,096; findings expos
 metadata only and source or limit errors fail closed.
 
 Direct `devrites-engine update` acquires the latest exact-release pack and
-platform binary, each verified by SHA-256 sidecar and `gh attestation verify`
-(`gh` installed and authenticated), then hands local paths to the downloaded engine. Shell/npm may
+platform binary, each verified by SHA-256 sidecar, then hands local paths to the downloaded engine. Shell/npm may
 perform the same acquisition before invoking the local path. `--check` compares
 the installed version with latest release metadata without downloading assets;
 engine release selectors are unsupported.

package/docs/engine/commands.md

@@ -18,12 +18,12 @@ workflow strategy.
 | `check path-disjoint [--root <dir>] [<json-file> | -]` | Verify slice path sets are pairwise disjoint. |
 | `parallel select --cap <1-10> [--root <dir>] [<json-file> | -]` | Choose the greedy path-disjoint subset ≤ cap from supplied ready slices. |
 | `parallel <create\|integrate\|cleanup\|status\|abort\|lease-read\|lease-write\|lease-clear\|record-green>` | Deterministic parallel worktree leases, integration, and cleanup for parallel writer batches. |
-| `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. |
+| `check task-graph <slug>` | Validate `tasks.md` slice dependency graph for cycles, unknown deps, malformed tokens, duplicate IDs, missing `Dependencies`, and `depends_on` mismatch. Prints a non-blocking `ADVISORY size:` line (and records a `size-advisory` metric) for each slice with 12+ Writer allowlist files and no `Size rationale:`. |
 | `check regression <slug> [--update]` | Compare the workspace's structural progress facts (phase ordinal, checked ACs, met/abandoned gates, done slices, resolved questions, present artifacts) against the recorded `regression-baseline.json` high-water mark; `--update` ratchets the baseline forward under the feature lock and prints each blessed regression. |
-| `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. |
-| `check windows <slug> [--worktree\|--staged\|--base <ref>]` | Fail on deferral markers (TODO/FIXME/XXX/HACK, skipped-test and stub idioms) the change's added lines introduce without a waiver row in the workspace's `windows.md`. |
+| `check drift <slug> [--record]` | Attribute readiness-input changes to the exact artifact. `--record` writes the per-input `readiness-inputs.json` digest baseline under the feature lock; without it the workspace diffs current inputs against that baseline (or falls back to the aggregate binding recorded in `eng-review.md`). Advisory: exit `0` on drift; a corrupt baseline exits `3`. A `test-plan.md` change limited to exact `Workflow Artifact reviewed identity: <64hex>` lines is reported as `reviewed-identity-only` (ADR-0034). |
+| `check windows <slug> [--worktree\|--staged\|--base <ref>]` | Fail on deferral and bar-lowering markers the change introduces without a waiver row in the workspace's `windows.md`: added TODO/FIXME/XXX/HACK, skipped/focused-test and stub idioms, checker suppressions, one-line empty catch; removed `deleted-test` files and net `removed-assertion` lines in remaining test files. |
 | `check dup [slug] [--all\|--worktree\|--staged\|--base <ref>] [--min-lines n] [--threshold f] [--ignore-file <path>] [--limit n] [--exclude <csv>]` | Report near-duplicate code clusters that survive comment stripping, literal collapsing, and identifier renaming — token-shingle matches chained into segments, clustered transitively, ranked with bounded path/line-distance boosts. Diff modes mark units overlapping changed hunks with `*`; stable content-derived cluster hashes let `.devrites/dup-ignore` dismissals survive line moves but resurface on structural edits. Staged mode reads index blobs and excludes untracked files. Bounded heuristic: successful scans/leads exit `0`; usage, unavailable input, and partial scans exit `2`. |
-| `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. |
+| `check slice <slug> <SLICE-ID>` | Pre-dispatch lint of one slice's wright contract: contract present, exact Writer allowlist paths, resolvable `Satisfies` AC ids, bounded scope. Same non-blocking size advisory as `check task-graph`. |
 | `check diff-scope <slug> --allow <csv>\|--allow-file <path> [--worktree\|--staged\|--base <ref>]` | Verify the changed-path set stays inside the declared allowlist; the mechanical gate run before reviewer dispatch. |
 | `check skill-trust <path>` | Scan one skill/agent Markdown file for structural trust violations. |
 | `check indexes [--root <dir>]` | Report install manifest and code-index presence as JSON. |
@@ -32,8 +32,8 @@ workflow strategy.
 | `observe slice <slug> <SLICE-ID>` | Print one `SLICE-###` section of `tasks.md` so Build reads a slice, not the file. |
 | `next [slug]` | Print the minimal remaining lifecycle path plus advisory skips. |
 | `handoff [slug]` | Emit the deterministic resume record: cursor fields, `awaiting_human`, open `questions.md` gate kinds, the `gates.md` reduction with unmet/stale/abandoned ids, `decisions.md` dead ends, missing required files, and the canonical read-next order. Read-only; the `/rite-handoff` spine and the compaction-fallback entry point. |
-| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--trigger a,b]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. |
-| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; start/return auto-record metrics. |
+| `context [slug] (--phase <p>\|--skill <name>) [--role <r>] [--slice <SLICE-ID>] [--trigger a,b]` | Emit one deduplicated read-set bundle per phase/role/skill from each skill's `loads:` manifest; `--skill` works without a workspace when `--out` is given. A `--role` bundle leads with the role's agent contract and names the manifest's `rootOnly` paths instead of inlining them. `--slice` inlines that slice's `tasks.md` block and turns each over-budget artifact into a by-reference index (path, SHA-256, headings, line hits for every ID the block cites); repeat `--slice` for several slices; an unknown slice exits `3`. |
+| `dispatch <slug> <open\|start\|seal\|return\|status\|abandon>` | Launch-wave barrier for parallel dispatch: seal needs a handle per role, return needs seal; start/return auto-record metrics. A build wave with a wright role needs `--slice <SLICE-ID>` per slice, and a slice-bound vet wave takes it too; every 5 rounds of either kind on one slice, `open` exits `3` until `--reslice-review <DRIFT-ID>` names an unused `drift.md` `## <DRIFT-ID>` heading for that slice. |
 | `metrics record <slug> --phase <p> --event <e> [--role r] [--bytes n] [--note s]` | Append an event to the workspace's `metrics.jsonl` ledger. |
 | `metrics summary [slug]` | Reduce `metrics.jsonl` into a per-phase roll-up. |
 | `claim <add\|release\|list\|check>` | Advisory session-scoped file claims in `.devrites/claims.jsonl` (append-only). `add` records intent to write a path set with a TTL (1–240 min, default 30); a live claim by another session exits `3` and names the holder. `release` appends a release event owned by the claiming session. `list` shows live claims (`--all` includes expired/released). `check` is the read-only preflight for a path set. Coordination aid only — never a substitute for one-writer-per-worktree. |

package/docs/release.md

@@ -31,9 +31,8 @@ the missing host payload before handing that local candidate to the engine. The
 engine itself only validates and copies host payloads; it never generates them.
 The npm entrypoint, verified release installer, and direct engine updater acquire
 only an exact-SemVer release bundle or platform binary with its mandatory
-exact-filename SHA-256 sidecar, and each such asset must also pass
-`gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`;
-`gh` must be installed and authenticated, with no bypass).
+exact-filename SHA-256 sidecar. They do not run `gh attestation verify`; that
+check is an optional manual step (below).
 
 Verify a downloaded engine binary from a GitHub Release:
 
@@ -45,7 +44,8 @@ curl -q -LO "https://github.com/ViktorsBaikers/DevRites/releases/download/v<vers
 
 Every release artifact also carries a GitHub artifact attestation (build
 provenance generated inside the release job, bound to the artifact digest).
-Verify it, pinning the signer workflow so an attestation minted from any other
+The installers do not check it, and GitHub CLI is not needed to install.
+To verify it manually, pin the signer workflow so an attestation minted from any other
 workflow path in this repository is rejected — provenance proves where a build
 ran, not that the publishing step was the intended one:
 
@@ -80,8 +80,7 @@ or path breach before extraction (at most 10,000 members, 4,096-byte paths, and
 256 MiB expanded files). Metadata is capped at 1 MiB, sidecars at 4 KiB,
 archives/binaries at 64 MiB, and the Node adapter follows at most five redirects.
 There is no raw, source-archive, tag, or default-branch acquisition fallback;
-exact-release guarantees begin at the checksummed release `install.sh` asset that
-also passes `gh attestation verify` (pinned to `ViktorsBaikers/DevRites` and signer workflow `ViktorsBaikers/DevRites/.github/workflows/ci.yml@refs/heads/main`).
+exact-release guarantees begin at the checksummed release `install.sh` asset.
 The Go release boundary may acquire the latest stable candidate; the downloaded
 engine then supplies local paths to the manifest-owned update core. Engine
 `update --check` resolves release metadata but downloads no assets. `--to` and

package/engine/help.go

@@ -125,16 +125,20 @@ func takesSubcommand(command string) bool {
 	}
 }
 
-// claimValueFlags are the claim flags that consume the next argument as a value.
-var claimValueFlags = map[string]bool{"--session": true, "--reason": true, "--ttl": true, "--id": true}
+// valueFlags lists, per command, the flags that consume the next argument as a
+// value. A command listed here has known flags, so its help flag is honoured
+// anywhere except as the value of one of these flags.
+var valueFlags = map[string]map[string]bool{
+	"claim":    {"--session": true, "--reason": true, "--ttl": true, "--id": true},
+	"dispatch": {"--phase": true, "--wave": true, "--role": true, "--handle": true, "--reason": true},
+}
 
 // hasHelpFlag reports whether args (the arguments after the command word) are a
 // help request. The command path is consumed by dispatch, so a help flag is
 // honoured among the leading flags that follow it. The scan stops at the first
 // argument that does not start with a dash, because from there the engine
-// cannot tell a flag from a value or operand. Only claim, whose value flags are
-// known, honours a help flag later, and never one that is the value of such a
-// flag.
+// cannot tell a flag from a value or operand. Commands in valueFlags honour a
+// help flag later, and never one that is the value of such a flag.
 func hasHelpFlag(command string, args []string) bool {
 	if len(args) > 0 && !strings.HasPrefix(args[0], "-") && takesSubcommand(command) {
 		args = args[1:]
@@ -143,9 +147,10 @@ func hasHelpFlag(command string, args []string) bool {
 		if isHelpFlag(args[i]) {
 			return true
 		}
-		if command == "claim" && claimValueFlags[args[i]] {
+		known, ok := valueFlags[command]
+		if ok && known[args[i]] {
 			i++
-		} else if command != "claim" && !strings.HasPrefix(args[i], "-") {
+		} else if !ok && !strings.HasPrefix(args[i], "-") {
 			return false
 		}
 	}

package/engine/help_test.go

@@ -48,6 +48,7 @@ func TestCommandHelp(t *testing.T) {
 		{args: []string{"handoff", "--help"}, want: "handoff [slug]"},
 		{args: []string{"next", "help"}, want: "devrites-engine next [slug]"},
 		{args: []string{"dispatch", "help"}, want: "devrites-engine dispatch <slug>"},
+		{args: []string{"dispatch", "x", "open", "--help"}, want: "devrites-engine dispatch <slug>"},
 		{args: []string{"secret-scan", "help"}, want: "secret-scan [--staged] [--stdin]"},
 		{args: []string{"open-visual", "help"}, want: "open-visual <path-or-name>"},
 		{args: []string{"claim", "--help"}, want: "claim <add|release|list|check>"},

package/engine/internal/gate/readiness_binding.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"hash"
+	"regexp"
 	"strings"
 
 	"github.com/devrites/devrites/internal/markdowntext"
@@ -147,6 +148,20 @@ type ReadinessInputDigest struct {
 	Path    string `json:"path"`
 	Present bool   `json:"present"`
 	SHA256  string `json:"sha256,omitempty"`
+	// Normalized is test-plan.md's digest without its reviewed-identity lines,
+	// so drift can prove a Workflow Artifact byte correction changed nothing
+	// else Vet approved.
+	Normalized string `json:"normalized,omitempty"`
+}
+
+// reviewedIdentityRE is the exact test-plan.md line binding the Workflow
+// Artifact bytes an independent code review approved. Only this exact shape
+// is ignored, so the exclusion cannot hide any other edit.
+var reviewedIdentityRE = regexp.MustCompile(`(?m)^Workflow Artifact reviewed identity: [0-9a-f]{64}\r?\n?`)
+
+// withoutReviewedIdentity drops every exact reviewed-identity line.
+func withoutReviewedIdentity(content []byte) []byte {
+	return reviewedIdentityRE.ReplaceAll(content, nil)
 }
 
 // ReadinessInputDigests returns each readiness input's content digest plus the
@@ -172,6 +187,10 @@ func ReadinessInputDigests(root, slug string) ([]ReadinessInputDigest, string, e
 		if present {
 			sum := sha256.Sum256(content)
 			entry.SHA256 = hex.EncodeToString(sum[:])
+			if input.logical == "test-plan.md" {
+				normalized := sha256.Sum256(withoutReviewedIdentity(content))
+				entry.Normalized = hex.EncodeToString(normalized[:])
+			}
 		}
 		digests = append(digests, entry)
 	}

package/engine/internal/lib/cli_observe.go

@@ -5,6 +5,7 @@ import (
 	"io"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/state"
 )
 
 // RunTaskGraphCheck validates tasks.md for one slug.
@@ -21,6 +22,21 @@ func RunTaskGraphCheck(root, slug string, stdout, stderr io.Writer) int {
 		return 3
 	}
 	fmt.Fprintf(stdout, "task-graph: ok (%d slices)\n", len(graph.Slices))
+	// Size advisory: never changes the exit code; the metric shows how often
+	// it would have fired before anyone makes it blocking.
+	if raw, err := readWorkspaceArtifact(root, slug, "tasks.md"); err == nil {
+		over := 0
+		for _, s := range graph.Slices {
+			block, _ := state.ExtractTaskSlice(raw, s.ID)
+			if n, ok := sliceSizeAdvisory(block); ok {
+				fmt.Fprintf(stdout, "task-graph: ADVISORY size: %s has %d Writer allowlist files (>= %d); split it (acceptance-preserving) or record `Size rationale:`\n", s.ID, n, sliceFileAdvisory)
+				over++
+			}
+		}
+		if over > 0 {
+			recordMetric(root, slug, "define", "size-advisory", "", int64(over))
+		}
+	}
 	return 0
 }