rite-doctorlisted

# /rite-doctor: DevRites diagnostics Read-only: never repair files, advance a feature, or diagnose the application. ## Workflow 1. **Locate the repository root.** Resolve the current physical Git root without crossing into a parent repository. If `DEVRITES_ROOT` is set, confirm it names that root or its contained `.devrites/`. Record lexical and resolved paths. A missing/ambiguous root or an escape is `FAIL`. 2. **Inspect the installation manifest.** Read `.claude/devrites.manifest` as untrusted data. Check its version/flags header, relative and unique managed paths, containment, regular-file topology, and recorded SHA-256 values. Missing files, path escapes, symlinks, special files, malformed hashes, or customized managed bytes are `FAIL`; a legacy unhashed record is `WARN`. Do not rewrite or hash secrets into the report. 3. **Inspect installed host artifacts and config.** Honor manifest install flags. For enabled surfaces, require the canonical Claude skills/settings and the generated Codex skills, exact agent profiles, config, and AGENTS bridge. Cross-check the loaded/effective host configuration when the host exposes it: Claude root plan mode with only `devrites-slice-wright` writable; Codex root `devrites-orchestrator`, wright `:workspace`, all reviewers `:read-only`. File presence without effective loading is `WARN`; wrong permissions or a missing required profile is `FAIL`. 4. **Inspect workspace topology.** Read `.devrit