docs: add plain Wesley onboarding path

CHANGELOG.md

@@ -6,8 +6,32 @@ The format is based on Keep a Changelog, and this project adheres to Semantic Ve
 
 ## [Unreleased]
 
+### Added
+
+- Added a Plain Wesley first-hour docs path with a beginner compiler tutorial,
+  GraphQL-to-Wesley term map, contributor tutorial, and public-vocabulary rule
+  for new docs terminology.
+- Added an assurance capability matrix that separates shipped native CLI
+  evidence commands, transitional JavaScript tooling, Rust foundation code, and
+  concept-only assurance vocabulary.
+- Added an external target protocol MVP specification for future
+  descriptor-verified external-process target execution with host-enforced
+  capability denial, bounded execution, deterministic command resolution, and
+  staged artifact copy-out.
+- Added `cargo xtask bench-ir`, an advisory Rust-native IR lowering benchmark
+  that generates scale fixtures, reports structural counters and timing
+  summaries, and can write JSON release evidence.
+- Added a first-PR contributor path with docs-only, fixture-only, emitter-test,
+  and CLI bug fast lanes plus maintainer starter-issue checks.
+- Added a security-tooling posture topic that records Wesley's current scanner
+  baseline, rejects DAST for the current compiler-only surface, and gates future
+  Semgrep or `cargo-deny` adoption on low-noise repo-owned policies.
+
 ### Fixed
 
+- Rejected duplicate non-repeatable custom directives during SDL lowering,
+  including duplicates split across type definitions and extensions, while
+  preserving ordered arrays for directives declared `repeatable`.
 - Escaped law-backed Rust validator error messages before emission so hostile
   case values containing quotes, backslashes, or control characters cannot break
   generated Rust source.

CONTRIBUTING.md

@@ -9,7 +9,11 @@ Wesley's. METHOD defines how work is queued, pulled, proved, and closed.
 
 ## Start Here
 
-Read these surfaces in order:
+For a first small PR, start with
+[First PR](docs/topics/contributing/first-pr.md). It gives the shortest path
+from a scoped GitHub issue to a local validation command and PR body.
+
+For broader orientation, read these surfaces in order:
 
 - [README.md](README.md) for doctrine and repo shape
 - [docs/BEARING.md](docs/BEARING.md) for current direction and tensions
@@ -63,14 +67,21 @@ done. The Chronicle files in the repo root are historical archive only.
 New contributors should start from scoped GitHub Issues, not from repo-local
 backlog files:
 
+- [First PR path](docs/topics/contributing/first-pr.md)
 - [Good first issues](https://github.com/flyingrobots/wesley/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22)
 - [Near-term roadmap issue](https://github.com/flyingrobots/wesley/issues/646)
 - [Wesley Roadmap Project](https://github.com/users/flyingrobots/projects/18)
 
-Starter issues must already have a goalpost milestone and one scheduling-state
-label such as `v0.3.0`. If an issue still has a `triage:*` label, it is not a
+Starter issues must have one scheduling-state label such as `v0.3.0`, one
+`Goalpost: ...` milestone, one primary file or tiny file set, and one local
+validation command. If an issue still has a `triage:*` label, it is not a
 starter task until a maintainer schedules, splits, moves, or closes it.
 
+The normal first-contribution lanes are docs-only PRs, fixture-only PRs,
+emitter-test PRs, and CLI bug PRs. Advanced architecture, assurance, and
+release docs are background for these lanes, not required reading unless the
+issue says otherwise.
+
 ## Design Requirements
 
 Every non-trivial cycle packet under `docs/design/<cycle>/` must name:

README.md

@@ -95,6 +95,12 @@ The retained pnpm workspace supports docs, Holmes assurance tooling, and
 workspace checks. Use Node `>=22.12.0` with pnpm `9.15.9` when working from
 this checkout.
 
+For assurance status, use the
+[Assurance Capability Matrix](./docs/reference/assurance-capability-matrix.md).
+Wesley emits deterministic evidence inputs and ships experimental assurance
+tooling around them; a capability is shipped only when the matrix lists an
+executable command or workflow.
+
 ## What Wesley Owns
 
 Wesley owns domain-free compiler facts:
@@ -106,7 +112,8 @@ Wesley owns domain-free compiler facts:
 - Rust and TypeScript model and operation bindings
 - TypeScript and Rust LE-binary codec projections
 - `weslaw/v1` authoring, hashing, diffing, rebinding, and coverage metadata
-- release and assurance checks around those generic compiler contracts
+- deterministic evidence inputs and release checks around those generic
+  compiler contracts
 
 Wesley preserves directives as inspectable structure. It does not decide what
 those directives mean for a database, runtime, product, graph rewrite system,

SECURITY.md

@@ -74,6 +74,9 @@ artifacts through generic emitters and external modules.
 
 - Keep dependency updates reviewable and run repository preflight before
   release.
+- Scope security scanners to Wesley's compiler and tooling surface. The current
+  baseline and candidate-gate decisions live in
+  [`docs/topics/security-tooling.md`](docs/topics/security-tooling.md).
 - Prefer deterministic inputs, injected clocks, and explicit host permissions
   for portable capability work.
 - Do not grant portable modules ambient filesystem, network, process, or clock
@@ -94,5 +97,6 @@ artifacts through generic emitters and external modules.
 - Domain-empty compiler boundary that keeps target security policy out of core
 - Hash-linked evidence and artifact review surfaces
 - Dependency and documentation preflight checks
+- Documented scanner-fit posture for advisory and static-analysis gates
 - Explicit external-module responsibility for database, runtime, and product
   security behavior