@sebastienrousseau/dotfiles 0.2.502 → 0.2.504

package/scripts/dot/powershell/Dot.psm1

@@ -0,0 +1,199 @@
+# Dot — native PowerShell module for the dotfiles framework.
+#
+# This module provides native PowerShell cmdlets for the subset of
+# `dot` subcommands that don't require bash. Closes Stub rows in
+# docs/reference/POWERSHELL_PARITY.md.
+#
+# Loaded by bin/dot.ps1 dispatcher; cmdlets are also callable
+# directly:
+#   Import-Module ./scripts/dot/powershell/Dot.psm1
+#   Get-DotVersion
+#   Invoke-DotHelp
+#   Test-DotAgentsSync -Verbose
+#
+# Tested via scripts/ci/windows-smoke-test.ps1.
+
+#requires -Version 7.0
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+# Module-level constants -------------------------------------------------------
+
+$script:RepoRoot = if ($env:DOT_REPO_ROOT) {
+    $env:DOT_REPO_ROOT
+}
+else {
+    # When called from bin/dot.ps1 the dispatcher sets DOT_REPO_ROOT.
+    # When imported directly, infer it from this file's path:
+    #   scripts/dot/powershell/Dot.psm1  →  ../../..
+    (Resolve-Path (Join-Path $PSScriptRoot '..\..\..')).Path
+}
+
+# Post-Phase-4b (v0.2.503) .chezmoidata.toml ships under defaults/.
+# Probe defaults/ first; fall back to legacy root location for older
+# deployments that pre-date the .chezmoiroot activation.
+$script:DataFile = Join-Path $script:RepoRoot 'defaults/.chezmoidata.toml'
+if (-not (Test-Path $script:DataFile)) {
+    $script:DataFile = Join-Path $script:RepoRoot '.chezmoidata.toml'
+}
+
+# Helpers ---------------------------------------------------------------------
+
+function script:Get-DotfilesVersionFromData {
+    if (-not (Test-Path $script:DataFile)) {
+        throw "Cannot read $script:DataFile (set DOT_REPO_ROOT to override)"
+    }
+    $line = Get-Content $script:DataFile |
+        Where-Object { $_ -match '^dotfiles_version\s*=\s*"([^"]+)"' } |
+        Select-Object -First 1
+    if (-not $line) {
+        throw "dotfiles_version not found in $script:DataFile"
+    }
+    if ($line -notmatch '"([^"]+)"') {
+        throw "Could not parse dotfiles_version from line: $line"
+    }
+    return $Matches[1]
+}
+
+function script:Write-DotBanner {
+    param([string]$Section)
+    if ($env:NO_COLOR) {
+        Write-Host "Dot · $Section"
+        return
+    }
+    $esc = [char]27
+    Write-Host "$esc[1;38;5;212mDot · $Section$esc[0m"
+}
+
+# Public cmdlets --------------------------------------------------------------
+
+<#
+.SYNOPSIS
+    Print the dotfiles framework version.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot version`. Reads the
+    canonical version from .chezmoidata.toml (the single source of
+    truth) — does NOT shell out to bash.
+
+.EXAMPLE
+    Get-DotVersion
+    0.2.503
+
+.EXAMPLE
+    Get-DotVersion -AsObject | ConvertTo-Json
+    {
+      "Version": "0.2.503",
+      "Source": "...\\.chezmoidata.toml",
+      "Native": true
+    }
+#>
+function Get-DotVersion {
+    [CmdletBinding()]
+    param(
+        [switch]$AsObject
+    )
+    $version = Get-DotfilesVersionFromData
+    if ($AsObject) {
+        return [pscustomobject]@{
+            Version = $version
+            Source  = $script:DataFile
+            Native  = $true
+        }
+    }
+    return $version
+}
+
+<#
+.SYNOPSIS
+    Print the dot CLI help overview.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot help`. Reads command
+    metadata from CLAUDE.md / the dispatcher's help table; does
+    NOT shell out to bash.
+
+    The full Linux-style help (every subcommand grouped by category)
+    requires the bash dispatcher; this cmdlet shows the Windows-
+    native subset.
+#>
+function Invoke-DotHelp {
+    [CmdletBinding()]
+    param()
+    $version = Get-DotfilesVersionFromData
+    Write-DotBanner -Section 'Help'
+    Write-Host ''
+    Write-Host "  Version    v$version"
+    Write-Host "  Repo       https://github.com/sebastienrousseau/dotfiles"
+    Write-Host "  Docs       https://github.com/sebastienrousseau/dotfiles/blob/master/docs/manual/"
+    Write-Host ''
+    Write-Host 'Native PowerShell commands (no bash required):'
+    Write-Host ''
+    Write-Host '  Get-DotVersion              Print framework version'
+    Write-Host '  Invoke-DotHelp              This screen'
+    Write-Host '  Test-DotAgentsSync          Check AGENTS.md ↔ CLAUDE.md sync'
+    Write-Host ''
+    Write-Host 'Bash-bridged subcommands (require bash on PATH):'
+    Write-Host ''
+    Write-Host '  dot doctor                  Deep environment audit'
+    Write-Host '  dot env list                List installed mise tools'
+    Write-Host '  dot env emit                Emit v1 environment manifest'
+    Write-Host '  dot agents render           Re-render every AGENTS.md harness'
+    Write-Host '  dot fleet status            Single-node fleet status (Full on PowerShell)'
+    Write-Host ''
+    Write-Host 'See: dot help all (via bash) — full command index'
+}
+
+<#
+.SYNOPSIS
+    Verify that AGENTS.md is in sync with CLAUDE.md.
+
+.DESCRIPTION
+    Native PowerShell implementation of `dot agents check`. Both
+    files share a "Project Overview" paragraph that is the canonical
+    sync surface. If they diverge, AGENTS.md needs re-rendering
+    (run `dot agents render` via bash; native PowerShell render is
+    a separate ticket).
+
+.OUTPUTS
+    [bool] — $true when in sync, $false otherwise.
+
+.EXAMPLE
+    if (-not (Test-DotAgentsSync)) {
+      Write-Warning 'AGENTS.md is stale; run: bash dot_local/bin/executable_dot agents render'
+    }
+#>
+function Test-DotAgentsSync {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param()
+    $claude = Join-Path $script:RepoRoot 'CLAUDE.md'
+    $agents = Join-Path $script:RepoRoot 'AGENTS.md'
+    foreach ($f in @($claude, $agents)) {
+        if (-not (Test-Path $f)) {
+            Write-Error "missing: $f"
+            return $false
+        }
+    }
+    # Both files declare: "Chezmoi-managed dotfiles for macOS, Linux,
+    # WSL, and PowerShell 7.5+. Version `0.2.503`."
+    # That single line is the canonical sync surface — its content
+    # is generated from the same template by `dot agents render`.
+    $claudeLine = (Select-String -Path $claude -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
+        Select-Object -First 1).Line
+    $agentsLine = (Select-String -Path $agents -Pattern '^Chezmoi-managed dotfiles' -SimpleMatch:$false |
+        Select-Object -First 1).Line
+    if (-not $claudeLine -or -not $agentsLine) {
+        Write-Verbose "sync surface line not found — claude:[$claudeLine] agents:[$agentsLine]"
+        return $false
+    }
+    if ($claudeLine -ne $agentsLine) {
+        Write-Verbose "drift detected:`n  CLAUDE.md: $claudeLine`n  AGENTS.md: $agentsLine"
+        return $false
+    }
+    Write-Verbose 'AGENTS.md sync surface matches CLAUDE.md'
+    return $true
+}
+
+Export-ModuleMember -Function Get-DotVersion, Invoke-DotHelp, Test-DotAgentsSync

package/scripts/fonts/install-nerd-fonts.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 ui_header "Nerd Fonts"

package/scripts/git-hooks/pre-commit-audit.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # ANSI Colors
 RED='\033[0;31m'
@@ -33,7 +33,7 @@ echo -n "   🔍 Scanning for secrets... "
 # Exclude assignments to values containing common placeholder strings or within template expressions
 SENSITIVE_PATTERNS="(GITHUB_TOKEN|API_KEY|SECRET|password|private_key|AKIA[0-9A-Z]{16})[[:space:]]*[:=]"
 # Exclusions list for legitimate variable checks or documentation
-SECRET_EXCLUDES="test_|assertions.sh|.pre-commit|README|CHANGELOG|FEATURES.md|CONFIG_STRATEGY.md|docs/|install/lib/|.chezmoitemplates/|mcp-doctor.sh|\.github/workflows/"
+SECRET_EXCLUDES="test_|assertions.sh|.pre-commit|README|CHANGELOG|FEATURES.md|docs/|install/lib/|.chezmoitemplates/|mcp-doctor.sh|\.github/workflows/"
 # Also exclude .tmpl files from secret scanning as they contain many false positive markers
 if echo "$STAGED_FILES" | grep -v "\.tmpl" | xargs grep -EiE "$SENSITIVE_PATTERNS" /dev/null | grep -vE "$SECRET_EXCLUDES" | grep -viE "dummy|placeholder|example|test|sk-placeholder|\\{\\{" >/dev/null 2>&1; then
   printf '%b\\n' "${RED}FAILED${NC}"
@@ -140,6 +140,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.502 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.504 standards maintained."
   exit 0
 fi

package/scripts/git-hooks/pre-push

@@ -90,3 +90,16 @@ if [ "${DOTFILES_ALLOW_UNSKIPPED_PUSH:-}" = "1" ]; then
 fi
 
 bash "$repo_root/scripts/qa/reliability-audit.sh" --quick
+
+# Step 4 — version-string consistency. Catches the case where the
+# canonical version in .chezmoidata.toml advanced but a human-visible
+# surface (CLI banner, man page, README badge) wasn't bumped. The
+# script is cheap (~8 grep calls); failure tells the user exactly
+# which file drifted and offers --fix.
+bash "$repo_root/scripts/qa/check-version-consistency.sh" --quiet || {
+  echo "" >&2
+  echo "Pre-push blocked: version-string drift detected." >&2
+  echo "Run: scripts/qa/check-version-consistency.sh" >&2
+  echo "Then: scripts/qa/check-version-consistency.sh --fix    (optional auto-fix)" >&2
+  exit 1
+}

package/scripts/ops/ai-setup.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 
 ui_header "Universal AI Toolchain Setup"
 

package/scripts/ops/bundle.sh

@@ -5,13 +5,13 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/log.sh"
+source "$SCRIPT_DIR/../lib/dot/log.sh"
 export DOT_COMMAND="bundle"
 
 # Concurrency guard

package/scripts/ops/chaos.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 ui_init
 
 if [[ "${1:-}" != "--force" ]]; then

package/scripts/ops/chezmoi-apply.sh

@@ -3,17 +3,23 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="apply"
 
-# Temp file cleanup
+# Temp file cleanup. `set +u` guards the array expansion: on bash 3.2
+# (macOS) expanding an empty array under `set -u` is an "unbound
+# variable" error, which would fire on every clean `dot sync`.
 _TMPFILES=()
-cleanup() { rm -f "${_TMPFILES[@]}"; }
+cleanup() {
+  set +u
+  rm -f "${_TMPFILES[@]}" 2>/dev/null
+  set -u
+}
 trap cleanup EXIT
 
 # Help flag

package/scripts/ops/heal.sh

@@ -21,12 +21,12 @@ trap cleanup EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 DOT_COMMAND="heal"
 REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
 DOTFILES_SOURCE="$REPO_ROOT"

package/scripts/ops/post-apply-repair.sh

@@ -3,9 +3,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ZWC_CACHE_DIRS_DEFAULT=("$HOME/.config/shell" "$HOME/.config/zsh")
 

package/scripts/ops/prewarm.sh

@@ -6,9 +6,9 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/ui.sh"
+source "$SCRIPT_DIR/../lib/dot/ui.sh"
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/dot/lib/log.sh"
+source "$SCRIPT_DIR/../lib/dot/log.sh"
 export DOT_COMMAND="prewarm"
 
 # Prevent concurrent execution

package/scripts/ops/release.sh

@@ -10,12 +10,12 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="release"
 ui_init
 

package/scripts/ops/rollback.sh

@@ -14,12 +14,12 @@ trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
-# shellcheck source=../dot/lib/log.sh
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
+# shellcheck source=../../lib/dot/log.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/log.sh"
+source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="rollback"
 REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"
 # Resolve symlinks for consistent path handling

package/scripts/ops/setup.sh

@@ -6,9 +6,9 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../dot/lib/ui.sh
+# shellcheck source=../../lib/dot/ui.sh
 # shellcheck disable=SC1091
-source "$SCRIPT_DIR/../dot/lib/ui.sh"
+source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 
 ui_init
 

package/scripts/qa/check-version-consistency.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# Verify that every "live" version reference matches the canonical
+# version in .chezmoidata.toml. The intent is to catch drift between
+# the source-of-truth and the human-visible surfaces (CLI banner, man
+# page, badge URL, etc.) BEFORE it ships.
+#
+# Historical references (CHANGELOG entries, audit-doc closed-cycle
+# tables, roadmap docs that mention previous versions) are NOT
+# checked — they are intentionally pinned to the version they
+# describe.
+#
+# Usage:
+#   scripts/qa/check-version-consistency.sh           # verify
+#   scripts/qa/check-version-consistency.sh --fix     # auto-fix
+#   scripts/qa/check-version-consistency.sh --quiet   # rc-only
+#
+# Exit codes:
+#   0  every live reference matches
+#   1  drift detected (with diff printed unless --quiet)
+#   2  bad usage / missing canonical version
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+# ── Parse flags ─────────────────────────────────────────────────────────
+fix=0
+quiet=0
+for arg in "$@"; do
+  case "$arg" in
+    --fix) fix=1 ;;
+    --quiet | -q) quiet=1 ;;
+    -h | --help)
+      sed -n '2,21p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+_log() { ((quiet)) || printf '%s\n' "$*"; }
+_err() { printf 'check-version-consistency: %s\n' "$*" >&2; }
+
+# ── Canonical version ──────────────────────────────────────────────────
+canonical="$(grep -E '^dotfiles_version[[:space:]]*=' defaults/.chezmoidata.toml |
+  head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
+
+if [[ -z "$canonical" ]]; then
+  _err 'failed to read dotfiles_version from defaults/.chezmoidata.toml'
+  exit 2
+fi
+_log "canonical: $canonical (defaults/.chezmoidata.toml)"
+
+# ── Per-file expected-substring map ────────────────────────────────────
+# Each entry: PATH|MATCH_PATTERN|EXPECTED_STRING
+# MATCH_PATTERN is a fixed substring to grep for on the file to
+# locate the version-bearing line; we then verify it contains the
+# expected substring rendered with $canonical. version-sync.sh
+# already handles many files (it reads package.json as source);
+# this list captures the surfaces version-sync.sh historically
+# missed — bento.sh banner, man-page header, dispatcher header.
+specs=(
+  "package.json|\"version\"|\"version\": \"${canonical}\""
+  "bin/dot|^VERSION=|VERSION=\"${canonical}\""
+  "bin/dot|^# Dotfiles CLI Entry Point - v|# Dotfiles CLI Entry Point - v${canonical}"
+  "share/man/man1/dot.1|^.TH DOT 1|dotfiles v${canonical}"
+  "lib/dot/bento.sh|D O T F I L E S|[v${canonical}]"
+  "README.md|img.shields.io/badge/Version|Version-v${canonical}-blue"
+  "CLAUDE.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+  "AGENTS.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+)
+
+drift=0
+for spec in "${specs[@]}"; do
+  IFS='|' read -r path pattern expected <<<"$spec"
+  if [[ ! -f "$path" ]]; then
+    _err "MISSING: $path (declared in spec list)"
+    drift=$((drift + 1))
+    continue
+  fi
+  line="$(grep -E "$pattern" "$path" | head -1 || true)"
+  if [[ -z "$line" ]]; then
+    _err "PATTERN NOT FOUND: '$pattern' in $path"
+    drift=$((drift + 1))
+    continue
+  fi
+  if [[ "$line" != *"$expected"* ]]; then
+    _err "DRIFT in $path"
+    _err "  found:    $line"
+    _err "  expected: contains '$expected'"
+    drift=$((drift + 1))
+    if ((fix)); then
+      # Auto-fix: only safe when the file contains a previous v0.X.YYY
+      # we can sed-replace. Skip otherwise.
+      old="$(printf '%s' "$line" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+      if [[ -n "$old" ]] && [[ "$old" != "v${canonical}" ]]; then
+        sed -i.bak "s|${old}|v${canonical}|g" "$path" && rm -f "$path.bak"
+        _log "  fixed:  $path  ($old → v${canonical})"
+      fi
+    fi
+  fi
+done
+
+if ((drift > 0)); then
+  if ((fix)); then
+    _log ""
+    _log "Auto-fixed where safe. Re-run without --fix to verify."
+  else
+    _log ""
+    _log "Tip: rerun with --fix to auto-correct (only safe substitutions)."
+    _log "     For non-trivial drift, edit the file manually then re-run."
+  fi
+  exit 1
+fi
+
+_log "all $((${#specs[@]})) live version surfaces match $canonical"
+exit 0

package/scripts/qa/coverage-baseline.sh

@@ -43,7 +43,7 @@ integration_tests="$(find "$REPO_ROOT/tests/integration" -name 'test_*.sh' | wc
 total_tests="$(find "$REPO_ROOT/tests" -path '*/framework/*' -prune -o -name 'test_*.sh' -print | wc -l | tr -d ' ')"
 named_tests="$(rg -o '\btest_start\b' "$REPO_ROOT/tests/unit" "$REPO_ROOT/tests/integration" -g 'test_*.sh' | wc -l | tr -d ' ')"
 docs_files="$(find "$REPO_ROOT/docs" -type f \( -name '*.md' -o -name '*.md.tmpl' \) | wc -l | tr -d ' ')"
-shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/dot_local/bin" "$REPO_ROOT/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
+shell_surfaces="$(find "$REPO_ROOT/scripts" "$REPO_ROOT/defaults/dot_local/bin" "$REPO_ROOT/defaults/.chezmoitemplates/functions" -type f \( -name '*.sh' -o -name 'executable_*' \) | wc -l | tr -d ' ')"
 
 printf 'Coverage Baseline\n'
 printf 'Repository: %s\n' "$REPO_ROOT"

package/scripts/qa/docs-coverage.sh

@@ -5,12 +5,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-DOT_CLI="$REPO_ROOT/dot_local/bin/executable_dot"
+DOT_CLI="$REPO_ROOT/bin/dot"
 UTILS_DOC="$REPO_ROOT/docs/reference/UTILS.md"
 AI_DOC="$REPO_ROOT/docs/AI.md"
 SCRIPTS_DOC="$REPO_ROOT/docs/reference/SCRIPTS.md"
 ARCH_DOC="$REPO_ROOT/docs/architecture/ARCHITECTURE.md"
-FUNCTION_GROUPS_JSON="$REPO_ROOT/.chezmoitemplates/functions/groups.json"
+FUNCTION_GROUPS_JSON="$REPO_ROOT/defaults/.chezmoitemplates/functions/groups.json"
 MIN_DOCS_COVERAGE="${MIN_DOCS_COVERAGE:-100}"
 
 TOTAL_CHECKS=0

package/scripts/qa/powershell-contract.ps1

@@ -16,7 +16,7 @@ $ErrorActionPreference = 'Stop'
 $Failures = New-Object System.Collections.Generic.List[string]
 
 $RepoRoot = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
-$ProfileSrc = Join-Path $RepoRoot 'dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
+$ProfileSrc = Join-Path $RepoRoot 'defaults/dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
 
 if (-not (Test-Path $ProfileSrc)) {
     Write-Output "FAIL: profile source not found at $ProfileSrc"