@sebastienrousseau/dotfiles 0.2.512 → 0.2.513

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.513 — 2026-08-06
+
+- **Verified module registry installation.** `dot registry install` now validates the v1 index, verifies immutable archive SHA-256 digests, rejects traversal and link-bearing archives, previews with chezmoi by default, and applies only with explicit `--yes`. CI validates the published registry contract and JSON Schema.
+- **Native PowerShell daily workflow.** `dot.ps1` now handles core chezmoi operations, status, doctor, mise inventory, agent checks/listing, and local fleet status without bash. Windows CI exercises the cmdlets directly, and the parity matrix now distinguishes native behavior from bash bridges.
+- **Checksum-verified self-healing tools.** Nushell, Pueue, Wasmtime, SOPS, Yazi, and Zellij recovery now uses exact mise/aqua pins instead of mutable GitHub release URLs and unverified executable downloads.
+- **Reproducible toolchain lock.** The development toolchain now ships a cross-platform `mise.lock` covering Linux, macOS, and Windows with exact download URLs and available SHA-256 checksums. Font archives, distro signing keys, and binary archives now fail closed on integrity or unsafe archive structure.
+
+### Security
+
+- Enforce signed commits, linear history, required merge/reliability/DCO/PR
+  signature checks, conversation resolution, and up-to-date branches on
+  `main`.
+- Default GitHub Actions tokens to read-only, disable workflow PR approvals,
+  enable secret push protection, and pin the SLSA reusable workflow to its
+  immutable commit.
+- Verify every remotely executed installer against a committed SHA-256
+  allowlist. CI rejects direct download-to-shell execution and verifier
+  bypasses.
+
+### Fixed
+
+- Make CLI snapshots hermetic across hosts by normalizing platform facts,
+  installed-tool paths, versions, health counts, and timing measurements.
+- Keep `dot health` best-effort when an interactive zsh startup probe fails or
+  omits timing output, so macOS diagnostics still reach the health summary.
+- Measure both unit and mandatory regression tests in Bash coverage, retain
+  function-probe xtrace, and cache source normalization. Measured line
+  coverage rises to 59.32%, the enforced floor rises to 58%, and aggregation
+  now completes in seconds instead of minutes.
+- Run the reliability audit's integration phase without repeating the full
+  unit and regression suites.
+- Keep `master` as a verified, fast-forward-only compatibility mirror of
+  `main` for historical raw-content install URLs.
+- Package a self-contained `dot` distribution including command modules,
+  operational scripts, policies, schemas, help data, and the verified-download
+  manifest. Previously published archives omitted the command modules required
+  by most subcommands.
+- Add `make install PREFIX=... DESTDIR=...` and `make uninstall` using the
+  same tested staging path as release archives. Published releases now run a
+  provenance-verified clean-install smoke test on Linux and macOS.
+- Store CLI benchmark baselines under `XDG_CACHE_HOME` instead of requiring a
+  writable source checkout.
+- Make focused help work for `apply`, `agents`, and `registry`.
+- Make an explicit version-sync target update `package.json` atomically and
+  distinguish historical roadmap versions from current-version references.
+- Correct documentation that conflated 100% executable-module mapping with
+  measured Bash line coverage.
+
 ## v0.2.512 — 2026-07-21
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.512-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.513-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.512/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.513/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.512) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.513) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.512 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.513 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/manual/01-concepts/02-trust-model.md

@@ -160,7 +160,8 @@ See [Fleet Architecture](04-fleet.md) for the full model.
 | Shellcheck zero-warnings | `ci.yml` | Yes |
 | Gitleaks scan | `ci.yml` | Yes |
 | Copyright headers | `ci-enforced.yml` | Yes |
-| 100% unit test coverage | `ci-enforced.yml` | Yes |
+| 100% executable module mapping | `ci-enforced.yml` | Yes |
+| Measured Bash line coverage | `coverage.yml` | Ratcheted floor; see `docs/operations/COVERAGE.md` |
 | Reliability (macOS + Linux) | `ci-enforced.yml` | Yes |
 | Checkov infrastructure scan | `ci-enforced.yml` | On severity MEDIUM+ |
 | SBOM (CycloneDX) | `ci.yml` | No (informational) |

package/docs/manual/03-reference/03-environment.md

@@ -75,7 +75,7 @@ Variables relevant in GitHub Actions.
 | `CI` | Set to `true` in CI; disables prompts |
 | `GITHUB_ACTIONS` | GHA-specific; enables step summary output |
 | `CHEZMOI_VERSION` | Pinned chezmoi version for CI |
-| `COVERAGE_THRESHOLD` | Test coverage threshold (100 in enforced CI) |
+| `COVERAGE_THRESHOLD` | Executable module-mapping threshold (100 in enforced CI; not line coverage) |
 | `DOTFILES_TEST_MODE` | Skip network-dependent tests |
 
 ## Secret-Related

package/docs/manual/04-cookbook/03-faq.md

@@ -25,7 +25,7 @@ Only via WSL2. Native Windows PowerShell support exists for baseline parity (ali
 
 ### Is it production-ready?
 
-Yes — it's the author's daily driver across multiple hosts and receives regular releases (see `CHANGELOG.md`). CI enforces 100% test coverage, zero-warning linting, WCAG AAA for themes, SBOM + CVE scanning, and signed commits on every merge.
+Yes — it's the author's daily driver across multiple hosts and receives regular releases (see `CHANGELOG.md`). CI enforces 100% executable-module mapping and a ratcheted measured Bash line-coverage floor, plus zero-warning linting, WCAG AAA for themes, SBOM + CVE scanning, and signed-commit verification. The current measured coverage and exclusions are documented in `docs/operations/COVERAGE.md`.
 
 ### Can I fork it and use it without attribution?
 

package/docs/manual/05-appendices/B-security-checklist.md

@@ -71,7 +71,8 @@ Every PR to main must pass:
 - [x] Detect-secrets baseline diff
 - [x] TruffleHog verified scan
 - [x] Copyright headers present
-- [x] 100% unit test coverage
+- [x] 100% executable module mapping
+- [ ] 100% measured line and branch coverage (current ratchet is documented in `docs/operations/COVERAGE.md`)
 - [x] Reliability tests (macOS + Ubuntu)
 - [x] Checkov infra scan
 - [x] Version sync (bumped across all files)

package/docs/operations/COVERAGE.md

@@ -43,18 +43,18 @@ matches and emits standard `lcov.info` that Codecov ingests natively.
 
 | Surface | What runs |
 |---|---|
-| **PR + push to main** | `.github/workflows/coverage.yml` → `Coverage / kcov` job → uploads lcov.info to Codecov and fails the build below `MIN_COVERAGE_PCT` (currently `49`, ratcheted up after measured integer-floor gains). |
+| **PR + push to main** | `.github/workflows/coverage.yml` → `Coverage / kcov` job → uploads lcov.info to Codecov and fails the build below `MIN_COVERAGE_PCT` (currently `58`, ratcheted up after measured integer-floor gains). |
 | **Local dev** | `bash tools/ci/run-coverage.sh` — works on Linux + macOS (xtrace is a bash primitive, no platform tools needed). |
 | **macOS dev** | Supported. xtrace-based instrumentation runs on macOS bash 3.2+ and Homebrew bash 5.x, with a Perl alarm fallback when GNU `timeout`/`gtimeout` is unavailable. |
 
 ## The current floor
 
-`MIN_COVERAGE_PCT=49` in `.github/workflows/coverage.yml`. Slice 1
+`MIN_COVERAGE_PCT=58` in `.github/workflows/coverage.yml`. Slice 1
 of [#883](https://github.com/sebastienrousseau/dotfiles/issues/883)
 established the baseline at **~2.7% measured** (~613 of ~22 500 lines
 across 231 files). Successive slices raised it; the current measured
-value sits at **50.16%** (`6205/12371` lines, re-measured on the merged tree; gate floored at 49 for local<->CI drift + run variance) after the eighth core
-coverage-ratchet slice added `jwt` portability coverage and
+value sits at **59.32%** (`7523/12682` lines, measured on v0.2.513; gate floored at 58 for local<->CI drift + run variance). This release now traces both mandatory unit and regression suites, replays the function exerciser's captured xtrace, and caches source-path normalization so aggregation completes in seconds instead of minutes. It builds on the earlier parser correction for nested Bash execution prefixes and deterministic branch-driving tests for Scorecard snapshots, examples coverage, and `httpdebug`. It builds on the eighth core
+coverage-ratchet slice, which added `jwt` portability coverage and
 branch-driving function coverage for `apihealth`, `apiload`, and
 `apilatency`. This builds on the prior helper slice that drove
 `scripts/dot/commands/restore.sh` to 75.17%,
@@ -89,10 +89,9 @@ To tighten:
 
 ### Why not the 95% target from #883
 
-The roadmap originally targeted ≥95% measured. After working through
-all six slices, the achievable ceiling with xtrace-only instrumentation
-is closer to **~50%** on this codebase. The remaining gap is structural,
-not aspirational:
+The roadmap originally targeted ≥95% measured. The current xtrace-only
+measurement is **59.32%** on this codebase. The remaining gap is largely
+structural:
 
 - **System-mutation surface** — large parts of the repo orchestrate
   real OS state (`chezmoi apply`, `gpg`, `pass`/`age` keystores,

package/docs/operations/REGISTRY.md

@@ -20,7 +20,9 @@ This page documents the JSON contract and the contribution flow. It is the §3 /
 dot registry list                   # list every published module
 dot registry search rust            # filter by keyword
 dot registry info rust-dev-setup    # full metadata for one module
-dot registry install rust-dev-setup # apply to this workstation (scaffold)
+dot registry install rust-dev-setup # verify and preview changes
+dot registry install rust-dev-setup --yes # verify, persist, and apply
+dot registry installed              # list locally installed modules
 dot registry url                    # show active registry URL
 dot registry set-url <url>          # point at a different registry
 ```
@@ -44,44 +46,43 @@ A registry index is a single JSON document:
       "version": "1.2.0",
       "tags": ["rust", "language", "dev"],
       "maintainer": "alice@example.com",
-      "sha256": "f9a2c1b…",
+      "archive_url": "https://example.com/rust-dev-setup-1.2.0.tar.gz",
+      "sha256": "f9a2c1b0a8d27c41b99c8c93641a0d476a0e54b23161847c47c780025ac7c4a1",
       "license": "MIT"
     }
   ]
 }
 ```
 
-Required keys: `name` (kebab-case, ≤ 32 chars), `description` (≤ 200 chars), `repo` (HTTPS clone URL), `version` (semver).
+Required keys: `name` (kebab-case, no more than 32 characters), `description` (no more than 200 characters), `version` (semver), `archive_url` (immutable HTTPS archive), and `sha256` (64 lowercase hexadecimal characters).
 
-Recommended keys: `tags` (lower-case array), `maintainer`, `sha256` (pinned at publish time so installers can verify), `license` (SPDX identifier).
+Optional keys: `repo` (HTTPS project URL), `tags` (lower-case array), `maintainer`, and `license` (SPDX identifier). The machine-readable contract is [`docs/schema/dot-registry-v1.json`](../schema/dot-registry-v1.json).
 
 ## Contributing a module
 
-1. Build your module as a chezmoi-source-compatible directory at `https://github.com/<you>/<module>.git`. The contents are overlaid onto the consumer's chezmoi source dir during install.
+1. Build a gzip-compressed tar archive containing a chezmoi-source-compatible directory. Publish it at an immutable HTTPS URL, such as a versioned GitHub release asset.
 2. Open a PR against `sebastienrousseau/dotfiles` adding one entry to `docs/registry.json` (alphabetical by `name`).
 3. The PR runs CI checks for:
-   - Schema validity (`jq` against the JSON contract).
-   - `repo` URL resolves and is a public git repo.
-   - `sha256` matches the latest tag at `repo`.
+   - Runtime contract validity and unique, sorted module names.
+   - Valid JSON for both the index and its published JSON Schema.
+   - A pinned SHA-256 digest for every archive.
 4. Once merged, the GitHub Pages workflow re-deploys the registry; `dot registry list` picks it up within 6 hours (or immediately if the consumer purges the cache).
 
-## Install pipeline (scaffold today, full in Phase 2)
+## Install pipeline
 
-`dot registry install <name>` currently prints what *would* happen. The full pipeline lands as follows:
+`dot registry install <name>` is preview-first and does not mutate the workstation. Pass `--yes` only after reviewing the chezmoi dry-run. The installer:
 
 1. Resolve the module entry from the registry index.
-2. Clone the module to `$XDG_DATA_HOME/dotfiles/modules/<name>/<version>`.
-3. Verify the clone's HEAD matches `sha256` from the registry.
-4. Source the module's `module.toml` (if present) for declared profiles + feature flags.
-5. Merge the module's chezmoi source into the consumer's chezmoi source dir under a namespaced subtree (`/registry/<name>/...`).
-6. Run `chezmoi apply --include /registry/<name>/**` so only the module's files are written.
-
-The sandboxed apply (point 6) requires changes to `dot sync` to accept an include filter — that is its own roadmap issue and tracked separately.
+2. Download the versioned archive using HTTPS and TLS 1.2 or newer.
+3. Verify the archive against the registry's SHA-256 digest.
+4. Reject absolute paths, parent traversal, symbolic links, and hard links before extraction.
+5. Run `chezmoi apply --dry-run` against the isolated module source.
+6. With `--yes`, persist it at `${XDG_DATA_HOME:-~/.local/share}/dotfiles/modules/<name>/<version>` and apply that exact verified source.
 
 ## Security model
 
-- Modules execute with the consumer's user privileges via chezmoi `run_onchange_*` scripts. The trust contract is identical to consuming any third-party dotfiles repo.
-- Pinning `sha256` lets a consumer verify the registry entry hasn't been tampered with between publish and install.
+- Modules execute with the consumer's user privileges via chezmoi scripts. Review the default dry-run and publisher before passing `--yes`.
+- The SHA-256 pin binds installation to the reviewed archive bytes, even if the hosting release later changes.
 - The registry index itself is fetched over HTTPS; the GitHub Pages cert chain provides transport integrity.
 
 ## Why this lives in this repo (for now)

package/docs/reference/POWERSHELL_PARITY.md

@@ -12,9 +12,9 @@ This document tracks what is supported on Windows-native PowerShell 7.4 LTS / 7.
 
 | Tier | Meaning | Examples |
 |---|---|---|
-| **Full** | Native PowerShell path; tested in CI on `windows-latest`. | `dot version`, `dot help`, `dot agents check` (via WSL-bash fallback). |
+| **Full** | Native PowerShell path; tested in CI on `windows-latest`. | `dot version`, `dot help`, `dot agents check`. |
 | **WSL-bridged** | Runs under WSL2 bash with the same UX as Linux. | All `dot` subcommands, the test suite, the cold-start bench. |
-| **Stub** | The command exists as a PowerShell entry-point but delegates to bash. | `dot init`, `dot fleet apply` (require chezmoi/ssh; both Windows-installable). |
+| **Bash-bridged** | The PowerShell dispatcher delegates to Git Bash or WSL bash and fails clearly when bash is unavailable. | `dot registry`, `dot fleet apply`, Unix-specific diagnostics. |
 | **N/A** | The command targets a Unix-only surface and is not exposed on PowerShell. | Wallpaper-driven theming via macOS `defaults`; Linux-only `lock-configs.sh`. |
 
 ## Command-by-command matrix
@@ -22,26 +22,24 @@ This document tracks what is supported on Windows-native PowerShell 7.4 LTS / 7.
 | Command | Windows-native | WSL2 | macOS | Linux |
 |---|---|---|---|---|
 | `dot version` | **Full (native)** — `Get-DotVersion` cmdlet in `scripts/dot/powershell/Dot.psm1`; reads `.chezmoidata.toml` directly, no bash | Full | Full | Full |
-| `dot help` | **Full (native)** — `Invoke-DotHelp` cmdlet; `dot help <subcmd>` still bash-bridged | Full | Full | Full |
-| `dot doctor` | Full (subset of checks; some Unix-only checks return N/A) | Full | Full | Full |
-| `dot init <user>` | Full (requires `chezmoi` on PATH — install via `scoop install chezmoi`) | Full | Full | Full |
+| `dot help` | **Full (native)** — `Invoke-DotHelp`; detailed Unix command help remains bash-bridged | Full | Full | Full |
+| `dot status` | **Full (native)** — structured clean/drifted result from chezmoi | Full | Full | Full |
+| `dot diff` / `apply` / `sync` / `update` | **Full (native)** — direct, exit-code-checked chezmoi operations | Full | Full | Full |
+| `dot add` / `remove` / `init` / `cd` | **Full (native)** — direct chezmoi operations and source-path lookup | Full | Full | Full |
+| `dot doctor` | **Full (native baseline)** — PowerShell, chezmoi, git, repo data, and module checks; Unix-only diagnostics are bash-bridged | Full | Full | Full |
 | `dot agents check` | **Full (native)** — `Test-DotAgentsSync` cmdlet; CI smoke test runs the cmdlet directly | Full | Full | Full |
-| `dot agents render` / `list` | Stub (bash-bridged — `render` is a multi-harness mustache-equivalent rewrite, tracked as a separate ticket) | Full | Full | Full |
-| `dot fleet status` / `drift` / `events` | Full | Full | Full | Full |
-| `dot fleet apply` | Stub (bash-bridged + requires Windows OpenSSH `ssh.exe` on PATH; no native pwsh-side test in CI yet — tracked in ROADMAP §C5 follow-up) | Full | Full | Full |
-| `dot fleet namespace set` | Full | Full | Full | Full |
-| `dot registry list` / `search` / `info` | Full | Full | Full | Full |
-| `dot registry install <name>` | Scaffold (no behavior yet on any platform) | Scaffold | Scaffold | Scaffold |
-| `dot agent` / `dot mode` | Full | Full | Full | Full |
-| `dot ai` / `dot ai-setup` / `dot ai-query` | Full | Full | Full | Full |
-| AI bridges (`cl`, `codex`, `copilot`, `gemini`, `goose`, etc.) | Full when the underlying AI CLI is installed (scoop / winget / native) | Full | Full | Full |
+| `dot agents list` | **Full (native)** — structured harness/path/rendered records | Full | Full | Full |
+| `dot agents render` | Bash-bridged | Full | Full | Full |
+| `dot env list` | **Full (native)** — mise text or JSON inventory | Full | Full | Full |
+| `dot env emit` | Bash-bridged | Full | Full | Full |
+| `dot fleet status` | **Full (native)** — node, version, OS, architecture, and drift | Full | Full | Full |
+| `dot fleet drift` / `events` / `apply` / `namespace` | Bash-bridged | Full | Full | Full |
+| `dot registry list` / `search` / `info` / `install` | Bash-bridged; Unix path is verified, checksum-pinned, and preview-first | Full | Full | Full |
+| `dot agent` / `mode` / AI commands | Bash-bridged | Full | Full | Full |
 | `dot lint` | WSL-bridged (shellcheck/shfmt are Unix-native) | Full | Full | Full |
-| `dot perf` | Full (uses pwsh `Measure-Command` on the PS path) | Full | Full | Full |
-| `dot health` | Full | Full | Full | Full |
-| `dot tools` | Full (uses winget/scoop on Windows; brew/apt elsewhere) | Full | Full | Full |
-| `dot theme` (wallpaper-driven) | Stub (Windows wallpaper API needs additional work) | Stub (X11 only — Wayland support pending) | Full | Full (X11 only) |
-| `dot wallpaper` | Stub | Stub | Full | Full |
-| `dot security firewall` | Full (Windows Defender Firewall via `Set-NetFirewallProfile`) | N/A | Full (pf) | Full (ufw/firewalld) |
+| `dot perf` / `health` / `tools` | Bash-bridged | Full | Full | Full |
+| `dot theme` / `wallpaper` | N/A on native Windows | Limited | Full | Full (desktop-dependent) |
+| `dot security firewall` | Bash-bridged; no native Defender mutation | N/A | Full (pf) | Full (ufw/firewalld) |
 | `dot security lock-configs` | N/A (Windows ACL model differs; tracked) | N/A | Full (`chflags uchg`) | Full (`chattr +i`) |
 | Shell startup integration | Full (`Microsoft.PowerShell_profile.ps1` ships) | Full (zsh, bash, fish) | Full (zsh, bash, fish, nu) | Full (zsh, bash, fish, nu) |
 
@@ -51,27 +49,30 @@ This document tracks what is supported on Windows-native PowerShell 7.4 LTS / 7.
 |---|---|
 | `dot version` exits 0 | windows-latest, ubuntu-latest, macos-latest, macos-14 |
 | `dot help` exits 0 | windows-latest, ubuntu-latest, macos-latest, macos-14 |
-| `dot agents check` exits 0 | windows-latest (via bash on PATH), ubuntu-latest, macos-latest, macos-14 |
+| `dot agents check` exits 0 | windows-latest (native), ubuntu-latest, macos-latest, macos-14 |
+| Native module import, agent-body sync, harness inventory, doctor baseline, and chezmoi diff | windows-latest |
+| Native dispatcher version, help, and agents check | windows-latest |
 | PowerShell ≥ 7.4 | windows-latest (smoke test at `tools/ci/windows-smoke-test.ps1`) |
 | PSScriptAnalyzer Error-level findings | windows-latest |
 | `chezmoi --version` exits 0 | windows-latest (via scoop), all Unix matrices |
 | `bash tools/ci/dot-cli-startup-bench.sh` median < 200ms | macos-latest |
 | `bash tools/ci/dot-cli-startup-bench.sh` median < 150ms | ubuntu-latest |
 
-## Known parity gaps (deferred to follow-up PRs)
+## Known parity gaps
 
 These are scoped in [`ROADMAP_2026 §C5`](../operations/ROADMAP_2026.md) but not in this PR's scope:
 
-1. **Native PowerShell `dot.ps1` dispatcher.** Today the Windows path either uses `bash dot` (when bash is on PATH via Git for Windows / WSL) or shells out via `pwsh -Command`. A truly idiomatic PowerShell dispatcher with native cmdlet semantics (verb-noun naming, `[CmdletBinding()]`, pipeline support) is a separate effort.
-2. **Wallpaper-driven theming on Windows.** Requires SystemParametersInfo W32 API or `Set-ItemProperty HKCU:\Control Panel\Desktop`. macOS-native today.
-3. **`dot security lock-configs` for Windows.** Needs an ACL/EFS-based equivalent of `chattr +i` / `chflags uchg`. Not in this PR's scope; documented here so it doesn't get re-discovered.
-4. **Native Windows installer signing.** The repo signs the bootstrap tarball via Cosign keyless; a SignTool-signed `install.ps1` for code-signing-enforced enterprises is a future enhancement.
+1. **Registry and fleet mutation.** Verified registry installation and multi-node fleet application still use the explicit bash bridge.
+2. **Wallpaper-driven theming.** Native Windows wallpaper extraction and application are not implemented.
+3. **Windows config locking.** There is no ACL/EFS equivalent of the Unix immutable-file operation.
+4. **Authenticode signing.** Release provenance covers the archive, but `install.ps1` and `dot.ps1` are not Authenticode-signed for enterprise execution policies.
 
 ## Source-of-truth files
 
 - `.github/workflows/ci.yml` — `test-windows` job (pwsh + scoop + chezmoi + smoke)
 - `tools/ci/windows-smoke-test.ps1` — the actual gate
-- `dot_config/powershell/Microsoft.PowerShell_profile.ps1` — the deployed PowerShell profile (if present)
+- `bin/dot.ps1` and `scripts/dot/powershell/Dot.psm1` — native dispatcher and cmdlets
+- `defaults/dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl` — deployed profile
 - `scripts/dot/lib/platform.sh` — the dot_path_to_unix/native bridge (H9 audit fix)
 
 ## Why this matters

package/docs/schema/dot-registry-v1.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sebastienrousseau.github.io/dotfiles/schema/dot-registry-v1.json",
+  "title": "Dot Module Registry v1",
+  "description": "Integrity-pinned index consumed by dot registry.",
+  "type": "object",
+  "required": ["version", "modules"],
+  "additionalProperties": false,
+  "properties": {
+    "version": { "const": 1 },
+    "updated": { "type": "string", "format": "date-time" },
+    "registry": { "type": "string", "minLength": 1 },
+    "modules": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "version", "description", "archive_url", "sha256"],
+        "additionalProperties": false,
+        "properties": {
+          "name": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,31}$" },
+          "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+([+-][0-9A-Za-z.-]+)?$" },
+          "description": { "type": "string", "maxLength": 200 },
+          "archive_url": { "type": "string", "pattern": "^https://" },
+          "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+          "repo": { "type": "string", "pattern": "^https://" },
+          "tags": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+          "maintainer": { "type": "string", "minLength": 1 },
+          "license": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}

package/docs/security/SCORECARD.md

@@ -35,7 +35,7 @@ Aggregate score **7.6 / 10** at 2026-05-17T08:11:51Z.
 | Token-Permissions | 10 | GitHub workflow tokens follow principle of least privilege |
 | Vulnerabilities | 10 | 0 existing vulnerabilities detected |
 
-*Refresh: `scripts/qa/scorecard-snapshot.sh` · CI check: `lint/scorecard-snapshot` (planned).*
+*Refresh: `scripts/qa/scorecard-snapshot.sh` · Monitoring: `.github/workflows/scorecard.yml`.*
 <!-- END scorecard-snapshot -->
 
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sebastienrousseau/dotfiles/badge)](https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles)

package/install.sh

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Universal Dotfiles Installer (Zero-Dependency)
-# Usage: bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
+# Usage: gh repo clone sebastienrousseau/dotfiles && cd dotfiles && ./install.sh
 # (or ./install.sh locally)
 
 # This installer uses bash features (set -o pipefail, arrays, [[ ]]). If it is
@@ -12,7 +12,7 @@
 # it parses in any shell before bash takes over.
 if [ -z "${BASH_VERSION:-}" ]; then
   echo "install.sh requires bash. Run:  bash install.sh" >&2
-  echo "  or:  bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)\"" >&2
+  echo "  clone: gh repo clone sebastienrousseau/dotfiles && cd dotfiles && ./install.sh" >&2
   exit 1
 fi
 
@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.512)
+  version       The version (tag or branch) to install (default: v0.2.513)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.512"
+  local version="v0.2.513"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.512)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.513)."
         fi
         version="$arg"
         version_set=1
@@ -158,8 +158,15 @@ main() {
       brew install gum >/dev/null 2>&1
     elif [[ "$target_os" == "debian" || "$target_os" == "wsl2" ]]; then
       sudo mkdir -p /etc/apt/keyrings
-      curl -fsSL https://repo.charm.sh/apt/gpg.key |
-        sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/charm.gpg
+      charm_key_tmp="$(mktemp -t charm-key.XXXXXX)"
+      if ! curl --proto '=https' --tlsv1.2 -fsSL \
+        -o "$charm_key_tmp" https://repo.charm.sh/apt/gpg.key; then
+        rm -f "$charm_key_tmp"
+        return 1
+      fi
+      sudo gpg --batch --yes --dearmor \
+        -o /etc/apt/keyrings/charm.gpg "$charm_key_tmp"
+      rm -f "$charm_key_tmp"
       # Pin the Charm GPG key fingerprint — a DNS attacker swapping
       # repo.charm.sh/apt/gpg.key for a forged key with the same uid
       # would otherwise pass the prior "any fid: present" check.
@@ -362,7 +369,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.512 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.513 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -371,7 +378,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.512 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.513 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi
@@ -443,14 +450,16 @@ main() {
     if [[ -d "$prov_dir" ]]; then
       local script
       # run_once_install_* (shells) first, then numbered run_onchange_* in order.
+      # The fixed globs contain no user-controlled filenames.
+      # shellcheck disable=SC2012
       while IFS= read -r script; do
         [[ -f "$script" ]] || continue
         echo "   → $(basename "$script")"
         if [[ "$script" == *.tmpl ]]; then
-          chezmoi execute-template <"$script" | bash ||
+          chezmoi execute-template <"$script" | DOTFILES_SOURCE_DIR="$SOURCE_DIR" bash ||
             echo "     (step exited non-zero — continuing)"
         else
-          bash "$script" || echo "     (step exited non-zero — continuing)"
+          DOTFILES_SOURCE_DIR="$SOURCE_DIR" bash "$script" || echo "     (step exited non-zero — continuing)"
         fi
       done < <(ls "$prov_dir"/run_once_install_* "$prov_dir"/run_onchange_* 2>/dev/null | sort)
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.512",
+  "version": "0.2.513",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/diagnostics/health.sh

@@ -386,7 +386,10 @@ check_performance() {
 
   if has_command zsh; then
     local startup_time
-    startup_time=$({ time zsh -i -c exit; } 2>&1 | grep real | awk '{print $2}' | sed 's/[ms]//g')
+    # Startup timing is diagnostic only. A user's interactive configuration
+    # may exit non-zero or omit a `real` row, which must not abort health under
+    # `set -euo pipefail` before the summary is printed.
+    startup_time=$({ time zsh -i -c exit; } 2>&1 | awk '/real/ { print $2; exit }' | sed 's/[ms]//g' || true)
     if [[ -n "$startup_time" ]]; then
       check "Shell startup time" "pass"
     else

package/scripts/dot/commands/ai.sh

@@ -90,6 +90,8 @@ _ai_refresh_status_cache() {
   # shellcheck disable=SC2016
   local _TO=""
   command -v timeout >/dev/null 2>&1 && _TO="timeout 8 "
+  # Variables expand inside the child Bash probe.
+  # shellcheck disable=SC2016
   local probe_script='
     payload="$1"; out_dir="$2"; to="$3"
     i="${payload%%|*}"; entry="${payload#*|}"
@@ -418,7 +420,7 @@ ${prompt}"
       fi
     elif [[ "$tool_bin" == "agy" ]]; then
       ui_warn "$tool" "not installed"
-      ui_info "Install" "curl -fsSL -o /tmp/agy-install.sh https://antigravity.google/cli/install.sh && bash /tmp/agy-install.sh"
+      ui_info "Install" "dot ai install agy (checksum verified)"
       exit 1
     elif [[ "$tool_bin" == "kimi" ]]; then
       ui_warn "$tool" "not installed"

package/scripts/dot/commands/fleet.sh

@@ -73,7 +73,7 @@ _fleet_emit_event() {
     endpoint="$(sed -n 's/^endpoint = "\(.*\)"/\1/p' "$data_file" | head -1)"
   fi
   if [[ -n "$endpoint" ]] && [[ "$endpoint" == https://* ]]; then
-    curl -fsSL -X POST -H "Content-Type: application/json" \
+    curl --proto '=https' --tlsv1.2 -fsSL -X POST -H "Content-Type: application/json" \
       -d "$payload" "$endpoint" >/dev/null 2>&1 || true
   fi
 }