@sebastienrousseau/dotfiles 0.2.520 → 0.2.521

package/CHANGELOG.md

@@ -4,6 +4,24 @@ This file documents all notable changes to this project.
 
 ## Unreleased
 
+## v0.2.521 — 2026-09-20
+
+### Changed
+
+- Began the production-hardening roadmap with an immutable release-identity
+  preflight, same-commit reusable workflows, and task-scoped GitHub
+  authentication instead of a globally inherited token.
+- Promoted the verified, release-pinned installation path and tightened the
+  npm bootstrap artifact contract.
+- Added pure theme plans plus serialized, journaled theme transactions with
+  pre-apply validation and automatic file/symlink rollback on required
+  failures.
+- Hardened AI CLI theme adapters with typed outcomes, malformed-config
+  preservation, compare-before-commit writes, and global/per-provider opt-outs.
+- Added an independently versioned palette audit covering truecolor, xterm-256,
+  focus/selection contrast, perceptual separation, and color-vision simulation
+  across all 228 themes; stabilized semantic status colors in both modes.
+
 ## v0.2.520 — 2026-09-13
 
 ### Added

package/LICENSE-APACHE

@@ -0,0 +1,190 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to the Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+Copyright 2026 Sebastien Rousseau
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sebastien Rousseau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -14,7 +14,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.520-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.521-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://www.npmjs.com/package/@sebastienrousseau/dotfiles"><img src="https://img.shields.io/npm/v/@sebastienrousseau/dotfiles?style=for-the-badge&logo=npm&logoColor=white&label=npm" alt="npm" /></a>
   <a href="https://doc.dotfiles.io/"><img src="https://img.shields.io/badge/Manual-doc.dotfiles.io-66c2a5?style=for-the-badge&labelColor=555555&logo=materialformkdocs&logoColor=white" alt="Manual" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
@@ -23,7 +23,6 @@
   <a href="https://www.bestpractices.dev/projects/12840"><img src="https://img.shields.io/cii/level/12840?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Best%20Practices" alt="OpenSSF Best Practices" /></a>
   <a href="#license"><img src="https://img.shields.io/badge/License-Apache--2.0%20OR%20MIT-green?style=for-the-badge&logo=opensourceinitiative&logoColor=white" alt="License: Apache-2.0 OR MIT" /></a>
   <a href="#requirements"><img src="https://img.shields.io/badge/toolchain-bash%205.0%20%C2%B7%20chezmoi%202.40-93450a?style=for-the-badge&logo=gnubash&logoColor=white" alt="Minimum toolchain: bash 5.0, chezmoi 2.40" /></a>
-  <a href="https://repology.org/project/dot-cli/versions"><img src="https://img.shields.io/repology/repositories/dot-cli?style=for-the-badge&label=Repology" alt="Repology" /></a>
 </p>
 
 ---
@@ -74,35 +73,29 @@
 
 ## Install
 
-### One-line installer
+### Verified release installer
 
-```bash
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
-```
-
-The script needs `git` and `curl`. It fetches a SHA256-verified
-`chezmoi` binary, clones this repository to `~/.dotfiles`, runs
-`chezmoi init --apply`, and puts `dot` on your `PATH`. It runs on
-macOS, Ubuntu, Debian, Arch, WSL2, and GitHub Codespaces, and it is
-idempotent: run it once or a hundred times, same machine state.
-
-### Verified installer (recommended for primary workstations)
-
-Pin to a release tag, download the installer, check its SHA256
-against the value published with the release, then run it. The
-per-release hash and how it is generated are documented in
+The default installation path is pinned to a release and fails before
+execution if the installer bytes do not match the reviewed SHA256. Never pipe
+the moving `main` branch directly into a shell. The per-release hash and its
+release process are documented in
 [`docs/security/INSTALL_VERIFICATION.md`](docs/security/INSTALL_VERIFICATION.md).
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.520/install.sh
-echo "3b5d1332fb07a1261da117e53f69acc0097c3d9bd676fc9f53a000257b72978e  /tmp/dotfiles-install.sh" \
-  | shasum -a 256 -c
+  https://github.com/sebastienrousseau/dotfiles/releases/download/v0.2.521/dotfiles-install-0.2.521.sh
+if command -v sha256sum >/dev/null 2>&1; then
+  echo "704e278f970d4aa53362204a89d044caefd64823b7d1cdf3a815c08cac971a89  /tmp/dotfiles-install.sh" | sha256sum -c -
+else
+  echo "704e278f970d4aa53362204a89d044caefd64823b7d1cdf3a815c08cac971a89  /tmp/dotfiles-install.sh" | shasum -a 256 -c -
+fi
 bash /tmp/dotfiles-install.sh
 ```
 
-The verified path also needs `shasum` or `sha256sum`. The one-line
-form above skips this check; use it for sandboxes and ephemeral CI.
+The script needs `git`, `curl`, and `sha256sum` or `shasum`. It downloads a
+checksum-verified `chezmoi` binary, clones the pinned release to
+`~/.dotfiles`, applies it, and puts `dot` on `PATH`. The installer is
+idempotent across macOS, Ubuntu, Debian, Arch, WSL2, and GitHub Codespaces.
 
 ### Pre-built release archive (`dot` CLI only)
 
@@ -113,10 +106,10 @@ directory. The archive
 carries SLSA build provenance (keyless, via Fulcio + Rekor):
 
 ```bash
-gh release download v0.2.520 --repo sebastienrousseau/dotfiles --pattern 'dot-*.tar.gz'
-gh attestation verify dot-0.2.520.tar.gz --repo sebastienrousseau/dotfiles
-tar -xzf dot-0.2.520.tar.gz
-make -C dot-0.2.520 install PREFIX=/usr/local
+gh release download v0.2.521 --repo sebastienrousseau/dotfiles --pattern 'dot-*.tar.gz'
+gh attestation verify dot-0.2.521.tar.gz --repo sebastienrousseau/dotfiles
+tar -xzf dot-0.2.521.tar.gz
+make -C dot-0.2.521 install PREFIX=/usr/local
 ```
 
 [`release-install-smoke.yml`](.github/workflows/release-install-smoke.yml)
@@ -177,8 +170,9 @@ air-gapped host; unpack it and run `./install.sh --force`.
 Silent install (no prompts):
 
 ```bash
+# After downloading and verifying /tmp/dotfiles-install.sh as shown above:
 DOTFILES_SILENT=1 DOTFILES_NONINTERACTIVE=1 \
-  bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
+  bash /tmp/dotfiles-install.sh --force
 ```
 
 Docker sandbox:
@@ -257,7 +251,8 @@ back.
 ## Quick Start
 
 ```bash
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
+# First download and verify /tmp/dotfiles-install.sh as shown in Install.
+bash /tmp/dotfiles-install.sh
 dot doctor            # audit tools, paths, portability, security
 dot learn             # interactive tour of shells, secrets, themes, performance
 dot theme rebuild     # generate themes from the wallpapers on this machine
@@ -307,10 +302,10 @@ every push.
 
 ```bash
 # The framework (everything, chezmoi-managed)
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/main/install.sh)"
+bash /tmp/dotfiles-install.sh  # after the verified download above
 
 # Only the dot CLI, from the attested release archive
-gh release download v0.2.520 --repo sebastienrousseau/dotfiles --pattern 'dot-*.tar.gz'
+gh release download v0.2.521 --repo sebastienrousseau/dotfiles --pattern 'dot-*.tar.gz'
 
 # The Go satellites are (re)built on apply by
 #   defaults/run_onchange_24-build-dot-ui.sh.tmpl
@@ -357,7 +352,7 @@ What the repository can show today:
 - **Bash line coverage floor 58%** measured by pure `xtrace`, no
   kcov, ratcheted up slice by slice with the history recorded in
   [`coverage.yml`](.github/workflows/coverage.yml).
-- **51 workflows**, every third-party action SHA-pinned, Harden
+- **53 workflows**, every third-party action SHA-pinned, Harden
   Runner in every one of them.
 
 The gaps, so nobody has to find them:
@@ -644,13 +639,24 @@ regenerated.
 
 ```bash
 dot theme              # interactive picker (paired themes only)
+dot theme set maui     # select a family and follow OS appearance
+dot theme plan maui --mode auto --json # inspect the pure transaction plan
 dot theme tahoe-dark   # switch directly
 dot theme toggle       # swap dark and light within the current family
+dot theme mode light   # pin a manual appearance
+dot theme mode auto    # resume following the OS appearance
 dot theme family       # cycle between theme families
-dot theme sync         # follow the OS dark/light setting
+dot theme sync         # enable auto mode and sync immediately
 dot theme rebuild      # regenerate from current wallpapers
 ```
 
+Maui is the default family. Its dynamic HEIC supplies both wallpaper
+appearances, while the resolved `maui-light` or `maui-dark` palette keeps
+terminals and applications aligned. On macOS, a LaunchAgent watches the
+system appearance preference and reruns the sync automatically. Runtime
+selection is machine-local in `~/.config/chezmoi/chezmoi.toml`, so using the
+picker does not modify the dotfiles checkout.
+
 On theme switch, every managed surface updates. Terminals: Ghostty,
 Alacritty, Kitty, WezTerm, Warp, iTerm2, tmux. Editors: Neovim and
 VS Code. The theme also sets GTK and icon themes, the macOS accent
@@ -861,7 +867,7 @@ design is
 
 ```toml
 # defaults/.chezmoidata.toml — repo-wide defaults, schema-checked in CI
-dotfiles_version = "0.2.520"
+dotfiles_version = "0.2.521"
 
 [features]
 alias_wrapper = false   # confirm destructive aliases
@@ -1126,7 +1132,7 @@ corpus lives beside the harnesses under
 | `release-install-smoke.yml` / `release-distribute-*.yml` | release | Clean-install smoke on Ubuntu + macOS; Homebrew, Scoop, AUR fan-out |
 | `npm-publish.yml` / `manual-publish.yml` / `pages.yml` | release, push | npm via OIDC trusted publishing; the manual in nine formats; the site |
 
-51 workflows in total; the cadence and the composite actions are
+53 workflows in total; the cadence and the composite actions are
 documented in
 [`docs/operations/CI_CADENCE.md`](docs/operations/CI_CADENCE.md) and
 [`docs/operations/CI_COMPOSITES.md`](docs/operations/CI_COMPOSITES.md).
@@ -1210,7 +1216,7 @@ architectural level, not behind opt-in flags. The full analysis is
   tag reference is the SLSA generator reusable workflow, which its
   maintainers require to be referenced by release tag
   ([`docs/security/CI_PINNING.md`](docs/security/CI_PINNING.md)).
-- **Harden Runner in all 51 workflows**, six jobs in egress-block
+- **Harden Runner in all 53 workflows**, six jobs in egress-block
   mode with an explicit endpoint list
   ([`docs/security/CI_EGRESS_ALLOWLIST.md`](docs/security/CI_EGRESS_ALLOWLIST.md)).
 - **Releases carry provenance:** SLSA L3 build attestation on the
@@ -1349,6 +1355,6 @@ See [CHANGELOG.md](CHANGELOG.md) for release history.
 ---
 
 **THE ARCHITECT** ᛫ [Sebastien Rousseau](https://sebastienrousseau.com)
-**THE ENGINE** ᛞ [EUXIS](https://euxis.co) ᛫ Enterprise Unified Execution Intelligence System
+**THE ENGINE** ᛞ [EUXIS](https://github.com/sebastienrousseau/euxis) ᛫ Enterprise Unified Execution Intelligence System
 
 <p align="right"><a href="#contents">Back to Top</a></p>

package/install.sh

@@ -71,7 +71,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.520)
+  version       The version (tag or branch) to install (default: v0.2.521)
 
 Options:
   --help        Show this help message
@@ -87,7 +87,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.520"
+  local version="v0.2.521"
   local version_set=0
   local minimal=0
   local provision="${DOTFILES_PROVISION:-0}"
@@ -117,7 +117,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.520)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.521)."
         fi
         version="$arg"
         version_set=1
@@ -196,6 +196,68 @@ main() {
     fi
   }
 
+  # Standalone checksum-verified chezmoi bootstrap. Keep this implementation
+  # in the entry point so a release-pinned install.sh remains self-contained;
+  # repository and npm installs may use the identical helper script below.
+  install_chezmoi_verified_embedded() {
+    local chezmoi_version="$1"
+    local destination="$2"
+    local os arch asset checksums_asset base_url temp_dir checksum_line
+
+    os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+    arch="$(uname -m)"
+    case "$os" in
+      linux | darwin) ;;
+      *)
+        echo "Unsupported OS for chezmoi bootstrap: $os" >&2
+        return 1
+        ;;
+    esac
+    case "$arch" in
+      x86_64 | amd64) arch="amd64" ;;
+      arm64 | aarch64) arch="arm64" ;;
+      *)
+        echo "Unsupported architecture for chezmoi bootstrap: $arch" >&2
+        return 1
+        ;;
+    esac
+
+    asset="chezmoi_${chezmoi_version}_${os}_${arch}.tar.gz"
+    checksums_asset="chezmoi_${chezmoi_version}_checksums.txt"
+    base_url="https://github.com/twpayne/chezmoi/releases/download/v${chezmoi_version}"
+    temp_dir="$(umask 077 && mktemp -d)"
+
+    if ! (
+      set -e
+      if ! curl --proto '=https' --tlsv1.2 -fsSL \
+        -o "$temp_dir/checksums.txt" "$base_url/$checksums_asset"; then
+        curl --proto '=https' --tlsv1.2 -fsSL \
+          -o "$temp_dir/checksums.txt" "$base_url/checksums.txt"
+      fi
+      curl --proto '=https' --tlsv1.2 -fsSL \
+        -o "$temp_dir/$asset" "$base_url/$asset"
+      checksum_line="$(grep -E "[[:space:]]${asset}$" "$temp_dir/checksums.txt" | head -n 1 || true)"
+      [[ -n "$checksum_line" ]] || {
+        echo "Checksum entry not found for $asset" >&2
+        exit 1
+      }
+      cd "$temp_dir"
+      if command -v sha256sum >/dev/null 2>&1; then
+        printf '%s\n' "$checksum_line" | sha256sum -c -
+      else
+        printf '%s\n' "$checksum_line" | shasum -a 256 -c -
+      fi
+      tar -xzf "$asset" chezmoi
+      mkdir -p "$destination"
+      install -m 755 chezmoi "$destination/chezmoi"
+    ); then
+      rm -rf "$temp_dir"
+      return 1
+    fi
+
+    rm -rf "$temp_dir"
+  }
+
   # 3. Install Chezmoi (in parallel with other checks where possible)
   install_chezmoi() {
     if command -v chezmoi >/dev/null; then
@@ -231,11 +293,15 @@ main() {
         fi
         return 0
       fi
-      echo "" >&2
-      echo "   tools/ci/install-chezmoi-verified.sh is missing; cannot verify chezmoi bootstrap." >&2
-      echo "   Install chezmoi manually (brew install chezmoi / official binary)" >&2
-      echo "   and re-run install.sh." >&2
-      return 1
+      echo "   Using embedded checksum verifier..."
+      if ! install_chezmoi_verified_embedded "${CHEZMOI_VERSION:-2.47.1}" "$bin_dir"; then
+        echo "" >&2
+        echo "   The embedded checksum-verified chezmoi bootstrap failed." >&2
+        echo "   Refusing to fall back to an unverified remote script." >&2
+        echo "   Install chezmoi manually from https://www.chezmoi.io/install/" >&2
+        return 1
+      fi
+      return 0
     fi
   }
 
@@ -369,7 +435,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.520 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.521 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -378,7 +444,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.520 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.521 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.520",
+  "version": "0.2.521",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {
     "dotfiles-install": "./install.sh"
   },
   "scripts": {
+    "prepack": "node scripts/qa/verify-npm-package.mjs",
     "test": "bash ./scripts/qa/reliability-audit.sh",
     "test:quick": "bash ./scripts/qa/reliability-audit.sh --quick",
     "test:unit": "bash ./scripts/qa/reliability-audit.sh --unit-only",
@@ -66,13 +67,12 @@
   },
   "files": [
     "install.sh",
+    "tools/ci/install-chezmoi-verified.sh",
+    "tools/README.md",
     "README.md",
-    "LICENSE",
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
     "CHANGELOG.md",
-    "docs/",
-    "dot_config/",
-    "dot_local/",
-    "scripts/",
-    "templates/"
+    "package.json"
   ]
 }

package/tools/README.md

@@ -0,0 +1,49 @@
+# `tools/` — Repo-Only Operations
+
+Everything in this directory is **internal to the repo** — CI helpers,
+release tooling, documentation generators, maintenance jobs. Nothing
+here ships to end users; the `dot` CLI doesn't dispatch to anything
+under `tools/`.
+
+Per the v0.2.503 reorg (`docs/operations/RFC_v0_2_503_reorganization.md`
+Phase 5), this directory holds what used to live under
+`scripts/{ci,release,maintenance,docs}/`. The split clarifies which
+scripts a downstream distro packager needs to ship (`scripts/` +
+`lib/` + `bin/`) versus which only run in this repo's own CI
+(`tools/`).
+
+## Subtree map
+
+| Path | Purpose | Touched by |
+|---|---|---|
+| `tools/ci/` | CI-only helpers. `dot-cli-startup-bench.sh`, `install-chezmoi-verified.sh`, `windows-smoke-test.ps1`, `run-coverage.sh`, etc. | `.github/workflows/*` |
+| `tools/release/` | Release-time tasks. | Release workflow + `gh release create` flow |
+| `tools/maintenance/` | Recurring upkeep: `check-updates.sh`, etc. | Cron, manual |
+| `tools/docs/` | Documentation-generation helpers: `generate-command-index.sh`, manual builds, screenshot capture. | `manual-publish.yml`, `dot manual`, doc-drift |
+
+## Why this directory exists
+
+The R4 audit (`docs/operations/HARD_AUDIT_2026.md` §8.3 P4) flagged
+the framework / repo-ops intermingling under `scripts/` as a
+contributor-onboarding cost. New contributors couldn't tell:
+
+> "Is `scripts/ci/install-chezmoi-verified.sh` part of the CLI, or
+> is it just a CI helper?"
+
+Splitting them physically answers the question without anyone
+having to grep. `scripts/` is now exclusively the runtime-invoked
+surface; `tools/` is exclusively repo-internal.
+
+## Conventions
+
+Same as `scripts/`:
+
+- Shell style: 2-space indent, `set -euo pipefail`, shellcheck-clean.
+- Format with `shfmt -i 2 -ci`.
+- Source `lib/dot/ui.sh` for output (no raw `printf`).
+
+## See also
+
+- `../docs/STRUCTURE.md` — top-level repo map.
+- `scripts/README.md` — the runtime-invoked sister tree.
+- `docs/operations/RFC_v0_2_503_reorganization.md` — Phase 5 spec.