devrites 4.0.0 → 4.0.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [4.0.2](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.1...v4.0.2) (2026-08-05)
+
+### Fixed
+
+* **deps:** resolve blocking npm audit advisories ([5181daa](https://github.com/ViktorsBaikers/DevRites/commit/5181daa5e93e6edc4a862caa7db5bc11b40c978c))
+* **installer:** remove deprecated tar type check ([1ed3e0d](https://github.com/ViktorsBaikers/DevRites/commit/1ed3e0d600fc48ae020e958ea06d6cb945031994))
+* **installer:** restore self-contained engine updates ([3d851c6](https://github.com/ViktorsBaikers/DevRites/commit/3d851c67e4d740d793695e1f7caa30fddc8d832b))
+* **tests:** avoid flaky unknown-command pipe ([da584aa](https://github.com/ViktorsBaikers/DevRites/commit/da584aaf0d4195ed57ef6d1b21789f00ac81e390))
+
+## [4.0.1](https://github.com/ViktorsBaikers/DevRites/compare/v4.0.0...v4.0.1) (2026-08-03)
+
+### Fixed
+
+* **installer:** clean legacy Codex hooks during v4 updates ([4908945](https://github.com/ViktorsBaikers/DevRites/commit/49089453ade730a9fede6c9fade180457d8ce2f9))
+
 ## [4.0.0](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.28...v4.0.0) (2026-08-03)
 
 ### ⚠ BREAKING CHANGES

package/README.md

@@ -28,7 +28,7 @@ project-conventional push, tag, or PR action, and archive the workspace.
 Unattended runs may create local WIP checkpoint commits along the way, but they
 remain local unless Ship's disclosed plan includes an approved remote action.
 
-**Status:** [`v4.0.0`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.0): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v4.0.2`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v4.0.2): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 This is the latest published release; `main` may contain unreleased work.
 
@@ -105,8 +105,12 @@ Some work needs a different route:
   cursor form alone never triggers repair; it is not a lifecycle phase.
 - [`/rite`](pack/.claude/skills/rite/SKILL.md) shows the command menu.
 
-The npm or shell updater acquires a local install candidate and uses
-`devrites-engine update` to refresh the installed engine and pack offline.
+Run `devrites-engine update` from an installed project to acquire the latest
+stable release and update both the engine and pack. `npx devrites@latest update`
+and the verified release `install.sh` remain equivalent adapter routes. If an
+older engine instead reports `missing codex/hooks.json` or asks for
+`--source-dir`, use the npm or verified shell route once to cross to a release
+with the self-contained updater.
 `/rite-upgrade` is the separate native, preservation-first route for reconciling
 an unfinished workspace. It proves a current-contract defect before routing
 Clarify, Plan repair, Converge, Vet, Prove, Polish, Review, or Seal; it never
@@ -244,6 +248,10 @@ npx devrites@latest update
 npx devrites@latest update --check
 npx devrites@latest uninstall
 npx devrites@latest uninstall --keep-binary
+
+# The installed engine can update itself and the project pack directly
+devrites-engine update
+devrites-engine update --check
 ```
 
 Useful install flags:
@@ -331,11 +339,12 @@ path must report that version in a new process. The installer keeps a backup in
 the same directory until the second check passes. On failure, it restores the
 previous binary or removes a bad first install.
 
-The Go installer never downloads or selects a release. npm and the Bash
-bootstrap acquire the exact-release bundle and checksummed binary first,
-then invoke the engine with local paths. `update --check` compares the installed
-manifest version with that local candidate; release selectors belong to the
-acquisition layer, not the engine.
+Direct `devrites-engine update` resolves the latest stable release, acquires its
+bundle and platform binary, and hands local paths to the downloaded engine. The
+candidate engine therefore validates its own payload before replacing the
+installed pack and binary. npm and Bash may supply the same local candidate
+paths directly. `update --check` resolves and compares the latest version
+without downloading release assets.
 
 Network acquisition resolves an exact SemVer release, permits HTTPS at every
 redirect hop, requires an exact-filename SHA-256 sidecar, and uses private
@@ -407,11 +416,12 @@ configured engine, download the exact release binary with its mandatory checksum
 build a temporary engine from package-local Go source, or use `devrites-engine`
 on `PATH`. Remote fetches are HTTPS-only and bounded. Use
 `--no-binary` or `DEVRITES_NO_BINARY=1` to avoid keeping a shared binary outside
-the project. npm or the Bash bootstrap also acquires update candidates and
-checksums before invoking the offline engine operation. The engine itself is
-network-free, and install, update, and uninstall do not inspect target-project
-Git. Retained safety operations such as `secret-scan --staged` intentionally
-read the exact Git index and staged blobs they validate.
+the project. npm, Bash, and direct engine update all require checksummed release
+assets. Engine network access is isolated to bounded latest-release acquisition;
+the downloaded engine performs the local manifest-owned update. Install, update,
+and uninstall do not inspect target-project Git. Retained safety operations such
+as `secret-scan --staged` intentionally read the exact Git index and staged blobs
+they validate.
 
 Production Git subprocesses remove repository/config/object/ref/pathspec
 retargeting `GIT_*` variables while preserving unrelated Git environment. Seal

package/SECURITY.md

@@ -119,8 +119,8 @@ and `.codex/config.toml` without replacing unrelated user settings. The shared
 `devrites-engine` executable is the only allowed artifact outside the project.
 It is installed to `DEVRITES_BIN_DIR`, a writable `~/.local/bin`, or a writable
 `/usr/local/bin`; `--no-binary` / `DEVRITES_NO_BINARY=1` skips it. The bootstrap
-path may fetch the release bundle and checksummed engine assets. It never invokes
-`sudo` or edits shell startup files.
+and direct updater may fetch the release bundle and checksummed engine assets.
+They never invoke `sudo` or edit shell startup files.
 
 The documented Node-free boundary downloads the release-owned `install.sh` and
 its exact-name sidecar before execution; mutable default-branch scripts are not
@@ -133,14 +133,15 @@ exact-filename SHA-256 sidecar. Every redirect hop must remain HTTPS, private
 temporary-directory creation must succeed, and unchecked raw/source/default-
 branch fallbacks are absent. Representative in-stream ceilings are 1 MiB for
 release metadata, 4 KiB for a sidecar, and 64 MiB for an archive or binary, with
-at most five Node redirect hops. Archive preflight streams metadata first and
-paths second, permits at most 10,000 members, 4,096-byte paths, and 256 MiB of
-expanded regular files, and aborts the producer on the first breach before
-extraction. Failures retain only safe tag/asset and status, redirect, size,
-checksum, or preflight context, never response bodies. The adversarial contract is exercised by
+at most five Node or ten Go redirect hops. Archive handling rejects unsafe types
+and paths, permits at most 10,000 members and 256 MiB regular files across all
+routes, and applies stricter route-specific count, file, and expanded-byte caps
+where configured. Failures retain only safe tag/asset and status, redirect,
+size, checksum, or archive context, never response bodies. The adversarial
+contract is exercised by `engine/internal/release/release_test.go`,
 `tests/bootstrap-security-test.sh`, `tests/npx-pack-smoke.sh`, and
 `tests/release-tarball-test.sh`; [ADR-0026](docs/adr/0026-content-bound-proof-and-bounded-inputs.md)
-owns the rationale.
+and [ADR-0028](docs/adr/0028-self-contained-engine-update.md) own the rationale.
 
 ### npx install path
 

package/docs/adr/0024-native-policy-offline-installer-boundary.md

@@ -1,6 +1,6 @@
 # ADR-0024: Native policy and offline installer boundary
 
-- **Status:** Accepted
+- **Status:** Accepted in part; offline engine-update clause superseded by 0028
 - **Date:** 2026-08-01
 
 ## Context

package/docs/adr/0028-self-contained-engine-update.md

@@ -0,0 +1,66 @@
+# ADR-0028: Self-contained engine update
+
+- **Status:** Accepted
+- **Date:** 2026-08-03
+
+## Context
+
+ADR-0024 moved release acquisition out of the Go engine. That made update
+application deterministic, but it also changed the established public contract:
+running `devrites-engine update` inside an installed project no longer updated
+DevRites. It instead required undocumented knowledge of a separately acquired
+release source and generated payload.
+
+The split also left old engines responsible for validating new payloads before
+installing the new engine. A payload-schema change could therefore prevent the
+upgrade that would have installed the compatible validator.
+
+## Decision
+
+- `devrites-engine update` with no local-candidate flags resolves the latest
+  stable GitHub release, downloads its release bundle and platform engine, and
+  verifies both against mandatory exact-filename SHA-256 sidecars.
+- The downloaded engine performs the update from the extracted local source and
+  payload. The running old engine does not interpret the new payload first.
+- `--check` resolves and compares the latest version without downloading release
+  assets. An already-current update also avoids asset downloads unless `--force`
+  is explicit.
+- `--source-dir` plus `--payload-dir` remains the local update path used by npm,
+  shell adapters, source checkouts, and tests. A local `--check` needs only the
+  source version; applying the candidate requires both paths.
+- Release acquisition is isolated in `engine/internal/release`. It accepts exact
+  SemVer tags and repository names, bounds responses and extraction, permits
+  HTTPS redirects only, rejects unsafe archive entries, and has no raw,
+  default-branch, or unchecked source-archive fallback.
+- The engine remains model-free. Network imports are allowed only in the release
+  acquisition package; workspace policy, state, proof, and installation packages
+  remain network-free.
+- `--to` and `--pre` remain unsupported. The public command updates to the latest
+  stable release.
+
+This supersedes ADR-0024 only where it requires engine update to be offline and
+caller-supplied. ADR-0024's local install/uninstall behavior and other policy
+boundaries remain in force.
+
+## Alternatives considered
+
+| Option | Why not |
+|---|---|
+| Keep direct engine update local-only | Breaks the established v3 command contract and makes the normal command unusable without adapter internals. |
+| Download the bundle but apply it with the running engine | Repeats the cross-version payload-schema failure: the old validator can reject the release that contains its replacement. |
+| Shell out to npm or Bash | Adds a runtime dependency and weakens Windows portability when the engine can acquire the same verified release directly. |
+| Restore arbitrary tag and prerelease selectors | The requirement is latest-stable update; extra selection policy is unnecessary. |
+
+## Consequences
+
+Direct engine updates again work from an installed project. npm and shell remain
+supported acquisition adapters and continue using the local-candidate path.
+Release networking is duplicated across entrypoints, but the public binary no
+longer depends on another runtime, and the network boundary remains small and
+guarded. Major upgrades hand off before candidate validation, so the candidate's
+own engine owns its payload schema.
+
+Regression coverage lives in
+`engine/internal/install.TestUpdateAcquiresLatestReleaseAndHandsOff`,
+`engine/internal/release`, and
+`engine/tests.TestNetworkImportsStayInReleaseBoundary`.

package/docs/adr/README.md

@@ -69,7 +69,8 @@ architecture; per-feature `decisions.md` files stay scoped to that feature.
 | [0021](0021-observable-workspace-compatibility.md) | Observable and reversible workspace compatibility | Superseded by 0022 | historical |
 | [0022](0022-native-orchestration-thin-engine.md) | Native orchestration with a thin deterministic engine | Accepted in part; snapshot/JSON-output clauses superseded by 0023; retained policy-command/install clauses narrowed by 0024 | `engine/root_routing_test.go`, `engine/internal/gate/gate_test.go`, `engine/internal/lib/cursor_compat_test.go`, `tests/native-orchestration-contract-test.sh` |
 | [0023](0023-native-workspace-reads-line-output.md) | Native workspace reads and line-oriented engine output | Accepted in part; AFK/recovery/doctor retention superseded by 0024 | `engine/root_routing_test.go`, `engine/internal/gate/gate_test.go`, `tests/native-orchestration-contract-test.sh`, `tests/npx-pack-smoke.sh` |
-| [0024](0024-native-policy-offline-installer-boundary.md) | Native policy and offline installer boundary | Accepted | `tests/native-orchestration-contract-test.sh`, `tests/phase-gate-routing-test.sh`, `tests/install-smoke.sh`, `tests/host-artifacts-test.sh` |
+| [0024](0024-native-policy-offline-installer-boundary.md) | Native policy and offline installer boundary | Accepted in part; offline engine-update clause superseded by 0028 | `tests/native-orchestration-contract-test.sh`, `tests/phase-gate-routing-test.sh`, `tests/install-smoke.sh`, `tests/host-artifacts-test.sh` |
 | [0025](0025-evidence-gated-workspace-upgrades.md) | Evidence-gated semantic workspace upgrades | Accepted | `tests/phase-gate-routing-test.sh`, `tests/host-artifacts-test.sh` |
 | [0026](0026-content-bound-proof-and-bounded-inputs.md) | Content-bound proof and bounded inputs | Accepted | `engine/internal/lib/candidate_test.go`, `engine/internal/lib/evidencefresh_test.go`, `engine/internal/gate/gate_test.go`, `engine/root_routing_test.go`, `engine/tests/parity_githelpers_test.go`, `tests/native-orchestration-contract-test.sh`, `tests/phase-gate-routing-test.sh`, `tests/install-smoke.sh`, `tests/update-smoke.sh`, `tests/npx-pack-smoke.sh`, `tests/release-tarball-test.sh` |
 | [0027](0027-content-bound-build-readiness.md) | Content-bound build readiness | Accepted | `engine/tests/adr_0027_readiness_binding_test.go` |
+| [0028](0028-self-contained-engine-update.md) | Self-contained engine update | Accepted | `engine/internal/install/install_test.go`, `engine/internal/release/release_test.go`, `engine/tests/meta_test.go` |

package/docs/architecture.md

@@ -143,20 +143,24 @@ re-read, qid allocation, Clarify cursor transitions, AFK/recovery accounting,
 and read-only diagnostics. `devrites-lib` documents that boundary and links common
 references; it does not implement an orchestration protocol.
 
-### Why install policy is local and acquisition stays at the edge
+### Why update acquisition is isolated from local installation
 `engine/internal/install` validates the pre-generated host payload and implements
 install, update, and uninstall behavior: manifest writing and pruning,
 shared-file marker merging and removal, legacy Codex hook removal, dry-run
-output, binary lifecycle, rollback, and install-flag replay. These operations
-consume only caller-supplied local source, payload, and binary candidates; the
-engine does not select releases or perform network I/O. `update --check`
-compares the installed manifest version with that local candidate. Engine
-`--to` and `--pre` selectors do not exist.
+output, binary lifecycle, rollback, and install-flag replay. Those mutations
+consume only local source, payload, and binary candidates.
+
+Direct `devrites-engine update` uses the separate `engine/internal/release`
+boundary to resolve the latest stable release and acquire its checksummed bundle
+and platform engine. It then invokes the downloaded engine with local paths, so
+the candidate validates its own payload schema. `update --check` resolves only
+release metadata and downloads no assets. Engine `--to` and `--pre` selectors do
+not exist.
 The shell entrypoints
 (`install.sh`, `uninstall.sh`, `update.sh`) and npm entrypoint
-(`bin/devrites.mjs`) are acquisition adapters. They acquire and verify the
-exact-release bundle or binary, then pass local paths and user flags through to
-the deterministic engine operation. Network paths require exact SemVer,
+(`bin/devrites.mjs`) remain equivalent acquisition adapters. They acquire and
+verify the exact-release bundle or binary, then pass local paths and user flags
+through to the deterministic engine operation. All network paths require exact SemVer,
 HTTPS-only redirects, exact-filename SHA-256 sidecars, private temporary
 directories, bounded transfers, and full archive preflight. They provide no
 unchecked raw, source-archive, tag, or default-branch fallback.
@@ -406,9 +410,10 @@ contract.
 - **Scope**: clarify → seal (decide) → ship (read-only preflight → type-GO →
   commit → optional approved push/tag/PR by project convention) → close. The CI
   pipeline stays with the project.
-- **Install**: project-local, manifest-managed host artifacts; shell/npm owns
-  acquisition, the engine performs offline local mutation, and the optional
-  shared engine binary is the only allowed global artifact.
+- **Install**: project-local, manifest-managed host artifacts; direct update,
+  shell, or npm may acquire a verified release, local install application owns
+  mutation, and the optional shared engine binary is the only allowed global
+  artifact.
 
 Candidate identity and bounded-input rationale are recorded in
 [ADR-0026](adr/0026-content-bound-proof-and-bounded-inputs.md). The

package/docs/cli.md

@@ -34,6 +34,20 @@ migration command.
 `check candidate` is additive; no existing engine command or public `/rite-*`
 workflow was removed or renamed.
 
+## Updates
+
+Run `devrites-engine update` in an installed project to resolve the latest
+stable release and update the project pack plus shared engine binary. The
+command downloads the release bundle and platform engine, verifies both exact
+filenames against their SHA-256 sidecars, then hands the extracted candidate to
+the downloaded engine. This avoids asking an old engine to validate a newer
+payload schema.
+
+`devrites-engine update --check` resolves and compares release metadata without
+downloading assets. `--source-dir` and `--payload-dir` remain the advanced local
+update path for npm, shell, source-checkout, and test callers; a local `--check`
+needs only `--source-dir`.
+
 ## npm adapter
 
 The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` for
@@ -41,10 +55,15 @@ The `npx devrites` adapter accepts `add` as an alias for `install`, `upgrade` fo
 `devrites-engine` aliases; documentation and automation should prefer the
 canonical command names.
 
-Use `npx devrites update --check` to compare the installed manifest version with
-the exact release candidate selected by the adapter without changing the
-installation. Use `npx devrites uninstall --keep-binary` to remove managed host
-artifacts while retaining the shared `devrites-engine` binary.
+Use `npx devrites update --check` to perform the equivalent adapter-level
+comparison without changing the installation. Use
+`npx devrites uninstall --keep-binary` to remove managed host artifacts while
+retaining the shared `devrites-engine` binary.
+
+If an older direct engine reports `missing codex/hooks.json` or asks for
+`--source-dir`, run `npx devrites@latest update`, or use a checksum-verified
+release `install.sh` and run `bash ./install.sh update` once to install a release
+with the self-contained updater.
 
 ## Checks
 
@@ -121,14 +140,14 @@ selection exits `2`; a malformed/unsafe manifest or candidate mismatch prints
 `DEVRITES_WORKSPACE` may select one explicit contained workspace. Mutating
 commands refuse ambiguous, escaped, symlinked, or otherwise unsafe roots.
 
-Install, update, and uninstall remain manifest-owned operations and perform no
-network acquisition. Shell and npm entrypoints acquire the local candidate
-bundle and optional checksummed binary before invoking them. Remote acquisition
-uses exact SemVer, HTTPS-only redirect hops, mandatory exact-filename SHA-256
-sidecars, private temporary directories, and byte/archive bounds; it has no
-unchecked raw/source/default-branch fallback. Update
-accepts `--check` to compare the installed manifest version with that local
-candidate; remote-selector flags such as `--to` and `--pre` are unsupported.
+Install, update application, and uninstall remain manifest-owned local
+operations. Direct engine update, shell, and npm may acquire a release candidate;
+all remote acquisition uses exact SemVer, HTTPS-only redirect hops, mandatory
+exact-filename SHA-256 sidecars, private temporary directories, and byte/archive
+bounds, with no unchecked raw/source/default-branch fallback. Update accepts
+`--check` to compare the installed manifest version with the latest stable
+release without downloading assets. Remote-selector flags such as `--to` and
+`--pre` are unsupported.
 `/rite-upgrade` is a native compatibility audit, not an engine migration. Its
 read-only planner must cite a current rule and exact workspace defect; admitted
 repairs run through the current Clarify, Plan, Converge, Vet, Prove, Polish,

package/docs/command-map.md

@@ -43,7 +43,7 @@ The Go surface is intentionally closed and deterministic:
 | Candidate and deterministic checks | `check candidate`, `check readiness [--emit-binding]`, `check seal` | Candidate validates/hashes the strict project manifest; readiness checks phase files or emits the vetted Build-input binding; seal checks final files/open gates, that binding, then exact candidate bindings. |
 | Atomic workspace state | `state resolve`, `state close` | Go owns answer/drop/batch resolution and transactional close. |
 | Security | `secret-scan` | `/rite-ship`, safe hooks, or an operator scans staged blobs, stdin, or touched files. |
-| Install/operator | `install`, `update`, `uninstall`, `version` | npm/bootstrap or a human operator supplies local candidates; the engine performs deterministic local changes. |
+| Install/operator | `install`, `update`, `uninstall`, `version` | Direct update acquires latest; npm/bootstrap may supply local candidates; the engine performs manifest-owned local changes. |
 | Native policy | no engine command | Skills/root own spec grammar re-read, qid allocation, Clarify cursor edits, AFK/recovery accounting, and read-only `/rite-doctor`. |
 
 `devrites-engine help` exhaustively lists the operational engine commands.
@@ -67,9 +67,11 @@ replacement objects disabled. `--stdin` accepts text through process stdin.
 Scans cap captured input at 64 MiB and entries/findings at 4,096; findings expose
 metadata only and source or limit errors fail closed.
 
-The shell/npm updater acquires the exact-release pack/binary, then invokes
-the offline local `devrites-engine update`. Its `--check` compares installed and
-local candidate versions; engine release selectors are unsupported.
+Direct `devrites-engine update` acquires the latest exact-release pack and
+platform binary, then hands local paths to the downloaded engine. Shell/npm may
+perform the same acquisition before invoking the local path. `--check` compares
+the installed version with latest release metadata without downloading assets;
+engine release selectors are unsupported.
 `/rite-upgrade` separately audits an older active workspace. Only a cited
 current-contract defect may route a repair through its existing Clarify, Plan
 repair, Converge, Vet, Prove, Polish, Review, or Seal owner.

package/docs/engine/commands.md

@@ -53,18 +53,20 @@ explicit root-owned native procedures. The workflow owns reproduction,
 hypothesis ranking, tool selection, and routing. No replacement scripts or
 counter artifacts are introduced.
 
-## Offline install boundary
-
-The engine's install/update/uninstall operations accept an already-local source,
-pre-generated host payload, and optional staged binary. They never select a
-release or download a bundle/binary. Shell and npm entrypoints own acquisition
-and checksum verification, then invoke the local deterministic operation.
-`update --check` compares the installed manifest version with the supplied
-local candidate. `--to` and `--pre` are not supported engine flags.
-
-Remote acquisition is exact-SemVer, HTTPS-only at every redirect, bounded, and
-requires an exact-filename SHA-256 sidecar. Archive preflight completes before
-extraction and unchecked raw/source/default-branch fallbacks are absent.
+## Install and update boundary
+
+Install application and uninstall accept local source, pre-generated host
+payload, and optional staged binary inputs. Direct `devrites-engine update`
+selects the latest stable release, downloads its bundle and platform engine,
+then invokes that downloaded engine with local candidate paths. Shell and npm
+may instead acquire and pass the same local inputs. `update --check` compares
+installed and latest release metadata without downloading assets. `--to` and
+`--pre` are not supported engine flags.
+
+Remote acquisition is isolated to the release boundary, exact-SemVer,
+HTTPS-only at every redirect, bounded, and requires exact-filename SHA-256
+sidecars. Archive validation completes during bounded extraction and unchecked
+raw/source/default-branch fallbacks are absent.
 
 ## Secret scanning
 

package/docs/release.md

@@ -22,9 +22,9 @@ its payload. Package and release installs validate and copy
 source checkout whose generated payload is incomplete, the shim may regenerate
 the missing host payload before handing that local candidate to the engine. The
 engine itself only validates and copies host payloads; it never generates them.
-The npm entrypoint and the verified release installer acquire only an exact-SemVer
-release bundle or platform binary with its mandatory exact-filename SHA-256
-sidecar.
+The npm entrypoint, verified release installer, and direct engine updater acquire
+only an exact-SemVer release bundle or platform binary with its mandatory
+exact-filename SHA-256 sidecar.
 Every redirect hop remains HTTPS; downloads use private temporary directories
 and fixed in-stream byte ceilings. The bootstrap first streams archive metadata,
 then paths, aborting the producer on a type, count, expanded-size, containment,
@@ -33,10 +33,10 @@ or path breach before extraction (at most 10,000 members, 4,096-byte paths, and
 archives/binaries at 64 MiB, and the Node adapter follows at most five redirects.
 There is no raw, source-archive, tag, or default-branch acquisition fallback;
 exact-release guarantees begin at the checksummed release `install.sh` asset.
-The Go install/update/uninstall core receives only local
-candidates and performs no network I/O. Its update `--check` compares the
-installed manifest with that local candidate; `--to` and `--pre` release
-selection belongs outside the engine and is not accepted there.
+The Go release boundary may acquire the latest stable candidate; the downloaded
+engine then supplies local paths to the manifest-owned update core. Engine
+`update --check` resolves release metadata but downloads no assets. `--to` and
+`--pre` release selection is not accepted.
 
 `bash scripts/validate.sh` is the single repository-validation authority. It
 performs strict recursive pack JSON parsing and render-to-temporary parity for

package/engine/internal/hostpack/hostpack.go

@@ -93,6 +93,12 @@ var CodexConfigMerge = MarkerMerge{
 	MarkerText: ".codex/config.toml contains the DevRites read-only-root permission profile.",
 }
 
+var LegacyCodexHooksMerge = ManagedMerge{
+	MarkerRel: ".claude/devrites.codex-hooks-merge",
+	TargetRel: ".codex/hooks.json",
+	DryRun:    ".codex/hooks.json legacy DevRites hooks",
+}
+
 var managedMerges = []ManagedMerge{
 	{
 		MarkerRel: CodexAgentsMerge.MarkerRel,
@@ -113,6 +119,7 @@ var managedMerges = []ManagedMerge{
 		TargetRel: ClaudeSettingsMerge.TargetRel,
 		DryRun:    ".claude/settings.json DevRites permissions",
 	},
+	LegacyCodexHooksMerge,
 }
 
 func RequiredPayload(withCodex bool) []string {