docks-kit 0.9.0 → 0.10.1

package/AGENTS.md

@@ -4,24 +4,29 @@ Canonical instructions for coding agents working on this project. Compatible wit
 
 ## Repository purpose
 
-Portable configuration kit for AI coding agents. Per-tool Single Source of Truth (SoT) directories get deployed to each tool's user-config location via `./docks-kit sync` — clone once, sync to your home directory, get a consistent AI-assisted dev environment everywhere. The kit focuses on **token efficiency without sacrificing quality**: every setting and hook is tuned to minimize token consumption while preserving rigorous output. When adding or editing anything, ask: *does this change reduce tokens without weakening correctness?*
+Portable configuration kit for AI coding agents. Per-tool Single Source of Truth (SoT) directories get deployed to each tool's user-config location via `./docks-kit sync` — clone once and get a consistent AI-assisted dev environment across supported Linux and macOS hosts. The kit focuses on **token efficiency without sacrificing quality**: every setting and hook is tuned to minimize token consumption while preserving rigorous output. When adding or editing anything, ask: *does this change reduce tokens without weakening correctness?*
 
 Tool-specific instructions live alongside this file:
 - **`CLAUDE.md`** — Claude Code SoT (`SoT/.claude/`), env vars, hooks, plugins, RTK, status line, session management, permission mode, open concerns.
 - Codex uses this `AGENTS.md` file plus the Codex SoT under `SoT/.codex/`; no separate root `CODEX.md` is needed.
 
+
+docks-kit runtime, standalone binary, and Session Relay prebuilt support is
+exactly Linux x64/arm64 and macOS x64/arm64. Unsupported hosts fail before the
+launcher can fall back to Bun source.
+
 ## Repository layout (cross-cutting)
 
 | Path | Purpose |
 |------|---------|
-| `docks-kit` | CLI launcher: runs the platform binary in `cli/dist/` only when its `--version` matches `package.json`, otherwise Bun-from-source (auto-installs Bun + `node_modules`). No-Bun recovery is the standalone platform release binary |
+| `docks-kit` | CLI launcher: on supported hosts, runs the platform binary in `cli/dist/` only when its `--version` matches `package.json`, otherwise Bun-from-source (auto-installs Bun + `node_modules`). Unsupported hosts fail before source fallback. No-Bun recovery is the standalone platform release binary |
 | `cli/src/engine-native/` | EngineNative implementation for `sync`, `model`, `workflow`, and `toolchain`; idempotent, flag-gated for destructive reconciliation |
 | `cli/` | Effect-TS CLI + bundled docs topics |
 | `SoT/models.json` | Kit-verified model catalog plus the strict Docks workflow-role registry |
 | `SoT/toolchain.json` | Toolchain floors manifest (verified pins consumed by EngineNative) |
 | `SoT/.claude/bin/` | Dependency-free Bun runtime programs for Claude's statusline, SessionStart, and Notification |
 | `install.sh` | Global installer |
-| `.github/workflows/release-cli.yml` | `cli-v*` release binaries + npm publish |
+| `.github/workflows/release-cli.yml` | `cli-v*` release: four Linux/macOS x64/arm64 binaries, `SHA256SUMS`, and npm publish |
 | `README.md` | Front door |
 | `package.json` / `bun.lock` | npm package: `bin` = `cli/src/main.ts`; bundles `cli/` with the generated in-memory SoT payload |
 | `SoT/.agents/skills.txt` | Universal-skill manifest, intentionally empty by default. Adding an [agentskills.io](https://agentskills.io/specification) slug opts it into EngineNative's shared `~/.agents/skills/` bootstrap and Claude symlink. |
@@ -36,7 +41,7 @@ Codex SoT notes:
 - `SoT/.codex/rules/*.rules` deploys to `~/.codex/rules/` as kit-managed Codex command policy. This is Codex's equivalent of permission allow/prompt/block rules; user-learned approvals in `~/.codex/rules/default.rules` are preserved.
 - `SoT/.codex/plugins/marketplace.json` deploys to Codex's personal marketplace path at `~/.agents/plugins/marketplace.json`; when the `codex` CLI is available, sync reruns `codex plugin add <plugin@marketplace>` for enabled SoT plugins so stale cached installs are refreshed.
 - `docks-kit status` verifies Session Relay only through the supported `codex plugin list --json` inventory. `ready` means installed and enabled for a newly started Codex session; it is not evidence about an old process, lifecycle state, receive-path health, or worker quiescence. The global prompt SoTs carry the owner's standing authorization for Docks cross-company plan review, which never overrides host or platform denial.
-- Claude and Codex sync call `sessionRelayCli.ts ensureSessionRelayCli` immediately before their plugin passes. It installs the exact source-pinned precompiled command at `~/.local/bin/session-relay` for Linux/macOS x64/arm64 only, requires committed digest = same-release `SHA256SUMS` row = downloaded bytes, smoke-tests the staged version, and atomically replaces the stable path. `agents`-only sync never enters this boundary. The committed digests remain fixture-only until the four `session-relay--v0.12.0` production assets exist; do not publish them as release evidence.
+- Claude and Codex sync call `sessionRelayCli.ts ensureSessionRelayCli` immediately before their plugin passes. It installs the exact source-pinned precompiled command at `~/.local/bin/session-relay` for Linux/macOS x64/arm64 only, requires committed digest = same-release `SHA256SUMS` row = downloaded bytes, smoke-tests the staged version, and atomically replaces the stable path. `agents`-only sync never enters this boundary. The four pinned production digests correspond to the stable `session-relay--v0.12.0` assets and its `SHA256SUMS`.
 - Both global prompt SoTs carry one byte-identical compact `Docks-workflow-models:` record. Root `--model-orchestrator` / `--model-reviewer` / `--model-implementer` / review-bound flags update only that deployed record; `docks-kit models workflow` lists the closed selectors, and a flag-less sync restores defaults.
 - Codex workflow selectors use the closed `<tool>:<model>@<effort>[+fast]` routing grammar. Fast is intentionally absent from the global SoT: no suffix means Standard and keeps the backward-compatible schema-1 record; `+fast` emits a schema-2 candidate with `service_tier: "fast"`. Docks and Session Relay consumers must explicitly launch unsuffixed Codex roles with the default service tier so a user's global Fast preference cannot leak into workflows.
 - The `codex` CLI binary is upstream-owned, not kit-owned. The official standalone installer keeps package metadata under `$CODEX_HOME/packages/standalone` and places the `codex` symlink in `~/.local/bin` by default; sync only warns with a download-then-run installer command when the CLI is missing. Existing installs can self-update with `codex update`; npm and Homebrew remain upstream alternatives.

package/README.md

@@ -2,8 +2,8 @@
 
 Portable configuration kit for AI coding agents. Per-tool **Single Source of
 Truth (SoT)** directories are deployed to each tool's user-config location —
-clone once, sync everywhere, get a consistent AI-assisted dev environment on
-every machine. Tuned for **token efficiency without sacrificing quality**.
+clone once and get a consistent AI-assisted dev environment across supported
+Linux and macOS machines. Tuned for **token efficiency without sacrificing quality**.
 
 Supported tools: **Claude Code**, **Codex**, and any agent consuming
 [agentskills.io](https://agentskills.io) universal skills.
@@ -17,10 +17,12 @@ cd ~/projects/public
 ./docks-kit status          # doctor view: drift, toolchain, plugins, skills
 ```
 
-The `./docks-kit` launcher prefers a compiled binary (`cli/dist/`) only when
-its version matches the checkout, then runs from source via Bun — auto-installing
-Bun and dependencies when missing. Stale ignored build artifacts cannot mask
-newer checkout code.
+The `./docks-kit` launcher supports Linux x64/arm64 and macOS x64/arm64.
+On those hosts it prefers a compiled binary (`cli/dist/`) only when its version
+matches the checkout, then runs from source via Bun—auto-installing Bun and
+dependencies when missing. Unsupported hosts fail immediately and never fall
+back to Bun source. Stale ignored build artifacts cannot mask newer checkout
+code.
 
 Other install paths (global `bun add -g docks-kit`, curl installer) —
 see `./docks-kit docs install`.
@@ -32,7 +34,7 @@ The executable carries the generated sync payload; no checkout or adjacent
 `SoT/` directory is required.
 
 Prerequisites for source/global installs: Bun; Node/npm for npm-global tools.
-`jq` is optional doctor/test tooling. `curl` is used only at requested POSIX
+`jq` is optional doctor/test tooling. `curl` is used only at requested Linux/macOS
 RTK/Bun download boundaries, not as a global sync prerequisite.
 
 ## CLI
@@ -107,7 +109,8 @@ current valid values, while a later flag-less sync restores all defaults.
   Session Relay plugin reconciliation. Linux/macOS x64/arm64 assets must match
   both the committed digest and their release `SHA256SUMS`, then pass an exact
   staged version smoke before atomic replacement; failures preserve any prior
-  command. Production digests for `session-relay--v0.12.0` are still pending.
+  command. The four production digests are pinned for the stable
+  `session-relay--v0.12.0` assets and match the same-release `SHA256SUMS`.
 - **Model catalog** — `SoT/models.json` is the research-verified source for
   model validation, listings, pickers, and the Docks workflow-role registry.
 - **Claude runtime** — sync materializes three dependency-free Bun `.mjs`
@@ -135,19 +138,21 @@ current valid values, while a later flag-less sync restores all defaults.
 
 ## Platform support
 
-| Platform | CLI | Sync engine |
-|----------|-----|-------------|
-| Linux | ✅ native | ✅ native |
-| macOS (x64/arm64) | ✅ native | ✅ native |
-| Windows | ✅ native binary (`.exe` and `bun add -g` CI-verified) | ✅ EngineNative (TS, default engine — no Git Bash); real-machine verified 2026-07-09 — RTK hooks are native too (rtk ≥0.37.2) |
+| Platform | Architecture | docks-kit binary | Session Relay prebuilt | Sync engine |
+|----------|--------------|------------------|------------------------|-------------|
+| Linux | x64 | ✅ | ✅ | ✅ native |
+| Linux | arm64 | ✅ | ✅ | ✅ native |
+| macOS | x64 | ✅ | ✅ | ✅ native |
+| macOS | arm64 | ✅ | ✅ | ✅ native |
 
 Details: `docks-kit docs platforms`.
 
 ## Releases
 
-Tagging `cli-v*` builds five standalone binaries (+ SHA256SUMS) and attaches
-them to the GitHub release; npm publish runs when the `NPM_TOKEN` secret is
-configured. Package bundles the CLI + generated payload, so npm releases are
+Tagging `cli-v*` builds four standalone binaries (Linux x64/arm64 and macOS
+x64/arm64) plus `SHA256SUMS` and attaches them to the GitHub release; npm
+publish runs when the `NPM_TOKEN` secret is configured.
+Package bundles the CLI + generated payload, so npm releases are
 versioned config snapshots without shipping the authoring `SoT/` tree.
 
 ## Deeper docs

package/cli/docs/install.md

@@ -1,5 +1,8 @@
 # Installing docks-kit
 
+Supported hosts are Linux x64/arm64 and macOS x64/arm64. Unsupported hosts
+fail before the launcher can fall back to Bun source.
+
 ## 1. Repo checkout (development / current users)
 
 ```
@@ -8,10 +11,11 @@ cd ~/projects/public
 ./docks-kit sync
 ```
 
-The `./docks-kit` launcher prefers a compiled binary in `cli/dist/` only when
-its reported version matches `package.json`, then falls back to Bun-from-source
-(auto-installing Bun via download-then-run and `bun install --frozen-lockfile`
-when needed). An ignored stale build is reported and bypassed.
+On a supported host, the `./docks-kit` launcher prefers a compiled binary in
+`cli/dist/` only when its reported version matches `package.json`, then falls
+back to Bun-from-source (auto-installing Bun via download-then-run and
+`bun install --frozen-lockfile` when needed). An ignored stale build is reported
+and bypassed.
 
 ## 2. Global via Bun (effect-solutions-style)
 
@@ -51,7 +55,7 @@ install; `docks-kit --version`, model catalogs, toolchain checks, and real sync
 remain functional with the script blocked. CI pins the one-package/one-command
 identity above and will fail if the script-bearing set changes.
 
-## 3. curl installer (Unix-only)
+## 3. curl installer (Linux/macOS)
 
 ```
 curl -fsSL https://raw.githubusercontent.com/DocksDocks/public/main/install.sh -o /tmp/docks-kit-install.sh
@@ -61,20 +65,7 @@ bash /tmp/docks-kit-install.sh && rm /tmp/docks-kit-install.sh
 Download-then-run, never `curl | bash` — stream truncation has bitten this
 kit before. The installer bootstraps Bun when absent, runs
 `bun add -g docks-kit`, and links the binary into `~/.local/bin`.
-**Linux/macOS only** — on Windows use the compiled `.exe` or `bun add -g`
-(both CI-verified; see below).
-
-## Windows entrypoints
-
-Two supported paths (CI-verified on windows-2025, native PowerShell):
-
-- **Compiled binary** — `docks-kit-windows-x64.exe` release asset. No Bun,
-  no Git Bash: the exe embeds the runtime and generated payload, and
-  EngineNative runs in-process from any working directory.
-- **`bun add -g docks-kit`** — bun creates a working shim for the
-  `#!/usr/bin/env bun` bin; the package carries the same generated payload.
-
-`install.sh` is not a Windows path.
+This installer supports Linux and macOS only.
 
 ## Keeping the kit up to date
 
@@ -105,6 +96,6 @@ sync/config reads.
 - Bun for source/global installs; release binaries embed the runtime
 - Node/npm for npm-global tools (agent-browser, LSP servers)
 - jq is optional doctor/test tooling; sync has no jq runtime dependency
-- curl is required only when a requested POSIX RTK/Bun bootstrap must download
+- curl is required only when a requested Linux/macOS RTK/Bun bootstrap must download
   an installer; an already-present Bun does not require it
 - See `docks-kit toolchain check` for the full picture on this machine

package/cli/docs/platforms.md

@@ -1,46 +1,18 @@
 # Platform support
 
-| Platform | CLI (docks-kit) | Sync engine | Notes |
-|----------|-----------------|-------------|-------|
-| Linux | native | EngineNative (TS) | Primary target |
-| macOS | native (x64 + arm64) | EngineNative (TS) | Release binary or Bun source path |
-| Windows | native (`.exe` / `bun add -g`, CI-verified) | EngineNative (TS) — no Git Bash | Real-machine verified 2026-07-09 |
-
-EngineNative is the only supported engine on all platforms. `DOCKS_KIT_ENGINE=bash`
-now exits with the removed-engine message and points at the `bash-engine-final`
-tag for historical recovery.
-
-## Windows detail
-
-Supported entrypoints (both verified in CI on windows-2025 under native
-PowerShell — see `.github/workflows/windows-entrypoints.yml`):
-
-- **`docks-kit-windows-x64.exe`** (release asset) — the no-toolchain path.
-  No Bun, no Git Bash; the exe embeds the runtime and generated payload, and
-  EngineNative runs in-process from any working directory.
-- **`bun add -g docks-kit`** — bun creates a working Windows shim for the
-  `#!/usr/bin/env bun` bin; the package carries the same generated payload.
-- `install.sh` is **Unix-only** and not a Windows path.
-
-The managed tools all run natively on Windows: Claude Code (requires Git
-Bash for its own Bash tool — that requirement is Claude Code's, not this
-kit's), Codex CLI (native PowerShell + Windows sandbox), RTK (native
-binaries; since rtk 0.37.2 the PreToolUse hook is a native binary command —
-`rtk hook claude`, no shell or jq. Only the kit's *auto-installer* is
-Unix-only: install rtk natively, then sync).
-
-CI coverage (all on the pinned windows-2025 label): EngineNative PowerShell
-smoke with `HOME` unset — `%USERPROFILE%` path resolution, `.cmd` tool
-spawning (npm), toolchain gate branches (`.github/workflows/parity.yml`,
-`native-windows` job); the two entrypoints above (`windows-entrypoints.yml`).
-Deployed SessionStart/Notification hooks directly exec an absolute real
-`bun.exe`. Claude still shell-evaluates the statusline, so its stored command is
-an encoded PowerShell missing-file guard that behaves identically when the outer
-shell is native PowerShell or Git Bash. CI executes both outer-shell paths and
-pins output bytes/channels plus latency ceilings.
-
-**Status: supported** — real-machine verified 2026-07-09 (Claude Code loads
-the synced `%USERPROFILE%\.claude`; full sync, self-update, plugin passes,
-universal skills, and agent-browser all green on native PowerShell). Needs
-git on PATH for plugin marketplaces; rtk installs natively via its Windows
-release (the kit's auto-install is Unix-only).
+The supported host matrix is exact:
+
+| Platform | Architecture | docks-kit binary | Session Relay prebuilt | Sync engine |
+|----------|--------------|------------------|------------------------|-------------|
+| Linux | x64 | `docks-kit-linux-x64` | `x86_64-unknown-linux-musl` | EngineNative (TS) |
+| Linux | arm64 | `docks-kit-linux-arm64` | `aarch64-unknown-linux-musl` | EngineNative (TS) |
+| macOS | x64 | `docks-kit-darwin-x64` | `x86_64-apple-darwin` | EngineNative (TS) |
+| macOS | arm64 | `docks-kit-darwin-arm64` | `aarch64-apple-darwin` | EngineNative (TS) |
+
+Windows and every other host are unsupported. The launcher fails before any
+Bun-from-source fallback, and Session Relay installation reports the unsupported
+host without downloading an asset.
+
+EngineNative is the only supported engine on supported hosts.
+`DOCKS_KIT_ENGINE=bash` exits with the removed-engine message and points at the
+`bash-engine-final` tag for historical recovery.

package/cli/docs/toolchain.md

@@ -33,7 +33,7 @@ now kit-approved" act.
 - **bun** — policy `present`: bootstrap only (pinned to `verified` via the
   installer's version argument), never auto-upgraded. `bun.ts` owns one
   per-engine-run memo shared by Claude runtime, effect-solutions, and direct
-  toolchain ensure. Windows resolves only a real absolute `bun.exe` for hooks.
+  toolchain ensure on supported Linux/macOS hosts.
 - **effect-solutions**, **agent-browser** — policy `track`: self-upgrade
   toward npm latest, gated by their `verified` pins.
 - **session-relay** — policy `exact`: Claude/Codex sync and
@@ -44,13 +44,13 @@ now kit-approved" act.
   source pin = selected row = downloaded bytes, chmods/smoke-tests only the
   sibling stage, then renames it over `~/.local/bin/session-relay`. Offline,
   unsupported-host, checksum, chmod, version, download, or rename failures
-  preserve an existing command byte-for-byte. The four committed digests are
-  validation fixtures pending independently hashed production assets; this
-  pin must not ship until they are replaced and reviewed.
+  preserve an existing command byte-for-byte. The four pinned production
+  digests correspond to the stable `session-relay--v0.12.0` assets and match
+  its `SHA256SUMS`.
 
 jq and curl are `check` rows, not global prerequisites. jq is not consumed by
-normal sync. curl is checked only at a requested POSIX RTK/Bun installer
-download boundary; Windows Bun bootstrap uses PowerShell's native download.
+normal sync. curl is checked only at a requested Linux/macOS RTK/Bun installer
+download boundary.
 
 ## Supply-chain stance
 

package/cli/src/commands/docs.ts

@@ -20,7 +20,7 @@ const TOPICS: Record<string, { summary: string; body: string }> = {
   "toolchain": { summary: "Verified-version floors, gate policy, --yes semantics", body: toolchain },
   "plugins": { summary: "enabledPlugins tri-state + optional plugin opt-ins", body: plugins },
   "install": { summary: "Install paths: repo checkout, bun add -g, curl installer", body: install },
-  "platforms": { summary: "Platform support: Linux/macOS native, Windows via Git Bash/WSL", body: platforms }
+  "platforms": { summary: "Platform support: Linux/macOS x64 and arm64", body: platforms }
 }
 
 const topic = Args.text({ name: "topic" }).pipe(

package/cli/src/commands/toolchain.ts

@@ -2,7 +2,7 @@ import { Args, Command, Options } from "@effect/cli"
 import { Effect, Option } from "effect"
 import { bail, engine } from "../engine"
 
-const MANAGED = ["rtk", "bun", "effect-solutions", "agent-browser"]
+const MANAGED = ["rtk", "bun", "effect-solutions", "agent-browser", "session-relay"]
 
 const op = Args.text({ name: "op" }).pipe(
   Args.withDescription("check (default) | ensure <tool>"),

package/cli/src/engine-native/DESIGN.md

@@ -96,12 +96,10 @@ hooks/env changed → restart line; skills changed → discovery line) or under
 
 ### Platform seam
 
-All platform branching routes through `os.ts` — the only engine module that
-reads `process.platform`, with one named exemption: `exec.ts`'s path/exec
-primitives (`commandExists` PATHEXT resolution and `X_OK` probing) stay
-self-contained because they sit below the seam. `deps.ts` install hints
-default their platform from `os.ts` and keep the parameter injectable for
-tests.
+All host detection routes through `os.ts`, the engine module that reads
+`process.platform`. `exec.ts` contains only POSIX executable and PATH probes.
+`deps.ts` install hints default their platform from `os.ts` and keep the
+parameter injectable for tests.
 
 ### Verbosity plumbing
 
@@ -122,7 +120,7 @@ active logger binding.
 | `../payload.ts` | generated text/byte payload reads and presentation-only source labels |
 | `claudeSync.ts` | Claude pipeline: RTK, prepared settings transaction, runtime assets, deploy-time modifiers, `~/.claude.json`, readiness-gated removed artifacts, plugins, optional plugins, LSP binaries |
 | `bun.ts` | per-run memoized Bun resolution/bootstrap shared by Claude runtime, effect-solutions, and direct toolchain ensure |
-| `claudeRuntime.ts` | sentinel validation, absolute runtime paths, no-cutover settings projection, and POSIX/encoded-PowerShell statusline commands |
+| `claudeRuntime.ts` | sentinel validation, absolute runtime paths, no-cutover settings projection, and POSIX statusline commands |
 | `settings.ts` | pure Claude settings merge/reconcile semantics and permission-array union |
 | `claudeModel.ts` | deployed Claude model modifier and direct `model claude` write path |
 | `codexSync.ts` | Codex pipeline: bubblewrap check, config merge, rules, AGENTS.md, personal marketplace, plugin refresh |
@@ -132,24 +130,20 @@ active logger binding.
 | `modes.ts` | direct `model` and `toolchain` modes |
 | `models.ts` | model catalog listing and validation |
 | `jq.ts` | JSON helpers that preserve jq-style merge/order/stringify behavior where the deployed file contract needs it |
-| `exec.ts` | path helpers, command probes, capture/spawn wrappers, Windows command resolution, change-detecting write/copy helpers |
+| `exec.ts` | slash-stable path helpers, POSIX command probes, capture/spawn wrappers, and change-detecting write/copy helpers |
 | `logger.ts` | Logger shape + stable raw stdout/stderr sink factory; the run-scoped verbosity gate lives in `index.ts` |
-| `deps.ts` | external-tool registry: identity, requirement class, presence probe, platform-correct install hints, per-manager missing-tool dedup; callers supply the current run Logger to `warnMissing` |
-| `os.ts` | platform capability seam — the single `process.platform` reader (`platformName`, `isWindows`, `isLinux`, shell-rc applicability) |
+| `deps.ts` | external-tool registry: identity, requirement class, presence probe, supported-host install hints, per-manager missing-tool dedup; callers supply the current run Logger to `warnMissing` |
+| `os.ts` | platform capability seam — the single `process.platform` reader (`platformName`, `isLinux`, shell-rc applicability) |
 | `services.ts` | shared raw-Logger + DependencyManager + Platform factory; wrapped in Effect Layers at `cli/src/services.ts`, with the run-scoped Logger gate applied only by `runEngineNative` |
 
-## Windows Specifics
+## Platform Support
 
-- Home resolves through Node's platform APIs; CI deliberately unsets `HOME` so
-  `%USERPROFILE%` is exercised.
-- Paths are built through `node:path`.
-- Connector env uses `setx` on win32; Unix shell rc files are not touched.
-- Symlink creation falls back to copy where the platform or permissions require
-  it.
-- Bubblewrap and shell-rc work are Linux/macOS only.
-- Claude command hooks directly exec the resolved absolute `bun.exe`; the
-  statusline stores an encoded PowerShell missing-file guard because Claude
-  shell-evaluates `statusLine.command` through PowerShell or Git Bash.
+- EngineNative supports Linux and macOS on x64 and arm64.
+- Unsupported hosts fail before launcher fallback, dependency probes, downloads,
+  settings writes, or sync work.
+- Runtime hooks use POSIX commands and absolute Bun paths.
+- Symlink creation remains capability-driven: permission or filesystem failures
+  fall back to copy without predicting the host.
 
 ## Tests
 
@@ -158,12 +152,10 @@ active logger binding.
   `cli/test/goldens/dryrun.json`.
 - `bun run golden:mutation` compares live native mutation snapshots, argv logs,
   output, and TOML invariants to `cli/test/goldens/mutation.json`.
-- `.github/workflows/parity.yml` is now the golden-regression workflow: Linux
-  runs unit + golden + prove-red plus the exact materialized POSIX runtime
-  commands; the `native-windows` job executes the same stored statusline command
-  through PowerShell and Git Bash plus direct Bun hooks.
-- `.github/workflows/windows-entrypoints.yml` verifies the release binary and
-  `bun add -g` entrypoints on Windows.
+- `.github/workflows/parity.yml` is the golden-regression workflow: Linux runs
+  unit + golden + prove-red plus the exact materialized POSIX runtime commands.
+- `.github/workflows/release-cli.yml` publishes the four Linux/macOS x64/arm64
+  binaries, `SHA256SUMS`, and the npm package.
 
 ## Non-Goals
 

package/cli/src/engine-native/bun.ts

@@ -4,7 +4,6 @@ import { tmpdir } from "node:os"
 
 import { p } from "./exec"
 import type { Ctx } from "./index"
-import { encodePowerShellCommand, powerShellLiteral } from "./powershell"
 import type { EngineServices } from "./services"
 import { field } from "./toolchain"
 
@@ -17,31 +16,14 @@ function remember(ctx: Ctx, state: BunRuntimeState): BunRuntimeState {
   return state
 }
 
-function predictedExecutable(ctx: Ctx, services: EngineServices): string {
+function predictedExecutable(ctx: Ctx): string {
   const root = process.env["BUN_INSTALL"] !== undefined && process.env["BUN_INSTALL"] !== ""
     ? process.env["BUN_INSTALL"]!
     : p(ctx.home, ".bun")
-  return p(root, "bin", services.platform.isWindows() ? "bun.exe" : "bun")
+  return p(root, "bin", "bun")
 }
 
-function windowsDownloadScript(installer: string): string {
-  return `$ErrorActionPreference = 'Stop'; Invoke-WebRequest -Uri ${powerShellLiteral("https://bun.sh/install.ps1")} -OutFile ${powerShellLiteral(installer)}`
-}
-
-function installBun(ctx: Ctx, services: EngineServices, pin: string, installer: string): void {
-  if (services.platform.isWindows()) {
-    const encoded = encodePowerShellCommand(windowsDownloadScript(installer))
-    const download = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded], { stdio: "ignore" })
-    if (download.error === undefined && download.status === 0) {
-      spawnSync(
-        "powershell.exe",
-        ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", installer, "-Version", pin, "-DownloadWithoutCurl"],
-        { stdio: "ignore" }
-      )
-    }
-    return
-  }
-
+function installBun(pin: string, installer: string): void {
   const download = spawnSync("curl", ["-fsSL", "https://bun.sh/install", "-o", installer], { stdio: "ignore" })
   if (download.error === undefined && download.status === 0) {
     spawnSync("bash", [installer, `bun-v${pin}`], { stdio: "ignore" })
@@ -59,19 +41,19 @@ export function bunBootstrap(ctx: Ctx, services: EngineServices): BunRuntimeStat
     services.logger.warn("Bun bootstrap aborted — SoT/toolchain.json has no verified Bun pin")
     return remember(ctx, { kind: "deferred", reason: "install-failed" })
   }
-  if (!services.platform.isWindows() && services.deps.probe("curl").state === "missing") {
+  if (services.deps.probe("curl").state === "missing") {
     services.deps.warnMissing("curl", services.logger, "cannot bootstrap Bun; install Bun manually, then re-run sync")
     return remember(ctx, { kind: "deferred", reason: "missing-curl" })
   }
   if (ctx.dryRun) {
-    const executable = predictedExecutable(ctx, services)
+    const executable = predictedExecutable(ctx)
     services.logger.echo(`[dry-run] install Bun ${pin} (kit-verified) -> ${executable}`)
     return remember(ctx, { kind: "ready", executable })
   }
   services.logger.warn(`Bun not found — installing Bun ${pin} (kit-verified)...`)
-  const installer = p(tmpdir(), `bun-install-${process.pid}.${services.platform.isWindows() ? "ps1" : "sh"}`)
+  const installer = p(tmpdir(), `bun-install-${process.pid}.sh`)
   try {
-    installBun(ctx, services, pin, installer)
+    installBun(pin, installer)
   } finally {
     rmSync(installer, { force: true })
   }

package/cli/src/engine-native/claudeRuntime.ts

@@ -1,7 +1,5 @@
 import { p } from "./exec"
 import { isObject, parseJson, type Json } from "./jq"
-import { encodePowerShellCommand, powerShellLiteral } from "./powershell"
-import type { Platform } from "./services"
 
 const BUN_SENTINEL = "__DOCKS_KIT_BUN__"
 const SESSION_START_SENTINEL = "__DOCKS_KIT_SESSION_START__"
@@ -89,22 +87,15 @@ function posixLiteral(value: string): string {
   return `'${value.replaceAll("'", `'"'"'`)}'`
 }
 
-export function statusLineCommand(runtime: ClaudeRuntimePaths, platform: Platform): string {
-  if (!platform.isWindows()) {
-    const bun = posixLiteral(runtime.bun)
-    const script = posixLiteral(runtime.statusline)
-    return `test -x ${bun} && test -f ${script} && exec ${bun} ${script} || true`
-  }
-  const bun = powerShellLiteral(runtime.bun.replaceAll("\\", "/"))
-  const script = powerShellLiteral(runtime.statusline.replaceAll("\\", "/"))
-  const guard = `$ProgressPreference = 'SilentlyContinue'; if ((Test-Path -LiteralPath ${bun} -PathType Leaf) -and (Test-Path -LiteralPath ${script} -PathType Leaf)) { & ${bun} ${script} }`
-  return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(guard)}`
+export function statusLineCommand(runtime: ClaudeRuntimePaths): string {
+  const bun = posixLiteral(runtime.bun)
+  const script = posixLiteral(runtime.statusline)
+  return `test -x ${bun} && test -f ${script} && exec ${bun} ${script} || true`
 }
 
 export function materializeClaudeSettings(
   template: Json,
-  runtime: ClaudeRuntimePaths | undefined,
-  platform: Platform
+  runtime: ClaudeRuntimePaths | undefined
 ): Json {
   validateTemplate(template)
   const result = cloneJson(template)
@@ -122,7 +113,7 @@ export function materializeClaudeSettings(
     notification["command"] = runtime.bun
     notification["args"] = [runtime.notify]
     if (!isObject(result) || !isObject(result["statusLine"])) throw new Error("Claude statusLine object is missing")
-    result["statusLine"]["command"] = statusLineCommand(runtime, platform)
+    result["statusLine"]["command"] = statusLineCommand(runtime)
   }
 
   for (const sentinel of [BUN_SENTINEL, SESSION_START_SENTINEL, NOTIFY_SENTINEL, STATUSLINE_SENTINEL]) {

package/cli/src/engine-native/claudeSync.ts

@@ -62,8 +62,7 @@ export function claudeSync(ctx: Ctx): ClaudeRuntimeState {
   }
   const materialized = materializeClaudeSettings(
     template,
-    runtime.kind === "ready" ? runtime.paths : undefined,
-    ctx.services.platform
+    runtime.kind === "ready" ? runtime.paths : undefined
   )
   const prepared = ctx.dryRun ? undefined : prepareClaudeSettings(ctx, claudeDir, materialized)
 
@@ -150,12 +149,7 @@ function syncRtk(ctx: Ctx, claudeDir: string): void {
     return
   }
 
-  if (ctx.services.platform.isWindows()) {
-    if (ctx.services.deps.probe("rtk").state === "missing") {
-      warn("rtk not installed — the kit's auto-install is Unix-only. Install natively (winget, or the rtk-*-windows-msvc.zip release), then re-run sync")
-      return
-    }
-  } else if (ensureRtk(ctx, "cannot download RTK installer; continuing sync without RTK", 0) !== 0) {
+  if (ensureRtk(ctx, "cannot download RTK installer; continuing sync without RTK", 0) !== 0) {
     warn("RTK bootstrap failed — continuing sync without it")
   }
 
@@ -412,32 +406,7 @@ function syncClaudeJson(ctx: Ctx): void {
 // -------------------------------------------------------- connector env ----
 
 function syncConnectorEnv(ctx: Ctx): void {
-  const { change, echo, verbose, warn } = ctx.services.logger
-  // win32: Claude Code launches from PowerShell/GUI, so the flag must be a
-  // real user env var (setx), not a Git-Bash-only shell-rc export. Never
-  // clobbers an existing value (set =true yourself to keep connectors).
-  if (ctx.services.platform.isWindows()) {
-    const existing = spawnSync("reg", ["query", "HKCU\\Environment", "/v", "ENABLE_CLAUDEAI_MCP_SERVERS"], {
-      stdio: "ignore"
-    })
-    if (existing.error === undefined && existing.status === 0) {
-      if (ctx.dryRun) echo("[dry-run] ENABLE_CLAUDEAI_MCP_SERVERS already in user environment — would skip")
-      else verbose("claude.ai connectors: ENABLE_CLAUDEAI_MCP_SERVERS already set in user environment (left as-is)")
-      return
-    }
-    if (ctx.dryRun) {
-      echo("[dry-run] setx ENABLE_CLAUDEAI_MCP_SERVERS false (user environment)")
-      return
-    }
-    const res = spawnSync("setx", ["ENABLE_CLAUDEAI_MCP_SERVERS", "false"], { stdio: "ignore" })
-    if (res.error === undefined && res.status === 0) {
-      change("claude.ai connectors disabled via setx (open a new terminal to apply)")
-      ctx.nextStepTriggers.claudeRestart = true
-    } else {
-      warn("setx ENABLE_CLAUDEAI_MCP_SERVERS false failed — set it manually in System Properties > Environment Variables")
-    }
-    return
-  }
+  const { change, echo, verbose } = ctx.services.logger
 
   const line = "export ENABLE_CLAUDEAI_MCP_SERVERS=false"
   const marker = "# docks-kit: disable claude.ai cloud MCP connectors (set =true to keep them)"

package/cli/src/engine-native/codexSync.ts

@@ -86,7 +86,7 @@ function bwrapSupportedOs(ctx: Ctx): boolean {
   const { warn } = ctx.services.logger
   const pn = ctx.services.platform.name()
   if (pn === "linux") return true
-  if (pn === "darwin" || pn === "windows") return false
+  if (pn === "darwin") return false
   warn("Unknown OS — skipping bubblewrap check; Codex sandbox may not work")
   return false
 }