simt-dev 0.5.0 → 0.6.0

package/src/commands/plugin.mjs

@@ -0,0 +1,61 @@
+// simt plugin <claude|gemini|cursor> --out <dir> [--yes]
+//
+// Build one harness package from the same tables `agent-hooks install` writes into a
+// repository, so a package and a repository install cannot drift apart. A dry run prints
+// the plan and writes nothing; --yes copies the runtime and writes every generated file.
+// The package is self-contained — it carries its own copy of the runtime — so it installs
+// into a clean profile that has never seen this tool (plan 0003 R43).
+
+import { EXIT, emit, emitJson, fail, isJson, writeMode } from '../output/index.mjs';
+import { CLI } from '../name.mjs';
+import { buildPackage, PLUGIN_KINDS } from '../plugins.mjs';
+
+export async function pluginCommand(args, flags) {
+  const kind = args[0];
+  if (!kind || !PLUGIN_KINDS.includes(kind)) {
+    return fail(
+      kind ? `unknown package kind \`${kind}\`` : 'plugin needs a kind',
+      EXIT.USAGE,
+      `one of: ${PLUGIN_KINDS.join(', ')}`,
+    );
+  }
+
+  const out = flags.out;
+  if (!out) {
+    return fail('plugin needs --out <dir>', EXIT.USAGE, 'where the generated package lands');
+  }
+
+  const { apply } = writeMode(flags);
+  const root = flags.root ?? process.cwd();
+  const plan = await buildPackage(kind, { root, out, apply });
+
+  if (isJson(flags)) {
+    emitJson({
+      ok: true,
+      command: `plugin ${kind}`,
+      out,
+      dryRun: !apply,
+      runtime: plan.runtime,
+      files: plan.files,
+      notes: plan.notes,
+    });
+    return EXIT.OK;
+  }
+
+  const runtimeTarget = plan.runtime.target === '.' ? '(the package root)' : `${plan.runtime.target}/`;
+  emit(
+    [
+      `kind     ${kind}`,
+      `out      ${out}`,
+      `runtime  copies ${plan.runtime.parts.join(', ')} into ${runtimeTarget}`,
+      ...plan.files.map((f) => `${apply ? 'WRITE' : 'PLAN '}  ${f.path}`),
+      ...plan.notes.map((n) => `note     ${n}`),
+      '',
+      apply
+        ? `WROTE    ${plan.files.length} generated file(s) plus the runtime`
+        : `PLAN     nothing written; apply with: ${CLI} plugin ${kind} --out ${out} --yes`,
+    ].join('\n'),
+    { maxBytes: flags.maxBytes ?? 0 },
+  );
+  return EXIT.OK;
+}

package/src/commands/rules.mjs

@@ -1,4 +1,4 @@
-// `simt-dev rules` - the rule catalogue and its provenance.
+// `simt rules` - the rule catalogue and its provenance.
 //
 // A rule is only meaningful if you can answer "why is this here?". Three
 // commands, mirroring the skill surface deliberately: `list` is the catalogue,

package/src/commands/skills.mjs

@@ -1,4 +1,4 @@
-// `simt-dev skills` - tier 0 (index), tier 1 (brief), tier 2 (show), plus find/why.
+// `simt skills` - tier 0 (index), tier 1 (brief), tier 2 (show), plus find/why.
 //
 // Implementation sequence steps 4 and 5.
 //

package/src/commands/skillscompile.mjs

@@ -20,9 +20,7 @@ import { resolveVaultDir } from '../bench/mine.mjs';
 import { locateSource, sourceHeldLocally } from '../resolve/source.mjs';
 import { nearMatches } from '../resolve/near.mjs';
 import { resolveWorkspace, WORKSPACE_REMEDY } from '../workspace.mjs';
-import { CLI, CONFIG_DIR } from '../name.mjs';
-
-const STATE_DIR = `.${CONFIG_DIR}`;
+import { CLI, STATE_DIR } from '../name.mjs';
 
 async function readSkillRawText(skill, workspaceRoot, root) {
   const canonical = skill.sources?.find((s) => s.role === 'canonical') ?? skill.sources?.[0];

package/src/commands/skillsinstall.mjs

@@ -1,4 +1,4 @@
-// `simt-dev skills install` - pin a skill into a repo as a local copy.
+// `simt skills install` - pin a skill into a repo as a local copy.
 //
 // Plan 0002 section 8.3: installed skills are recorded in `simt-dev.json`
 // `localSkills` and are excluded from central-drift accounting. The point is a

package/src/commands/sync.mjs

@@ -1,5 +1,5 @@
-// simt-dev sync --yes — write the generated regions.
-// simt-dev check — the gate.
+// simt sync --yes — write the generated regions.
+// simt check — the gate.
 //
 // They share plan/project.mjs so they can never disagree about what the regions
 // should contain. sync decides whether to act; check decides severity and exit
@@ -36,7 +36,7 @@ import { lintDecisions } from '../memory/decide.mjs';
 /** Findings `sync` reports and does not fail on.
  *
  *  `pointer-unread` is a misaimed pointer whose reader this repository serves. `sync`
- *  must not refuse on it: the remedy is `simt-dev sync --yes`, so a `sync` that blocked
+ *  must not refuse on it: the remedy is `simt sync --yes`, so a `sync` that blocked
  *  would be a gate whose remedy is the command being run — ADR-025 ruling 6's hazard, and
  *  worse than a noisy gate. `check` disagrees, and the reason is the whole of ADR-051.
  *
@@ -194,9 +194,9 @@ export async function syncCommand(positional, flags) {
     if (st.state === 'current') continue;
     // A *mispointed* pointer is one this tool wrote and this tool may repair: it is a
     // symlink, so it has no content, and the remedy printed by `check` for this exact
-    // finding is `simt-dev sync --yes`. Reporting a plan and then calling `symlink()` at
+    // finding is `simt sync --yes`. Reporting a plan and then calling `symlink()` at
     // an existing path is `EEXIST` — which is what this did, and the remedy it offered
-    // was `simt-dev doctor`, which reports nothing about it. A command whose own remedy
+    // was `simt doctor`, which reports nothing about it. A command whose own remedy
     // crashes on the state it names has no remedy at all.
     //
     // Only a symlink is replaced. A regular file or a directory is somebody's work and
@@ -364,7 +364,7 @@ export async function syncCommand(positional, flags) {
 
   const idle = changed.length === 0 && pointerPlan.length === 0 && !manifestChanged;
   if (checkOnly) return idle ? EXIT.OK : EXIT.FAIL;
-  // A preview that found work is not a success: `simt-dev sync --yes` with no flags is a
+  // A preview that found work is not a success: `simt sync --yes` with no flags is a
   // check that also prints the plan, and a check that exits 0 while reporting drift
   // is the one-question-two-answers shape ADR-035 rules out. This is what lets a
   // caller run `sync` in place of `sync --check` and get the same verdict.
@@ -500,8 +500,8 @@ export async function checkCommand(positional, flags) {  const root = flags.root
   const { manifest } = await readManifest(root);
   if (manifest) {
     // The gate runs from whatever binary resolved it. For a repository without npm that
-    // is a global install, and the only thing that knows which version it should be is
-    // the pin the repo recorded at adoption. A stale binary would run a different gate
+    // is the release binary in `.simt/bin` (ADR-098), and the only thing that knows
+    // which version it should be is the pin the repo recorded at adoption. A stale binary would run a different gate
     // than CI does, so the mismatch fails the gate rather than warning.
     const mismatch = assertVersionPin(manifest);
     if (mismatch) {

package/src/commands/tokens.mjs

@@ -1,4 +1,4 @@
-// simt-dev tokens - what a reader loads, counted.
+// simt tokens - what a reader loads, counted.
 //
 // Review 0002 S38 put the estate's always-on context at 90 KB per turn, 72% of it a
 // paragraph an earlier root had already loaded, and could only say so by reading seven

package/src/commands/upgrade.mjs

@@ -1,4 +1,4 @@
-// simt-dev upgrade - move every consumer to this simt-dev, as one reviewable set.
+// simt upgrade - move every consumer to this simt-dev, as one reviewable set.
 //
 // Why this command exists, and why it is shaped the way it is:
 //

package/src/commands/why.mjs

@@ -26,7 +26,7 @@ import { listPromotedLessons } from '../memory/lessons.mjs';
 
 const exec = promisify(execFile);
 
-const RULE_DIRS = ['rules', 'rules/stacks', 'rules/mdc', '.simt-dev/profiles'];
+const RULE_DIRS = ['rules', 'rules/stacks', 'rules/mdc', '.simt/profiles'];
 
 export async function whyCommand(args, flags, commands = []) {
   if (args.length > 1) return fail(`unknown why argument ${args[1]}`, EXIT.USAGE, `run: ${CLI} why [path]`);

package/src/compare/discover.mjs

@@ -1,4 +1,4 @@
-// Find the sibling repositories a `simt-dev compare` should report on.
+// Find the sibling repositories a `simt compare` should report on.
 //
 // Three things here are load-bearing, and each exists because the alternative is
 // a wrong answer rather than a missing one:

package/src/compare/hooksstate.mjs

@@ -1,7 +1,7 @@
 // Read a repo's hook routing and shim state without changing anything.
 //
-// This is the read half of what `simt-dev hooks status` does inline. It is a separate
-// module because two callers need it - `hooks status` and `simt-dev compare` - and a
+// This is the read half of what `simt hooks status` does inline. It is a separate
+// module because two callers need it - `hooks status` and `simt compare` - and a
 // second implementation of "is this shim current?" would be exactly the
 // duplicated-source-of-truth problem the tool exists to remove. `compare` reads it
 // for N repos, so it must not shell out per repo per event.
@@ -11,7 +11,7 @@ import { readFile, stat } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { promisify } from 'node:util';
 
-import { CHAIN_MARKER, EVENTS, HOOKS_DIR, HOOKS_PATH_KEY, SHIM_MARKER, fileFor, renderShim } from '../hooks/shim.mjs';
+import { CHAIN_MARKER, EVENTS, HOOKS_DIR, HOOKS_PATH_KEY, SHIM_MARKER, fileFor, renderChainedShim, renderShim } from '../hooks/shim.mjs';
 import { foreignHooks, resolveHooksDir } from '../hooks/where.mjs';
 import { packageVersion, hasNpm } from '../package-version.mjs';
 
@@ -123,8 +123,8 @@ export async function readHooksPath(root) {
  * already records for the same reason.
  *
  * `root` is the repository the shim belongs to: the remedy a shim prints depends on
- * the repo's kind (a devDependency where package.json exists, a pinned global install
- * where there is none), so the comparison must render the shim the way THIS repo got it,
+ * the repo's kind (a devDependency where package.json exists, the release binary into
+ * the repository where there is none), so the comparison must render the shim the way THIS repo got it,
  * or a non-npm repository would read as stale the moment this tool ships.
  */
 async function describeShim(path, root) {
@@ -142,7 +142,15 @@ async function describeShim(path, root) {
   }
   let stale = true;
   try {
-    stale = content !== renderShim(basename(path), { npm: await hasNpm(root), version: packageVersion() });
+    // A chained shim is current against the repository hook it chains to, not against
+    // the dispatcher template: comparing it to renderShim read every chained ungated
+    // event as stale forever, and no reinstall could clear it.
+    if (content.includes(CHAIN_MARKER)) {
+      const chain = await readChainedShim(path);
+      stale = chain === null || content !== renderChainedShim(chain.event, chain.target);
+    } else {
+      stale = content !== renderShim(basename(path), { npm: await hasNpm(root), version: packageVersion() });
+    }
   } catch {
     stale = true;
   }
@@ -177,17 +185,21 @@ export async function readHooksState(root, options = {}) {
   const staleOurs = [];
   for (const hook of live) {
     const shim = EVENTS.includes(hook.event) ? await describeShim(hook.path, root) : { stale: true };
-    if (!shim.stale) continue;
     // A chained shim is ours too, and its name says nothing: `post-commit` is what the
     // repository called its own hook, and the shim exists under that name precisely so
     // git finds it. Reading it as foreign would make every re-install refuse with "this
     // repo already runs hooks simt did not write" - a shim this tool wrote, refusing
     // itself. Identity is content, the same rule as the dispatcher shim above.
+    //
+    // Classified before the currency skip, because a current chain shim is not stale -
+    // and install still has to maintain it from `chained`, or a second run would forget
+    // the very shim that is already correct.
     const chain = await readChainedShim(hook.path);
     if (chain) {
       chained.push({ ...chain, path: hook.path });
       continue;
     }
+    if (!shim.stale) continue;
     // And so is a dispatcher shim from an EARLIER version of this tool, which is the
     // ordinary state of every repository adopted before the last release.
     //

package/src/compare/learn.mjs

@@ -1,6 +1,6 @@
 // Estate learning through `compare` (plan 0003 R36).
 //
-// Aggregates `.simt-dev/ledger.jsonl`, `.simt-dev/lessons.jsonl`, and ablation/bench
+// Aggregates `.simt/ledger.jsonl`, `.simt/lessons.jsonl`, and ablation/bench
 // records across workspace repositories to surface:
 //   1. the most-violated rules (from hook denials and `review-block` findings);
 //   2. the most-failing and slowest gates (from evidence ledgers);
@@ -189,7 +189,7 @@ async function collectRepoAblationRecords(repoPath) {
 }
 
 async function readExplicitNoValueSections(repoPath) {
-  const file = join(repoPath, '.simt-dev', 'ablation.json');
+  const file = join(repoPath, '.simt', 'ablation.json');
   try {
     const raw = JSON.parse(await readFile(file, 'utf8'));
     const list = Array.isArray(raw?.sections) ? raw.sections : Array.isArray(raw) ? raw : [];

package/src/compare/row.mjs

@@ -1,4 +1,4 @@
-// The matrix a `simt-dev compare` row is built from: one repo's adoption state.
+// The matrix a `simt compare` row is built from: one repo's adoption state.
 //
 // The shape of a row answers one question - "would this repo behave correctly if
 // an agent followed it today?" - from the four things that can make it not:
@@ -255,7 +255,7 @@ export async function buildRow(path, context) {  const name = path.split('/').fi
     if (region.status === 'drift') {
       // A drift has two causes with different fixes, and the SHA says which. When
       // the recorded SHA matches this simt-dev, the region was hand-edited and
-      // `simt-dev sync --yes` is right; when it does not, the repo is simply behind and the
+      // `simt sync --yes` is right; when it does not, the repo is simply behind and the
       // same command is also right - but the message must not claim a version
       // mismatch when the versions are identical, because that sends the reader
       // looking for a pin that is already correct.
@@ -274,7 +274,7 @@ export async function buildRow(path, context) {  const name = path.split('/').fi
     } else if (region.status === 'current' && row.pinnedSha && row.pinnedSha !== context.expectedSha) {
       // The region matches this simt-dev but the manifest pins an older one. The
       // next sync would stamp the newer SHA silently, so the pin is the thing
-      // that is stale - and it is the value `simt-dev upgrade` reads.
+      // that is stale - and it is the value `simt upgrade` reads.
       problems.push(
         `manifest pins simt-dev ${row.pinnedSha}, this is ${context.expectedSha}; run: ${CLI} upgrade`,
       );

package/src/decisions/index.mjs

@@ -1,4 +1,4 @@
-// The decision index: what `simt-dev rules why` traces back to.
+// The decision index: what `simt rules why` traces back to.
 //
 // Rule bodies cite the decision that settled them inline, as `(ADR-001)`. That
 // citation is the only thing standing between "a rule someone wrote" and "a rule

package/src/distill/distill.mjs

@@ -6,7 +6,7 @@
 // needs the guardrails here, because its output is the kind a reader would paste
 // into a pack and forget to check.
 //
-// Nothing here writes outside `.simt-dev/distilled/`, and nothing here edits a
+// Nothing here writes outside `.simt/distilled/`, and nothing here edits a
 // source file (ADR-090, ADR-075). A proposal that a human did not merge is a dead
 // file, which is the intended failure mode: proposals expire, projections do not.
 
@@ -34,7 +34,7 @@ import {
 } from './engine.mjs';
 
 export const DEFAULT_BUDGET = 2048;
-const DISTILL_DIR = '.simt-dev/distilled';
+const DISTILL_DIR = '.simt/distilled';
 
 /**
  * The row's acceptance metric, stated where a caller reads results (ADR-076):

package/src/distribute/release.mjs

@@ -0,0 +1,142 @@
+// The binary channel: what a release publishes, where a repository keeps its copy,
+// and the one command that gets it there.
+//
+// This module is the single place that knows those facts, because three generated
+// surfaces must agree on them and they are rendered from different call sites: the
+// locator block (src/locate.mjs) checks a path, the hook shim's remedy prints a
+// download command, and the CI workflow renders the same download as a step. A
+// second copy of the asset name or the URL is a copy that drifts, and a drifted
+// remedy tells a reader to fetch bytes that do not exist.
+//
+// The channel is a fourth beside npm, PyPI and Homebrew (ADR-058), and unlike the
+// other three it is the one that needs no toolchain at all: the npm channel needs
+// npm, the wheel needs a Python, and the formula - until this release - needed
+// node. The binary is a file. That is the whole design (ADR-098), and it is why
+// the locator checks a path in the repository before it checks PATH: the bytes a
+// repository pinned are the bytes its gate runs, on a machine with nothing else.
+
+import { CLI, PACKAGE_NAME } from '../name.mjs';
+
+// The GitHub repository the release is published from. A fact about where the
+// bytes come from, like the npm registry host: a reader outside this estate
+// reads it as a URL, not as an organisation. Not exported: the only surface a
+// caller needs is the URL, and a second copy of the slug is a copy that drifts.
+const REPO_SLUG = 'QuazarMedia/simt-dev';
+
+/** The platforms the release builds. The set is small on purpose: it is the set
+ *  the locator's remedy and the CI step can name, and a platform in this list that
+ *  the release does not build is a remedy that downloads a 404. */
+export const TARGETS = ['darwin-arm64', 'darwin-x64', 'linux-x64'];
+
+// Where a repository keeps the binary it pinned, relative to its top level.
+// Beneath `.simt`, like every other per-repo state this tool writes, so a reader
+// who has seen one knows where to look for all of them. The name is the command,
+// not the package: the reader types one program and this is it, the same way
+// `bin/simt.mjs` is it on npm.
+const LOCAL_BIN_NAME = CLI;
+
+/** The directory a repository keeps its pinned binary in, relative to its top
+ *  level. Exported because a caller that installs the binary must create it and
+ *  has no other source for the fact. */
+export const LOCAL_BIN_DIR = '.simt/bin';
+
+/** The path the locator checks, relative to the repository's top level. */
+export const LOCAL_BIN = `${LOCAL_BIN_DIR}/${LOCAL_BIN_NAME}`;
+
+/**
+ * The release asset name for a version and a target.
+ *
+ * The package name, not the command: it sits beside its siblings in the release
+ * and next to the npm tarball `simt-dev-0.5.0.tgz`, where one name for the project
+ * is what a reader matching names expects.
+ *
+ * @param {string} version x.y.z
+ * @param {string} osArch one of TARGETS
+ * @returns {string} e.g. `simt-dev-0.5.0-darwin-arm64`
+ */
+export function assetName(version, osArch) {
+  if (!TARGETS.includes(osArch)) throw new Error(`unknown target ${osArch}; known: ${TARGETS.join(', ')}`);
+  return `${PACKAGE_NAME}-${version}-${osArch}`;
+}
+
+/**
+ * The asset name with the platform left for the shell to fill in at runtime.
+ *
+ * The CI step and the remedy both run on a machine whose platform is not known
+ * where the text was written, so the name is completed from `uname` or the
+ * runner there. One template shared with {@link assetName} keeps the two from
+ * drifting: a name rendered here that the release does not publish is a 404.
+ *
+ * @param {string} version x.y.z
+ * @returns {string} e.g. `simt-dev-0.5.0-$os-$arch`, for a shell with $os and $arch set
+ */
+export function assetNameExpr(version) {
+  return `${PACKAGE_NAME}-${version}-$os-$arch`;
+}
+
+/**
+ * The URL the release serves a version's assets from.
+ *
+ * @param {string} version x.y.z
+ * @returns {string}
+ */
+export function releaseBase(version) {
+  return `https://github.com/${REPO_SLUG}/releases/download/v${version}`;
+}
+
+/**
+ * The URL the release serves one asset from.
+ *
+ * @param {string} version x.y.z
+ * @param {string} osArch one of TARGETS
+ * @returns {string}
+ */
+export function releaseUrl(version, osArch) {
+  return `${releaseBase(version)}/${assetName(version, osArch)}`;
+}
+
+/**
+ * The download a reader without npm runs from their repository's top level: fetch
+ * the asset this machine needs and put it where the locator looks.
+ *
+ * One line on purpose - it is rendered into a remedy that a reader copies from an
+ * error message, and a multi-line script in an error message is not copied. The
+ * platform is derived rather than baked in, because the remedy lives in a file
+ * that is committed and shared: a URL rendered for the machine that wrote the
+ * shim would be a 404 for the colleague who clones it.
+ *
+ * The transport is TLS from the release, and the version the bytes report is
+ * checked against the repository's pin by the dispatcher itself (ADR-098), so
+ * the remedy does not also carry a checksum: it is the shortest command that
+ * reaches a working state, and the gate re-verifies what it runs.
+ *
+ * @param {string} version x.y.z
+ * @returns {string} POSIX sh, run from the repository's top level
+ */
+export function localInstall(version) {
+  return [
+    `mkdir -p ${LOCAL_BIN_DIR}`,
+    ...platformLines(),
+    `curl -fsSL "${releaseBase(version)}/${assetNameExpr(version)}" -o ${LOCAL_BIN}`,
+    `chmod +x ${LOCAL_BIN}`,
+  ].join(' && ');
+}
+
+/**
+ * The two shell lines that derive this machine's release target at run time.
+ *
+ * `uname -m` answers `x86_64` on both platforms' Intel builds and `arm64` on
+ * Apple Silicon, so one substitution covers the naming gap. Both the remedy and
+ * the generated CI step name their asset from these lines: the text is committed
+ * and shared, so a URL baked for the machine that wrote it is a 404 for the
+ * colleague who clones it, and a workflow expression interpolated into a command
+ * substitution is worse - the CI step once rendered `os=$('${{ runner.os }}' …)`,
+ * which the runner substitutes to `os=$('Linux' …)` and `set -eu` refuses, so the
+ * install failed on every run in the one repository kind this channel exists for.
+ * The step is executed, not pattern-matched, in test/binary.test.mjs.
+ *
+ * @returns {string[]} POSIX sh lines assigning `$os` and `$arch`
+ */
+export function platformLines() {
+  return [`os=$(uname -s | tr A-Z a-z)`, `arch=$(uname -m | sed "s/x86_64/x64/")`];
+}

package/src/graph/load.mjs

@@ -35,14 +35,15 @@ function defaultRegistryPath() {
 /**
  * The registry to read when the reader names none, in order (ADR-061 ruling 3):
  *
- * 1. The package root, when it holds one. In this checkout that is how the tool finds its
- *    own registry; in an installed package `graph` is not in the published `files`, so it
- *    never does, and the reader falls through to 2 instead of being handed this workspace's
- *    catalogue.
- * 2. A member of the resolved workspace, when exactly one holds one: a tool installed from
- *    node_modules or a formula resolves its workspace by configuration, and the member that
- *    holds the registry is usually the tool's own checkout. More than one holding it is
- *    ambiguity and the reader must pick; none is an honest absence, reported with the
+ * 1. The package root, when it holds one. In a source checkout that is how the tool
+ *    finds its own registry, sitting next to the code that reads it. An installed
+ *    package holds no registry (ADR-061 ruling 2): the catalogue is workspace data,
+ *    and an install serving another estate's skills to an adopting repository would
+ *    be a confident wrong answer. This tier is a source-checkout convenience; when it
+ *    is empty, resolution falls through to the workspace member or an honest absence.
+ * 2. A member of the resolved workspace, when exactly one holds one: reachable in a checkout
+ *    whose package root holds no registry. More than one holding it is ambiguity and the
+ *    reader must pick; none is an honest absence, reported with the
  *    workspace that was looked in.
  *
  * Every step is file existence plus the configured workspace, so the answer can be

package/src/hooks/dispatcher.mjs

@@ -68,8 +68,9 @@ export async function runGates(event, { root, manifest }) {
   }
 
   // The gates below run from the binary that resolved this shim. For a repository
-  // without npm that is a global install, whose version nothing else pins: if it is not
-  // the one this repo adopted, the gates that run here are not the ones CI runs.
+  // without npm that is the release binary in `.simt/bin` (ADR-098), whose version
+  // nothing else pins: if it is not the one this repo adopted, the gates that run here
+  // are not the ones CI runs.
   // Placed after the empty-list check on purpose - with no gates there is nothing the
   // version could get wrong, and failing that case would block commits in repos that
   // deliberately declare none.

package/src/hooks/shim.mjs

@@ -18,6 +18,7 @@
 
 import { renderLocator } from '../locate.mjs';
 import { BIN_ENV, CLI, MANIFEST_FILE, PACKAGE_NAME } from '../name.mjs';
+import { localInstall } from '../distribute/release.mjs';
 import { packageVersion } from '../package-version.mjs';
 
 /**
@@ -49,8 +50,8 @@ export function fileFor(event) {
  * @param {string} event one of EVENTS
  * @param {{npm?: boolean, version?: string}} [opts]
  *   `npm` is whether the repository has a package.json: it decides the remedy's install
- *   (a devDependency where one exists, a pinned global install where there is no
- *   node_modules to pin in). `version` defaults to the running package's own version,
+ *   (a devDependency where one exists, the release binary into the repository where
+ *   there is no node_modules to pin in). `version` defaults to the running package's own version,
  *   so a shim generated by 0.2.0 names 0.2.0 in its remedy and CI install.
  * @returns {string} POSIX sh source, LF-terminated, executable
  */
@@ -62,8 +63,9 @@ export function renderShim(event, { npm = true, version } = {}) {
   // The install that finds the binary when node_modules and PATH both come up empty.
   // A repository with a package.json pins simt-dev as a devDependency, so the remedy
   // installs it there; one without (Gradle, Connect IQ) has no node_modules to pin in,
-  // so the remedy is a pinned global install - the same pinned bytes CI gets.
-  const install = npm ? `npm i -D ${PACKAGE_NAME}@${v}` : `npm i -g ${PACKAGE_NAME}@${v}`;
+  // so the remedy downloads the release binary into the repository - the same pinned
+  // bytes CI gets, and one that needs no npm and no node on the machine (ADR-098).
+  const install = npm ? `npm i -D ${PACKAGE_NAME}@${v}` : localInstall(v);
   const D = '$';
   return `#!/bin/sh
 ${SHIM_MARKER}
@@ -75,7 +77,8 @@ ${SHIM_MARKER}
 # This file only locates the dispatcher and hands over. It resolves in order:
 #   1. ${D}SIMT_DEV_BIN    explicit override, for CI images and odd checkouts
 #   2. node_modules/       the pinned project dependency
-#   3. ${CLI} on PATH       a global install
+#   3. .simt/bin/          the release binary this repository downloaded
+#   4. ${CLI} on PATH       a global install
 # If none resolves it REFUSES rather than exiting 0. A hook that cannot verify
 # anything must never report success - that is what teaches authors to reach for
 # --no-verify.
@@ -102,7 +105,9 @@ ${renderLocator(`hooks run ${event} --root "${D}ROOT"`, {
  */
 export function renderEvidenceShim({ npm = true, version } = {}) {
   const v = version ?? packageVersion();
-  const install = npm ? `npm i -D ${PACKAGE_NAME}@${v}` : `npm i -g ${PACKAGE_NAME}@${v}`;
+  // The same split as renderShim: a devDependency where one exists, the release
+  // binary into the repository where there is no node_modules to pin in.
+  const install = npm ? `npm i -D ${PACKAGE_NAME}@${v}` : localInstall(v);
   const D = '$';
   return `#!/bin/sh
 ${SHIM_MARKER}

package/src/index/govern.mjs

@@ -56,7 +56,7 @@ export function sourceRoots(files) {
 /**
  * One Affects token.
  *
- * A prefixed command (`simt-dev init`, `simt hooks run`) is a command only when
+ * A prefixed command (`simt init`, `simt hooks run`) is a command only when
  * that command exists. The tool name on its own is not a command and not a path.
  * Anything else is a path or a glob, at the repo root and then under each source
  * root. A token that is none of those is unresolved.

package/src/index/map.mjs

@@ -285,7 +285,7 @@ export async function embedTaskQuery(root, task, { embed = false, allowRemote =
  * }} [opts]
  */
 export async function measureRecall(root, opts = {}) {
-  const tasksDir = join(root, '.simt-dev', 'bench', 'tasks');
+  const tasksDir = join(root, '.simt', 'bench', 'tasks');
   let names;
   try {
     names = (await readdir(tasksDir)).filter((name) => name.endsWith('.json')).sort();

package/src/index/persist.mjs

@@ -7,8 +7,8 @@
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 
-export const SQLITE_FILE = '.simt-dev/index.sqlite';
-export const JSONL_FILE = '.simt-dev/index.jsonl';
+export const SQLITE_FILE = '.simt/index.sqlite';
+export const JSONL_FILE = '.simt/index.jsonl';
 export const SCHEMA_V = '3';
 
 const SCHEMA = `