redhat-et · s0undt3ch · Sep 16, 2026 · Sep 16, 2026 · Sep 16, 2026 · Sep 16, 2026
diff --git a/.github/pargates-shard-weights.json b/.github/pargates-shard-weights.json
@@ -129,6 +129,7 @@
 "docmentioncheck.sh": 0.9,
 "docscommandscheck.sh": 1.4,
 "doctorcheck.sh": 61.0,
+"doctorstalecheck.sh": 3.0,
 "donelegendcheck.sh": 10.8,
 "droppedpositivecheck.sh": 42.7,
 "duprowcheck.sh": 1.5,
@@ -226,6 +227,7 @@
 "headsnapcachecheck.sh": 19.9,
 "historyoraclecheck.sh": 6.9,
 "hookcheck.sh": 78.0,
+"hooksembedrecursivecheck.sh": 8.0,
 "hostilecheck.sh": 6.2,
 "hotspotsincecheck.sh": 8.6,
 "htmlcolorcheck.sh": 12.4,
@@ -502,6 +504,7 @@
 "shadowcheck.sh": 11.2,
 "shapingflagcheck.sh": 193.7,
 "shellgateindexcheck.sh": 1.2,
+"shimselfunverifiedcheck.sh": 1.8,
 "showcasecapturecheck.sh": 20.9,
 "sibliftcheck.sh": 0.5,
 "sigredactcheck.sh": 0.9,
@@ -517,6 +520,7 @@
 "skillroutingjudgedcheck.sh": 0.2,
 "skillscan.sh": 0.8,
 "skillscanreadcheck.sh": 0.4,
+"skillsinstallcheck.sh": 2.2,
 "skilltruthcheck.sh": 5.4,
 "skippedcheck.sh": 0.9,
 "skipreasoncheck.sh": 1.6,

diff --git a/.ripwire_quality_acks b/.ripwire_quality_acks
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -604,6 +604,42 @@ those methods; ripwire does not capture them). Every floor is stated and pinned,
 
 ## [0.6.2] — 2026-09-21
 
+### Added — skills and hooks are embedded in the binary; `ripwire skills install` replaces the checkout-symlink installer
+
+`skills/` and `hooks/` are baked into the `ripwire` binary at configure time (CMake globs both directories,
+recursively, into a generated content-addressed header), replacing the two previously separate mechanisms that
+staged them: `skills/install.sh`'s checkout-symlink installer, and the curl installer's `$prefix/share/ripwire/
+{skills,hooks}` copy step. Activation is one command, `ripwire skills install
+[--claude|--codex|--codex-legacy|--hermes|--openclaw|--all|DEST_PATH]`, which extracts the embedded set into a
+versioned, content-addressed store under `$RIPWIRE_DATA_HOME` (every directory it creates forced to `0755`
+regardless of the process umask, contents verified byte-for-byte against the binary's own embedded copy before an
+extraction is ever trusted) and symlinks from there into the target agent's own skill-discovery directory,
+including `skills/hermes/ripwire-*/`'s Hermes-native set. A dangling or foreign-but-live symlink at the
+destination is repaired; a real file or a planted symlink is refused even under `--force`; a stale entry no
+longer current is pruned only when it is ours to prune (manifest-tracked, or resolving under our own store) —
+never a user's own symlink that merely shares the `ripwire-*` naming. `--all` installs into every detected agent
+at once; `--contributor` also installs repo-maintainer-only skills; `--hook` registers each agent's
+PreToolUse/SessionStart nudge and, for Codex and Claude, the UserPromptSubmit prompt router and the
+substitution-meter disclosure banner, merged into the agent's own config via a PATH-resolved `jq`. The manifest
+and any hook config are written atomically (temp file + rename), and record what actually linked, never what was
+merely attempted. `--doctor` reports install provenance — `not_installed=`/`stale=` against the binary's own
+embedded version — and recognises a mise/aqua version-manager shim by its real on-disk install layout (an
+arbitrarily nested archive extraction, not a hardcoded shape) instead of ever calling a shim-managed install
+STALE by mtime; an unresolvable self path is disclosed as `self_unverified=`, never silently claimed as a byte
+match. `skills/install.sh` is now a thin wrapper over the same binary path. Bare `ripwire skills` and `ripwire
+skills install --help`/`-h` now print usage instead of mapping `skills/` as a crawl root or refusing as an
+unknown flag. Windows is out of scope for this round (blocked on the separate native port, #44). Gates:
+`test/skillsinstallcheck.sh` (new, 21 arms), `test/skillinstallcheck.sh`, `test/hermesinstallcheck.sh`,
+`test/hooksembedrecursivecheck.sh` (new), `test/shimselfunverifiedcheck.sh` (new), `test/doctorstalecheck.sh`,
+`test/codexinstallhonestycheck.sh`, `test/selfcontainedcheck.sh`'s embed cross-check. (#225)
+
+### Fixed — `ripwire wrap`'s printed `skills install` recipe line could execute shell metacharacters in a resolved binary path
+
+The recipe line names this process's own resolved executable path verbatim; a path containing `$(...)` or a
+backtick (a version-manager shim resolved through an unusual install layout) was pasted, and would run, as live
+shell. The path is now single-quote-escaped (`rw::shSingleQuote`) before printing, so it is always inert text to
+paste, never executable. Gate: `test/wrapverbscheck.sh`.
+
 ### Added — Microsoft's `cl.exe` builds the tree, so both Windows front ends compile and both gate
 
 The native Windows port (#44) built with clang-cl only; `cl.exe` stopped at the GCC/Clang language extensions

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -312,6 +312,65 @@ foreach(_ripwire_query_name IN LISTS _ripwire_query_names)
 endforeach()
 file(APPEND "${_ripwire_embedded_queries}" "}};\n\ninline constexpr std::string_view queryFor( std::string_view sub ) noexcept\n{\n    for( const EmbeddedQuery& query : kEmbeddedQueries )\n    {\n        if( query.sub == sub )\n            return query.source;\n    }\n    return {};\n}\n\n} // namespace rw::embedded_queries\n")
 
+# ---- configure-time skills/hooks embedding (same model as _ripwire_embedded_queries above) ----
+# skills/*/SKILL.md (+ companion .md files) and hooks/*.sh remain the editable source of truth.
+# CMake regenerates this constexpr table whenever any of those files change; the subcommand in
+# src/skillsinstall.h reads only the binary's read-only data at runtime — no filesystem dependency
+# on skills/ or hooks/ existing on disk (redhat-et/ripwire#225).
+set(_ripwire_embedded_skills "${_ripwire_generated_dir}/embedded_skills.h")
+# *.md only: every file under skills/<name>/ is currently markdown; a non-.md companion file added
+# later (a script, JSON, image) needs this glob widened too, or test/selfcontainedcheck.sh's
+# byte-exact cross-check (which walks every file under skills/*/, no extension filter) goes red.
+file(GLOB_RECURSE _ripwire_skill_files CONFIGURE_DEPENDS RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}/skills" "${CMAKE_CURRENT_SOURCE_DIR}/skills/*.md")
+# Only files inside a skills/<name>/ subdirectory are an embeddable skill — top-level files such as
+# skills/CONSOLIDATION.md are repo-maintainer notes, not a skill payload, and must not be embedded.
+list(FILTER _ripwire_skill_files EXCLUDE REGEX "^[^/]+$")
+file(GLOB_RECURSE _ripwire_hook_files CONFIGURE_DEPENDS RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}/hooks" "${CMAKE_CURRENT_SOURCE_DIR}/hooks/*.sh")
+list(SORT _ripwire_skill_files)   # deterministic iteration order — G4/determinism contract
+list(SORT _ripwire_hook_files)
+
+set(_ripwire_embed_hash_input "")
+string(ASCII 30 _ripwire_embed_rs)   # ASCII record separator — CMake has no \x escape, so build the byte via string(ASCII ...)
+file(WRITE "${_ripwire_embedded_skills}" "#pragma once\n\n#include <array>\n#include <cstddef>\n#include <string_view>\n\nnamespace rw::embedded_skills\n{\n\nstruct EmbeddedFile\n{\n    std::string_view relativePath;\n    std::string_view bytes;\n};\n\n")
+
+foreach(_ripwire_group skill hook)
+  if(_ripwire_group STREQUAL "skill")
+    set(_ripwire_group_files ${_ripwire_skill_files})
+    set(_ripwire_group_root "${CMAKE_CURRENT_SOURCE_DIR}/skills")
+    set(_ripwire_group_prefix "skills")
+    set(_ripwire_group_array "kSkillFiles")
+    set(_ripwire_group_count_name "kSkillFileCount")
+  else()
+    set(_ripwire_group_files ${_ripwire_hook_files})
+    set(_ripwire_group_root "${CMAKE_CURRENT_SOURCE_DIR}/hooks")
+    set(_ripwire_group_prefix "hooks")
+    set(_ripwire_group_array "kHookFiles")
+    set(_ripwire_group_count_name "kHookFileCount")
+  endif()
+  list(LENGTH _ripwire_group_files _ripwire_group_count)
+  file(APPEND "${_ripwire_embedded_skills}" "inline constexpr std::size_t ${_ripwire_group_count_name} = ${_ripwire_group_count};\ninline constexpr std::array<EmbeddedFile, ${_ripwire_group_count_name}> ${_ripwire_group_array} = {{\n")
+  set(_ripwire_embed_index 0)
+  foreach(_ripwire_rel IN LISTS _ripwire_group_files)
+    set(_ripwire_abs "${_ripwire_group_root}/${_ripwire_rel}")
+    set(_ripwire_stored_rel "${_ripwire_group_prefix}/${_ripwire_rel}")
+    file(READ "${_ripwire_abs}" _ripwire_file_content)
+    string(APPEND _ripwire_embed_hash_input "${_ripwire_stored_rel}${_ripwire_embed_rs}${_ripwire_file_content}${_ripwire_embed_rs}")
+    set(_ripwire_delim "CTXE_${_ripwire_group}_${_ripwire_embed_index}")
+    string(FIND "${_ripwire_file_content}" ")${_ripwire_delim}\"" _ripwire_embed_collision)
+    if(NOT _ripwire_embed_collision EQUAL -1)
+      message(FATAL_ERROR "embedded file ${_ripwire_abs} collides with its generated raw-string delimiter")
+    endif()
+    file(APPEND "${_ripwire_embedded_skills}" "    { \"${_ripwire_stored_rel}\", R\"${_ripwire_delim}(${_ripwire_file_content})${_ripwire_delim}\" },\n")
+    set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${_ripwire_abs}")
+    math(EXPR _ripwire_embed_index "${_ripwire_embed_index} + 1")
+  endforeach()
+  file(APPEND "${_ripwire_embedded_skills}" "}};\n\n")
+endforeach()
+
+string(SHA256 _ripwire_embed_full_hash "${_ripwire_embed_hash_input}")
+string(SUBSTRING "${_ripwire_embed_full_hash}" 0 8 _ripwire_embed_hash8)
+file(APPEND "${_ripwire_embedded_skills}" "inline constexpr std::string_view kVersion = \"${PROJECT_VERSION}\";\ninline constexpr std::string_view kHash8 = \"${_ripwire_embed_hash8}\";\ninline constexpr std::string_view kStoreKey = \"${PROJECT_VERSION}-${_ripwire_embed_hash8}\";\n\n} // namespace rw::embedded_skills\n")
+
 # ---- generated version.h ----
 # The version string lives in ONE place: the project(ripwire VERSION ...) call above. --version reads
 # this generated header; test/versioncheck.sh diffs its output against CMakeLists.txt's own VERSION so

diff --git a/INSTALL.md b/INSTALL.md
@@ -17,8 +17,8 @@ The installer:
 - downloads the latest [GitHub Release](https://github.com/redhat-et/ripwire/releases) for your OS and CPU
   and verifies its SHA-256;
 - installs the binary to `~/.local/bin/ripwire`, with no sudo;
-- stages the agent skills and hooks under `~/.local/share/ripwire/`;
-- activates the skills for each agent it finds on the machine (Claude Code, Codex, and Hermes with
+- activates the skills and hooks embedded in the binary (nothing is staged on disk) for each agent it
+  finds on the machine (Claude Code, Codex, and Hermes with
   [initial support](#skills)) and prints one line per agent;
 - never registers hooks and never edits your shell profile.
 
@@ -40,7 +40,7 @@ reports x86-64; the installer sends it to a native arm64 shell, where the arm64
 | `RIPWIRE_INSTALL_PREFIX` | Install under this prefix instead of `~/.local`; the binary goes in `<prefix>/bin`. |
 | `RIPWIRE_INSTALL_YES=1` | Skip the confirmation prompt. |
 | `RIPWIRE_SKIP_CPU_CHECK=1` | Skip the x86-64-v3 CPU check. The binary is still test-run before it is installed. |
-| `RIPWIRE_NO_ACTIVATE=1` | Stage the skills without activating them. |
+| `RIPWIRE_NO_ACTIVATE=1` | Skip activation; run `ripwire skills install --all` later. |
 
 Then try it in a repository:
 
@@ -66,25 +66,29 @@ first command to build for that machine's own CPU, or use `./install.sh` below,
 
 To put a source build on your `PATH`, run `./install.sh` from the checkout. It builds a Release binary tuned
 for this machine's CPU in `build-install/` and installs it under `RIPWIRE_INSTALL_PREFIX`, or under
-`brew --prefix` when Homebrew is present, or else under `~/.local`. Like the prebuilt installer, it stages
-skills and hooks under `<prefix>/share/ripwire/` and activates the skills for Claude Code and Codex when it
-finds them. `RIPWIRE_NO_ACTIVATE=1` stages only; `RIPWIRE_ACTIVATE_CODEX=1` also registers the Codex hooks.
+`brew --prefix` when Homebrew is present, or else under `~/.local`. Unlike the prebuilt installer, this route
+still stages `skills/` and `hooks/` as separate files under `<prefix>/share/ripwire/`, and activates Claude
+Code and Codex (when it finds them) by running that staged `skills/install.sh`. `RIPWIRE_NO_ACTIVATE=1`
+stages the files without activating either agent; `RIPWIRE_ACTIVATE_CODEX=1` also registers the Codex hooks.
+The prebuilt release installer (`scripts/install.sh`) is the one with skills and hooks embedded in the
+`ripwire` binary itself — nothing staged — and its own `RIPWIRE_NO_ACTIVATE=1` skips activation outright
+(there is nothing to stage).
 
 ## Connect your coding agent
 
 ### Skills
 
 Skills tell an agent *when* to reach for which ripwire verb. The installers activate them for the agents they
-detect. To activate them yourself, run the staged skills installer (replace `~/.local` with your prefix if
-you changed it):
+detect. To activate them yourself (or re-activate after an upgrade), run `ripwire skills install` — replace
+`ripwire` with the absolute path to your binary if it is not on `PATH`:
 
 | Agent | Command | Links into |
 | --- | --- | --- |
-| Claude Code | `bash ~/.local/share/ripwire/skills/install.sh` | `${CLAUDE_CONFIG_DIR:-~/.claude}/skills` |
-| Codex | `bash ~/.local/share/ripwire/skills/install.sh --codex` | `${AGENTS_HOME:-~/.agents}/skills` |
-| Hermes (initial support) | `bash ~/.local/share/ripwire/skills/install.sh --hermes` | `${HERMES_HOME:-~/.hermes}/skills` |
-| openclaw (initial support) | `bash ~/.local/share/ripwire/skills/install.sh --openclaw` | `~/.agents/skills` |
-| Anything else | `bash ~/.local/share/ripwire/skills/install.sh <dir>` | `<dir>` |
+| Claude Code | `ripwire skills install --claude` | `${CLAUDE_CONFIG_DIR:-~/.claude}/skills` |
+| Codex | `ripwire skills install --codex` | `${AGENTS_HOME:-~/.agents}/skills` |
+| Hermes (initial support) | `ripwire skills install --hermes` | `${HERMES_HOME:-~/.hermes}/skills` |
+| openclaw (initial support) | `ripwire skills install --openclaw` | `~/.agents/skills` |
+| Anything else | `ripwire skills install <dir>` | `<dir>` |
 
 Hermes and openclaw support is initial. CI checks what the installers write on disk. For Hermes, a contributor
 also ran the installer and the MCP registration against a real Hermes install when support landed
@@ -100,11 +104,11 @@ itself.
 
 ### Advisory hooks (optional)
 
-`bash ~/.local/share/ripwire/skills/install.sh --hook` registers ripwire's advisory hooks for Claude Code in
+`ripwire skills install --claude --hook` registers ripwire's advisory hooks for Claude Code in
 its `settings.json`: a SessionStart primer that adds ripwire's when-to-use guidance, a UserPromptSubmit router
 that suggests one ready-to-run command when it is confident, and a PreToolUse hook that suggests nothing and
-only records, on your machine, which tool calls ripwire could have answered. Adding `--codex --hook` does the
-same for Codex in `~/.codex/hooks.json`; open `/hooks` in Codex to review and trust them. The hooks never
+only records, on your machine, which tool calls ripwire could have answered. `ripwire skills install --codex
+--hook` does the same for Codex in `~/.codex/hooks.json`; open `/hooks` in Codex to review and trust them. The hooks never
 block a tool call, they need `jq`, and they are registered only when you pass `--hook`.
 
 ### MCP server (optional)
@@ -120,8 +124,8 @@ claude mcp add ripwire -- ripwire --mcp
 ## Check and upgrade
 
 `ripwire . --doctor` checks the install: the binary, the skills and the hooks. To upgrade, run the same
-install command again (pin a release with `RIPWIRE_VERSION`). It replaces the binary and the staged skills
-and refreshes their links.
+install command again (pin a release with `RIPWIRE_VERSION`). It replaces the binary and re-links the
+skills and hooks from the new binary's own embedded store.
 
 ## Uninstall
 

diff --git a/README.md b/README.md
@@ -962,9 +962,10 @@ ripwire --version
   `degraded="1"` and may report as failing even when `ripwire` is on `Path` (its PATH lookup is a known gap).
   The cache lives in `%LOCALAPPDATA%\Temp\ripwire-<uid>`.
 - **Agent skills** (Claude Code, Codex): from Git Bash, in the unzipped folder, `bash skills/install.sh` (Claude Code)
-  or `bash skills/install.sh --codex`. Or copy them by hand in PowerShell:
-  `New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Copy-Item -Recurse -Force "$bin\skills\ripwire-*" "$HOME\.claude\skills\"`
-  (Codex reads `$HOME\.agents\skills`). `--hook` is untested on Windows, and `scripts/install.sh` (the curl installer) does not run there.
+  or `bash skills/install.sh --codex`. Without Developer Mode / `SeCreateSymbolicLinkPrivilege`, `ripwire.exe` has no
+  symlink support and copies each skill's files instead of linking them — a later reinstall still refreshes them, it
+  just will not notice a store update on its own the way a symlink would. `--hook` is untested on Windows, and
+  `scripts/install.sh` (the curl installer) does not run there.
 </details>
 
 **Building it yourself needs CMake 3.24+ and a C++23 compiler, and nothing else installed first** —
@@ -1942,9 +1943,9 @@ wrong, and it has. These are the results that say so, all in-tree, all published
 ### In the tests
 
 <details>
-<summary><b>648 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
+<summary><b>651 gate scripts</b>, five contracts no unit test can hold, and the house rule: write the gate before the code it measures</summary> <!-- gatecount -->
 
-`test/regression.sh` names **648 gate scripts** and is the authoritative list; <!-- gatecount -->
+`test/regression.sh` names **651 gate scripts** and is the authoritative list; <!-- gatecount -->
 `python3 test/pargates.py . ./build/ripwire -j 6` runs the same set in parallel. On top of them sit the
 contracts that do not fit a unit test: two runs byte-identical, warm output identical to cold, output
 that pipes clean through `xmllint --noout`, a sanitizer build with `-fno-sanitize-recover=all`, and a