refactor: keep root install as the sole installer source

.trellis/spec/backend/toolchain-and-library.md

@@ -30,7 +30,7 @@ Process main is separate from callable roots. Initialize Unix SIGPIPE policy bef
 
 ## 2. Signatures
 
-- First installation: root `install` supports `bash install` and `curl -fsSL https://git.dever.cc/shemic/dever/install | bash`, forwarding `--version`, `--release`, `--trusted-key`, `--system-root`, and `--no-start` to the existing Python installer. `python3 sdk/install-entry.py [--check]` generates/verifies the standalone Bash from `skills/scripts/install.py` and the independent public key. Keep one installation implementation.
+- First installation: root `install` is the sole installer source and supports `bash install` and `curl -fsSL https://git.dever.cc/shemic/dever/install | bash`. Its Bash entry forwards `--version`, `--release`, `--trusted-key`, `--system-root`, and `--no-start` to its embedded Python implementation. Maintain this file directly; skills provide guidance, not another installer, and there is no generation step.
 - Project creation: `dever new <new-directory> [--markdown]`; `project::create(&Path, bool)` consumes the single template source under the ordinary `skills/assets/template` directory in the same repository revision. The machine launcher selects the active core without reading nonexistent target configuration.
 - AI guidance: `dever skill path [project-root]` resolves and verifies the active or project-pinned release's `skills/dever-language`; `dever skill install <new-directory>` atomically publishes a stable loader that invokes the absolute machine launcher. Skill resolution is a public read-only operation and must not open the root-only install lock.
 
@@ -90,9 +90,9 @@ Authenticate the catalog before extraction. Zstandard is a single checksummed fr
 
 Shared extensions live in service-writable `cache/extensions/<version>/<catalog-sha>/<id>`, outside native cache eviction and immutable core directories. IPC accepts only version and typed ID for an already authenticated installed catalog, never caller URLs/paths/keys. Prepare under the persistent install lock in private staging, verify complete bytes then publish readonly with NOREPLACE; corrupted reuse is an error. `SignedResources` owns verified read/list/root selection for Lib, daemon runtime verification and the actual compile worker. `dever target add linux-aarch64` and explicit dependency preparation may ensure resources; ordinary run/build/read cannot. Update prepares precisely the old active version's installed extension selection before switching the one core/skill active journal; any failure preserves the old selection. Stable launcher/daemon protocol changes require matching trusted bootstrap provisioning. Do not rewrite users' skill directories or add an independently switched skill pointer.
 
-The skill's first-install helper uses its independently distributed public key, verifies the full package before executing bootstrap, and generates only an owned temporary installer config. The generated Bash entry embeds that same key and passes the original Python source through a quoted heredoc to `/usr/bin/python3 -I -`; parse the complete function before invoking it. Non-root installation uses `/usr/bin/sudo`; help must neither elevate nor download. Missing Python 3.9/OpenSSL, unsupported OS/ABI, unavailable package or invalid signature is an explicit failure. Current x86_64 host packages require glibc 2.39; ARM application support does not establish an ARM compiler-host release. The installer never reads business configuration. Real-root installation explicitly starts the machine service unless --no-start is selected; image-root verification must not touch host services. Python/OpenSSL are installer prerequisites, not application runtime dependencies. `sdk/release-assets.py` uses an explicitly supplied author zstd executable and publishes deterministic base/extension/raw assets with Linux NOREPLACE directory rename; it cannot clean another writer's public output.
+The root first-install script embeds its independently provisioned public key, verifies the full package before executing bootstrap, and generates only an owned temporary installer config. Its Bash entry passes the embedded Python source through a quoted heredoc to `/usr/bin/python3 -I -`; parse the complete function before invoking it. Non-root installation uses `/usr/bin/sudo`; help must neither elevate nor download. Missing Python 3.9/OpenSSL, unsupported OS/ABI, unavailable package or invalid signature is an explicit failure. Current x86_64 host packages require glibc 2.39; ARM application support does not establish an ARM compiler-host release. The installer never reads business configuration. Real-root installation explicitly starts the machine service unless --no-start is selected; image-root verification must not touch host services. Python/OpenSSL are installer prerequisites, not application runtime dependencies. `sdk/release-assets.py` uses an explicitly supplied author zstd executable and publishes deterministic base/extension/raw assets with Linux NOREPLACE directory rename; it cannot clean another writer's public output.
 
-Web publication must explicitly serve the generated script at `/shemic/dever/install` and all assets as anonymous HTTPS, independently of source repository access. Redirects are restricted to HTTPS `git.dever.cc` with no credentials, non-443 port or fragment. Publish all immutable version assets before switching latest metadata. Source pushes and local transport tests do not prove public download readiness. Changing the official origin requires rebuilding the stable launcher/daemon and provisioning them once through the new installer; ordinary update activates version payloads but does not replace that bootstrap pair. Never relabel old binaries as a new release.
+Web publication must explicitly serve the root script at `/shemic/dever/install` and all assets as anonymous HTTPS, independently of source repository access. Redirects are restricted to HTTPS `git.dever.cc` with no credentials, non-443 port or fragment. Publish all immutable version assets before switching latest metadata. Source pushes and local transport tests do not prove public download readiness. Changing the official origin requires rebuilding the stable launcher/daemon and provisioning them once through the new installer; ordinary update activates version payloads but does not replace that bootstrap pair. Never relabel old binaries as a new release.
 
 Native author settings use `dever-native-release-input-v1`: version/target/signing_key, core and `core_libraries` inputs, required base/sqlite/postgres/both archive inputs, and ordered start/libraries/end. Input `source` is a normalized author-relative path and `sha256` is the exact lowercase digest; link inputs also specify the destination `path`. Core libraries use plain SONAME filenames and publish below `lib/`; runtime link inputs remain runtime-relative. Reuse the runtime v1 manifest types and validator. Copy into exclusively owned private staging, verify both source and copied digest, sort manifest artifacts, and sign those exact bytes with the supplied owner-private Ed25519 PKCS#8 key. Reject key content as payload, symlinks, path escape and reserved/duplicate destinations. Keep source paths, key material and timestamps out of release metadata. Linux publication uses atomic NOREPLACE; failures clean only owned staging. No tool invocation, environment configuration, downloads, input hard links or implicit trust-key installation belongs to this owner.
 
@@ -247,7 +247,7 @@ Create a response-body cancellation owner only after the pending-to-committed st
 
 - New target already exists (including empty directory or dangling symlink), parent is missing, or two creators race: explicit error for the loser; preserve the existing target and remove only owned staging.
 - Signature/payload/skill corruption, incomplete archive or absent official asset: explicit failure, no active-version switch or fallback. Publishing source code is not evidence that a downloadable binary release exists.
-- Truncated Bash body: no installer or sudo execution. Missing prerequisites: fail before metadata download. Failed authentication through Bash: preserve existing active journal/core/bootstrap and clean only owned staging. Generated entry drift: `sdk/install-entry.py --check` fails. Successful same-version bootstrap may append an activation record; assert selected-version identity rather than a byte-identical journal.
+- Truncated Bash body: no installer or sudo execution. Missing prerequisites: fail before metadata download. Failed authentication through Bash: preserve existing active journal/core/bootstrap and clean only owned staging. Tests load the embedded Python from the actual root entry and exercise Bash file/pipe execution; retain a check against the independently provisioned public key. Successful same-version bootstrap may append an activation record; assert selected-version identity rather than a byte-identical journal.
 - Project has a pinned version: `skill path <project>` resolves that exact installed version. Foreign users must read matching guidance without obtaining the administrator install lock.
 
 Cross build: unknown/duplicate/missing target arguments fail before execution; absent target packs, wrong ELF/archive machine, unsigned target leaves, incompatible lock/runtime/build receipt and changed target inputs fail before cache reuse or linking. Sandbox loader mode must survive both release packing and embedding; a hash-valid non-executable loader is not a usable Worker resource.
@@ -346,7 +346,7 @@ Managed base: a zero-Lib Python/JavaScript Adapter still locks its signed runtim
 
 For onboarding select CLI `new_project`, lib `release_source`, shared-toolchain version/skill tests and native-release skill authoring tests, plus `python3 -B -m unittest discover -s test/onboarding -v`. Assert both formats check/format, no-overwrite concurrency, real CMD/Test/build output, exact signed extraction, corrupt-download retention, project-pinned guidance and foreign-user reads. The foreign-user test lowers only an owned client UID. Bootstrap script tests mock final installation; report that separately from real native-template execution. Do not activate host services or run full release/CI suites as an onboarding check.
 
-For installer-only changes select `test_install*.py`, `toolchain::release_source` and generator `--check`. Assert actual Bash file/pipe help, isolated Python, literal argument/exit-status preservation, non-root sudo dispatch, independent-key authentication, new origin paths and rejected redirects. `verify_install_entry.py` is an opt-in actual signed-payload check: source-free entry, image-only first install, repeat install and corrupt-signature preservation. It uses an existing authenticated release/extractor and no host services; old payloads do not establish new-binary or online update acceptance.
+For installer-only changes select `test_install*.py` and `bash -n install`; also run `toolchain::release_source` when its Rust download owner changes. Assert actual Bash file/pipe help, isolated Python, literal argument/exit-status preservation, non-root sudo dispatch, independent-key authentication, new origin paths and rejected redirects. `verify_install_entry.py` is an opt-in actual signed-payload check: source-free entry, image-only first install, repeat install and corrupt-signature preservation. It uses an existing authenticated release/extractor and no host services; old payloads do not establish new-binary or online update acceptance.
 
 Cross-target changes cover `build_arguments`, native-release target/ELF/mode cases, CompileRequest validation, cache isolation and Lib/Worker target selection. The opt-in `signed_host_compiler_builds_arm_profiles_and_runs_standalone_under_qemu` and `signed_arm_ecosystems_build_offline_standalone_apps_for_system_guest` require explicit author inputs. Run exported Workers/HTTP with `test/ecosystem-release/arm64/simulate.py` under a complete ARM kernel; assert each successful output, source-located expected failure and child cleanup. Do not substitute QEMU user emulation for namespace/seccomp execution or infer physical ARM performance.
 
@@ -406,7 +406,7 @@ Command execution observes guard exec through a private CLOEXEC pipe. Bind the P
 
 Wrong: update a skill symlink separately after changing the active core, treat a cached older version as a successful failed update, or delete a public output tree after a publication race. Correct: resolve core and signed skill from one active journal, return the original download failure, and publish exclusively owned staging with NOREPLACE.
 
-Installer wrong: hand-edit generated install logic, take its key from the downloaded package, or assume changing Git remote changes an old launcher. Correct: regenerate from the canonical installer and independent key, then migrate the stable bootstrap pair with a newly built signed release.
+Installer wrong: recreate a separate skill installer or generator, take its key from the downloaded package, or assume changing Git remote changes an old launcher. Correct: maintain the sole root install source with its independent key, verify its actual Bash behavior, and migrate changed stable bootstrap binaries through a newly built signed release.
 
 Cross-target wrong: check ELF headers but use the host loader name to assign executable mode. Correct: validate target architecture and independently preserve each declared executable's mode across signed packaging, embedding and extraction; exercise the resulting Worker bootstrap under the target kernel.
 

.trellis/tasks/10-05-install-entry/design.md

@@ -2,9 +2,9 @@
 
 ## 唯一安装实现
 
-保留 skills/scripts/install.py 的下载、签名校验、raw launcher 校验与 Rust 解压/bootstrap 调用链。sdk/install-entry.py 从该源码和 skills/assets/release.pub 生成根 install。Bash 只负责 Python 前提检查、必要的 sudo 和把完整 Python 程序通过引用 heredoc 交给 /usr/bin/python3 -I -，参数原样转发。完整函数定义在最后调用前解析，截断的主体不执行安装。
+2026-10-05 用户在合仓后明确要求只保留根 install，取代之前的 skill安装器加生成器方案。根 install 直接维护既有下载、签名校验、raw launcher 校验与 Rust 解压/bootstrap 调用链。Bash 只负责 Python 前提检查、必要的 sudo 和把内嵌 Python 程序通过引用 heredoc 交给 /usr/bin/python3 -I -，参数原样转发。完整函数定义在最后调用前解析，截断的主体不执行安装。
 
-生成器注入独立固定公钥而不是从下载包取公钥；源 skill 的普通 Python 调用仍使用配套公钥文件。Python main 接受内嵌默认公钥参数；具体嵌入使用清晰的源码封装，避免手工复制第二份算法或脆弱的源码字符串替换。
+根脚本内嵌独立固定公钥，不从下载包取公钥；显式 --trusted-key 仍支持已独立确认的自有签名包。删除双入口专用的生成包装和skill相对路径。普通测试与发行验收统一消费根 install；测试用加载器只读取实际内嵌源码，不保存第二份安装实现、不成为生产依赖。
 
 默认版本 latest；元数据为 dist/latest/dever-<platform>.manifest.json 与 .sig；验签后只从 dist/<signed-version>/ 获取基础 archive、raw blobs 和扩展。Rust ReleaseSource 与 Python 使用同一静态协议。只允许官方 HTTPS 同站重定向，禁止凭据、非 443、fragment 和外站。没有环境变量/项目配置覆盖和旧源 fallback。
 

.trellis/tasks/10-05-install-entry/implement.md

@@ -68,3 +68,16 @@
 ### 待上线的唯一交付阻塞
 
 2026-10-05最后复核，`https://git.dever.cc/shemic/dever/install` 与 `/shemic/dever/dist/latest/dever-linux-x86_64.manifest.json` 均为HTTP404。已向用户询问SSH主机、端口、账号与静态目录，或既有部署配置位置；目前仅有Git SSH访问，不能据此推定服务器shell/路由配置。发布时将上述public目录映射至 `/shemic/dever/`，然后在自有隔离安装中验收真实HTTPS首装与update。部署完成前不归档、不标为全部交付完成。
+
+### 合仓后的安装入口清理（用户新增授权）
+
+用户确认只保留根install。旧设计中skill安装器作为源码、根入口作为生成物的约定被替代；前述发行验收是历史证据，不能据此宣称本次改动已验证。
+
+- 实现边界：根install成为唯一安装源码，删除 `skills/scripts/install.py` 和 `sdk/install-entry.py`，迁移根test/onboarding内的测试和发行验收调用，更新当前安装指引与规范。
+- 保持固定下载源、独立公钥、验签/路径/摘要校验、Rust解压及bootstrap、失败清理、Bash参数传递/提权/截断保护。仅移除双入口专用逻辑，不修改Rust或已签名0.1.2发行资产，不运行全量或全局服务验证。
+- trellis-implement负责安装脚本和测试；主会话负责指引、规范、任务记录，完成后独立检查实际diff与定向证据。
+- 原19项安装定向测试19/19通过，无跳过；保留文件/管道help、字面参数与退出码、隔离Python、真实非root UID的sudo截获、截断不执行、默认官方公钥拒绝自签包、显式可信key接受及篡改拒绝/清理。三个发行验收脚本的导入/help、Bash语法、skill结构、diff和旧活动引用扫描通过。
+- 主会话补验真实Bash签名/清理1/1通过。首次补验因根盘满在fixture创建阶段失败，改为仅本测试进程的 `/dev/shm` 临时目录后通过，未修改产品环境或增加环境变量配置。
+- 删除旧安装器的Python缓存及空 `skills/scripts/` 目录；源码可从Git历史恢复。为提交空间删除本轮 `target/release-0.1.2/tools/dever-core` 编译器副本（16,956,160字节，摘要已核对）；完整同字节核心仍保存在签名基础包，可由已有解包器恢复，其余工具与签名资产保留。
+- 新根install为13,632字节，SHA256 `2b07829c7c7c7d76b8fd257239b4ab44816e064951f66e33ffd6e2bdcfce92ef`。已制作的0.1.2版本/tag及签名包仍固定在原产品提交19f122b；本次未重新发行，不把旧安装验收报告当成新脚本的验收报告。
+- 待部署的 `target/release-0.1.2/public/install` 已同步新根入口并逐字节核对；dist签名资产未改。独立检查确认下载/验签等函数与原版本AST一致、Bash包装参数及尾部调用保持，未引入第二套生产安装实现；已清理规范中最后一处generator检查要求。

.trellis/tasks/10-05-install-entry/prd.md

@@ -19,7 +19,7 @@
 ## Acceptance Criteria
 
 - [x] Bash 语法、直接/管道 help、参数转发、退出状态、非 root 提权与截断脚本行为有最小定向验证。
-- [x] 生成物与现有安装器/独立公钥一致，不存在手工维护的第二套安装逻辑。
+- [x] 根 install 是唯一安装源码；删除skill安装器与生成器、迁移相关测试及验收调用，保留独立固定公钥和既有安装行为。（2026-10-05 合仓后用户修订）
 - [x] Python/Rust 新源 latest/精确版本/扩展地址一致，拒绝非法重定向。
 - [x] 真实 Ed25519 校验、损坏拒绝、临时文件清理保持通过；实际签名包可通过新入口安装到自有镜像，不启动宿主服务。
 - [x] 必要定向测试和 diff 检查通过，文档说明命令、发布目录、旧版迁移和线上未验证边界。