automaton/tasks/fix-install-update-flow/VERDICT.md

VERDICT: fix-install-update-flow

Task

Fix 5 issues in the install/update flow: hardcoded git URL, .venv cwd bug, Windows venv path, hook copy-vs-symlink inconsistency, and missing --version smoke test.

Deliverables Review

Requirement	Status	Evidence
R1: User-supplied git URL (D11)	DONE	install.sh GIT_URL="${1:-}" with usage and irreversibility warning, 4 tests
R2: Fix .venv cwd bug	DONE	Venv in $FRAMEWORK_DIR/.venv, requirements.txt from $FRAMEWORK_DIR, 4 tests
R3: Windows venv path	DONE	Platform-aware VENV_PY detection, -m pip, 4 tests
R4: Hook copy-vs-symlink	DONE	update.sh and upgrade.sh use cp + chmod +x, 6 tests
R5: --version smoke test	DONE	status.py --version after install, 1 test
R6: Tests	DONE	15 tests in tests/test_install_update_flow.py, all passing
R7: Documentation	DONE	CHANGELOG and README updated

Quality Assessment

• Test coverage: 15 new tests, all passing. Full suite 424 passed (was 409). No regressions.
• Shell syntax: bash -n passes for all 3 scripts.
• Security: No hardcoded URLs. No shell injection vectors. No path traversal.
• Backward compat: Existing users with symlinked hooks can re-run install-hooks.sh to switch to copies.
• Documentation: README and CHANGELOG accurate.

Verdict

APPROVED -- ready for complete.

All 7 requirements fully implemented, tested, and documented. The install/update flow is now portable, secure, and consistent.