The tool contract

Each tool is zero/tools/<category>/<tool>/install.sh, exporting exactly:

install_<tool>()      # install + verify the binary runs
update_<tool>()       # re-resolve latest and update
reinstall_<tool>()    # uninstall + install
uninstall_<tool>()    # remove only what was created
_<tool>_dependencies() # deps installed first

• Install = verify. The final step confirms the command exists; fail loudly otherwise.
• Update = re-resolve latest. Rolling tools must not be pinned.
• Uninstall = clean. Remove only what the tool created.
• Wire the tool into the category dispatch (zero/modules/<cat>.sh), write a README.md, test all four verbs, regenerate site data.

Version policy

• Rolling user-facing tools → latest (npm @latest, GitHub /releases/latest); no stale fallbacks.
• Pins only for build-critical/source-tag cases, each with # Zero-Termux: justified pin — <reason> plus a manifest entry in scripts/validation/version-pin-check.sh. CI fails on unapproved pins.
• Debian Version: is the package revision — not the tool version.

Packages

• packages/<name>/DEBIAN/{control,preinst,postinst,postrm}; Maintainer: Vaizer0, Architecture: all, every runtime dependency in Depends.
• postinst builds the tool from its official source and exposes the command via a $PREFIX/bin symlink. Don't mutate $PATH. Data may go under $PREFIX/share / $PREFIX/lib; themes/shell configs may write $HOME — document it and mirror it in postrm.
• Keep DEBIAN/ dirs and scripts executable — build-repo.sh normalizes only DEBIAN dirs; never blanket-chmod package trees.
• Add the package to assets/PACKAGES.md under the right category and regenerate site data.

Validation (all run in CI)

Check	Script	Fails on
Packages	validate-packages.sh	missing control fields, dupes, non-executable scripts
Branding	branding-check.sh	old-brand references outside the allowlist
Version pins	version-pin-check.sh	pins without a justified manifest entry
Stale URLs	stale-url-check.sh	dead upstream URLs
Docs/site	doc-links-check.sh	broken links, stale counts, unwanted URLs, wrong install command

Local run: bash -n everything, then for s in scripts/validation/*.sh; do bash "$s"; done, then python3 scripts/site/generate-data.py.

Pull requests

1. Branch from main: git checkout -b <scope>/<summary> main.
2. One logical change per commit; message style type(scope): summary.
3. Run the validators and fix failures in the same PR.
4. Never weaken validation to get CI green. Don't commit build artifacts or key material.