what: ship check-markdown.sh in skill payload, remove README curl step

what: add scripts/check-markdown.sh to RUNTIME_PAYLOAD_FILES so it
lands at ~/.hermes/skills/markdown-formatter/scripts/check-markdown.sh
after hermes skills install. No more curl/chmod manual steps.

why: the heredoc (previous fix) still required the user to mkdir,
curl, and chmod. Shipping the script in the tap payload eliminates
3 manual setup steps — only the config.yaml edit remains (and that
is architecturally unavoidable as user-level config).

Changes:
- runtime-payload.js: add scripts/check-markdown.sh to the 8-file
  payload allowlist
- sync-tap-payload.js: chmod the script on copy
- staged-install-verify.sh: replace blanket scripts/ exclusion
  with a targeted check for known payload scripts
- repo-shape.js: add payload path to expected shape
- runtime-payload.test.js: update expected array (7->8 files)
- README.md: replace curl block with note that script ships with
  the skill; update config.yaml path to skill path

Author: CodeSigils

README.md

@@ -190,31 +190,31 @@ Or run from source (no npm install):
 node src/index.js --fix --guard README.md
 ```
 
-For auto-wiring on every `write_file` or `patch` call, install a small hook
-wrapper:
+For auto-wiring on every `write_file` or `patch` call — the hook script ships with the
+skill. You just need to register it:
 
 ```bash
-mkdir -p "$HOME/.hermes/scripts"
-curl -sSLo "$HOME/.hermes/scripts/check-markdown.sh" \
-  "https://raw.githubusercontent.com/CodeSigils/zero-md-formatter/main/scripts/check-markdown.sh"
-chmod +x "$HOME/.hermes/scripts/check-markdown.sh"
+# The script is already at:
+#   ~/.hermes/skills/markdown-formatter/scripts/check-markdown.sh
+# No download needed.
 ```
 
 Then add the hook to `config.yaml`:
 
 ```yaml
 hooks:
   post_tool_call:
-    - command: ~/.hermes/scripts/check-markdown.sh
+    - command: ~/.hermes/skills/markdown-formatter/scripts/check-markdown.sh
       matcher: write_file
-    - command: ~/.hermes/scripts/check-markdown.sh
+    - command: ~/.hermes/skills/markdown-formatter/scripts/check-markdown.sh
       matcher: patch
 ```
 
 This runs `--check` (read-only) on every written Markdown file, blocking pipe
 hazards, fence errors, and formatting drift before they reach git. To
-auto-repair instead, edit `~/.hermes/scripts/check-markdown.sh` and change
-the `--check` flag to `--fix`.
+auto-repair instead, edit the script at
+`~/.hermes/skills/markdown-formatter/scripts/check-markdown.sh`
+and change the `--check` flag to `--fix`.
 </details>
 
 <details>

scripts/runtime-payload.js

@@ -9,6 +9,7 @@ const RUNTIME_PAYLOAD_FILES = [
   "guard/check-fences.js",
   "guard/check-tables.js",
   "guard/check-pipes.js",
+  "scripts/check-markdown.sh",
 ];
 
 module.exports = RUNTIME_PAYLOAD_FILES;

scripts/staged-install-verify.sh

@@ -14,7 +14,6 @@ mapfile -t RUNTIME_ALLOWLIST < <(node scripts/runtime-payload.js)
 # Define dev-only paths that MUST NOT appear in staged payload
 DEV_ONLY_PATHS=(
     "README.md"
-    "scripts/"
     "test/"
     ".github/"
     "skills/"
@@ -71,6 +70,19 @@ if [[ -d "$STAGE_DIR/.git" ]]; then
     VIOLATION_FOUND=true
 fi
 
+# Check for unexpected files in scripts/ payload directory
+declare -A PAYLOAD_SCRIPTS
+PAYLOAD_SCRIPTS["check-markdown.sh"]=1
+if [[ -d "$STAGE_DIR/scripts" ]]; then
+    while IFS= read -r -d '' f; do
+        name=$(basename "$f")
+        if [[ -z "${PAYLOAD_SCRIPTS[$name]-}" ]]; then
+            echo "❌ VIOLATION: Unexpected file in scripts/ payload directory: $name"
+            VIOLATION_FOUND=true
+        fi
+    done < <(find "$STAGE_DIR/scripts" -type f -print0)
+fi
+
 if [[ "$VIOLATION_FOUND" == true ]]; then
     echo ""
     echo "STAGED INSTALL VERIFICATION FAILED"

scripts/sync-tap-payload.js

@@ -20,7 +20,7 @@ for (const file of RUNTIME_PAYLOAD_FILES) {
   const destination = join(TAP_PAYLOAD_DIR, file);
   mkdirSync(dirname(destination), { recursive: true });
   cpSync(source, destination, { recursive: true });
-  if (file === "src/index.js") {
+  if (file === "src/index.js" || file === "scripts/check-markdown.sh") {
     chmodSync(destination, 0o755);
   }
 }

scripts/validators/repo-shape.js

@@ -32,6 +32,7 @@ const PLAN_EXPECTED_REPO_SHAPE = new Set([
   "skills/markdown-formatter/guard/check-structure.js",
   "skills/markdown-formatter/guard/check-tables.js",
   "skills/markdown-formatter/guard/check-pipes.js",
+  "skills/markdown-formatter/scripts/check-markdown.sh",
   "src/index.js",
   "src/format-content.mjs",
   "guard/check-fences.js",

skills/markdown-formatter/scripts/check-markdown.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Hermes shell hook: check Markdown files with mdfmt --check on write_file/patch
+#
+# Setup:
+#   mkdir -p "$HOME/.hermes/scripts"
+#   cp scripts/check-markdown.sh "$HOME/.hermes/scripts/"
+#   chmod +x "$HOME/.hermes/scripts/check-markdown.sh"
+#
+# Then add to ~/.hermes/config.yaml:
+#   hooks:
+#     post_tool_call:
+#       - command: ~/.hermes/scripts/check-markdown.sh
+#         matcher: write_file
+#       - command: ~/.hermes/scripts/check-markdown.sh
+#         matcher: patch
+set -eo pipefail
+
+payload="$(cat -)"
+file_path="$(echo "$payload" | jq -r '.tool_input.path // ""' 2>/dev/null)" || file_path=""
+
+[[ -z "$file_path" || ! -f "$file_path" ]] && printf '{}\n' && exit 0
+
+case "$file_path" in
+  *.md|*.markdown|*.mdx) ;;
+  *) printf '{}\n' && exit 0 ;;
+esac
+
+if command -v mdfmt &>/dev/null; then
+  mdfmt --check "$file_path"
+elif [[ -f "$HOME/.hermes/skills/markdown-formatter/src/index.js" ]]; then
+  node "$HOME/.hermes/skills/markdown-formatter/src/index.js" --check "$file_path"
+else
+  echo "[check-markdown] zero-md-formatter not found — skipping check" >&2
+fi
+
+printf '{}\n'

test/unit/runtime-payload.test.js

@@ -12,6 +12,7 @@ describe('runtime payload allowlist', () => {
       'guard/check-fences.js',
       'guard/check-tables.js',
       'guard/check-pipes.js',
+      'scripts/check-markdown.sh',
     ]);
   });
 });