packaging: one paste installs telltale on Windows, and says the binary is unsigned

[sanlee-ys]

What a user can now do

Paste one line into PowerShell and have telltale on PATH:

irm https://raw.githubusercontent.com/sanlee-ys/telltale/main/packaging/install.ps1 | iex

It is the third Windows route and the only one that needs nothing installed
first. scoop and winget both assume the reader already has the package
manager. A reader with neither had two choices: unpack an archive by hand, or
build from source.

What it verifies, and what it refuses to claim

The script downloads the archive and checksums.txt, compares the SHA-256
before it unpacks anything, and deletes the download on a mismatch. It
then prints, in its own output rather than only in a document nobody reads at
install time, that the binary carries no Authenticode signature and that the
checksum proves what the workflow built and not who built it. That is
design.md §8 item 8 restated at the one moment the reader can act on it.

The script signs nothing and prepares no signing pipeline. No brew tap, no
npm, no winget automation. Each of those is ruled elsewhere and a one-paste
installer is not an argument to revisit any of them.

Three refusals live in the script rather than in a note: a non-AMD64
machine, a tag with no published release (named with the URL that 404'd), and
a checksums.txt with no entry for the archive.

Verified LIVE, 2026-08-18, against the published v0.2.0

• PowerShell 7.6.5 and Windows PowerShell 5.1.26100.9168. Both
  installed telltale_0.2.0_windows_amd64.zip, both computed
  7a2401aa…33772528, and that equals the digest GitHub reports for the
  asset. The installed binary answers telltale 0.2.0.
• The irm | iex shape, exercised as Get-Content -Raw | Invoke-Expression.
  The calling shell survived: the script throws and never calls exit.
• The PATH branch, driven once against the real user variable and restored
  byte for byte. It also measured the one surprise, now recorded: the
  directory is appended, so a telltale.exe already earlier on PATH
  goes on winning.
• Two refusals end to end, installing nothing: the arm64 refusal, and
  TELLTALE_VERSION=v0.1.0 against the tag that has no release.
• telltale doctor on this box, twice, for the troubleshooting table below:
  once with all five vendors resolvable, once with a stripped PATH.

Recorded as debt, not claimed: the mismatch refusal has no end-to-end live
trial, because driving it needs a host that serves a corrupted archive. Its
comparison was measured live instead (the real checksums.txt parsed, a byte
appended to the real archive, the hashes differed); the three lines that act
on that result are unexercised. STATE.md carries it as a known gap and
design.md §8 carries the record.

First five minutes

README.md gains a troubleshooting table. Every row is keyed to a line
telltale doctor actually prints, taken from the two runs above — including
the one a stranger meets first: 0 checks passed with no vendor CLI
installed, which is the preflight working rather than telltale failing.

The gate

ci.yml parses install.ps1 under Windows PowerShell 5.1 on every push,
rejects any byte at or above 0x80, and rejects an exit statement. It never
executes the script, because executing it would download a release on every
push.

That gate exists because the trap bit during this work: 5.1 reads a BOM-less
file as ANSI, so one em dash inside a throw produced four parser errors
under 5.1 while pwsh 7.6.5 read the same file fine. The ASCII arm was measured
non-vacuous — one em dash appended to a copy, and the gate reported three
bytes and failed.

The playbook, recorded and not executed

design.md §8 gains a dated amendment for the launch cadence, because this
repo rejects unrecorded strategy and every piece of it is an owner action on a
surface outside this repository:

• Directory listings take winget's ruling — a human action, never
  automated, never opened by a contributor session. The README badge slot
  fills only after a listing merges.
• One Show HN per versioned feature, with one binding limit: §8 item 2
  pins the launch to ONE hypothesis, so a serial cadence must not quietly
  widen that claim.
• Publish the run-evidence bar. §8 item 2 already fixes the KIND of
  evidence. The threshold is NOT taken here: the sweep proposed "10 runs
  in 30 days", that number has no measurement behind it, and adopting it would
  be the invented figure ADR-001 refuses. The count and the window are the
  owner's to name.

README.md gains a badge slot and a hero slot with their rules written in.
The badge slot holds one badge, the CI result, which is GitHub rendering
GitHub's own run. A star, download or install count never lands there:
telltale measures none of them.

Gates

go vet ./... clean. go test ./... -timeout 20m green, all 35 packages,
exit 0 (internal/council 368.8s). No Go file changed.