diff --git a/.husky/commit-msg b/.husky/commit-msg
index c676911..c9016ad 100755
--- a/.husky/commit-msg
+++ b/.husky/commit-msg
@@ -1,4 +1,4 @@
-# RuleOfCode v7.17.5 Commit Message Validation
+# RuleOfCode v7.17.6 Commit Message Validation
 # Config-driven validation with 1 pattern(s)
 # husky v9+ native hook (no deprecated v8 boilerplate)
 
@@ -28,7 +28,7 @@ fi
 if [ "$VALID" = false ]; then
     echo "❌ Invalid commit message format!"
     echo ""
-    echo "🏛️ RuleOfCode v7.17.5 Constitutional Commit Message Format:"
+    echo "🏛️ RuleOfCode v7.17.6 Constitutional Commit Message Format:"
     echo "   Your message must match one of the configured patterns"
     echo ""
     echo "Types: feat, fix, docs, style, refactor, test, chore, perf, ci, build, revert"
@@ -68,4 +68,4 @@ if [ "$EXEMPT" = false ]; then
     fi
 fi
 
-echo "✅ Commit message format validated (RuleOfCode v7.17.5)"
+echo "✅ Commit message format validated (RuleOfCode v7.17.6)"
diff --git a/.husky/pre-commit b/.husky/pre-commit
index 2749bf6..661415b 100755
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,5 +1,5 @@
-# RuleOfCode v7.17.5 Constitutional Checkpoint (husky v9+ native hook)
-echo "🏛️ RuleOfCode v7.17.5 Constitutional Checkpoint with lint-staged"
+# RuleOfCode v7.17.6 Constitutional Checkpoint (husky v9+ native hook)
+echo "🏛️ RuleOfCode v7.17.6 Constitutional Checkpoint with lint-staged"
 npx lint-staged
 
 # Run constitutional audit on staged files
diff --git a/.husky/pre-push b/.husky/pre-push
index c42c80a..54a4fc3 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,5 +1,5 @@
-# RuleOfCode v7.17.5 Constitutional Compliance Pre-Push Hook (husky v9+ native)
-echo "🏛️ RuleOfCode v7.17.5 Constitutional Checkpoint - Pre-Push Mode"
+# RuleOfCode v7.17.6 Constitutional Compliance Pre-Push Hook (husky v9+ native)
+echo "🏛️ RuleOfCode v7.17.6 Constitutional Checkpoint - Pre-Push Mode"
 echo "═════════════════════════════════════════════════════"
 
 # Run full RuleOfCode audit before push
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9b3848..7cb2ee5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,50 @@ All notable changes to RuleOfCode will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.17.6] - 2026-08-08
+
+### 🐛 Fixed — the hook executable bit is read from the git index, not the filesystem
+
+Git Hook Compliance called **every hook of every Windows project** non-executable, and
+the consumer could not act on it. NTFS carries no POSIX execute bit: `fs.stat().mode` is
+`0o666` for every file there and `chmod` is a no-op, so `chmod +x` — the fix the law
+printed — changes nothing. It also judged files git never runs: husky keeps
+`.gitignore`, `husky.sh` and `h` in its hooks directory.
+
+The bit now comes from the **git index** (`100755` / `100644`), which answers the same
+question identically on every platform and only for files a consumer can commit a mode
+for. Untracked hooks are not judged at all — husky ignores its generated `_` directory
+wholesale, so no mode exists there for anyone to set. Only names git actually runs as
+hooks are considered.
+
+**The concern behind the law was real and is kept.** Hooks committed at `100644` are not
+executable when the repository is cloned on Linux. The committed layout is
+`.husky/<hook>`, not the resolved hooks directory, so the check reads both — removing
+the false positive without removing the true one. The suggestion is now actionable:
+`git update-index --chmod=+x <path>`.
+
+Three new `detectionLimits` entries declare what is consequently **not** checked.
+
+If a Windows build was failing this law, this is the fix — no config change needed.
+
+### 🔒 Security — dependency lockfile refreshed
+
+Development installs pinned minimatch 9.0.5, brace-expansion 2.0.2 and lodash 4.17.21 —
+three high-severity advisories between them. **Consumers were never exposed**: the
+package's caret ranges resolve the patched versions on a fresh install, verified against
+the published tarball. Only this repository's lockfile was stale, which meant CI tested
+against vulnerable dependencies. `npm audit` now reports zero.
+
+### 📄 Documentation — the law card schema
+
+`roc laws --json` exposes two fields that look like one vocabulary and are not: `stack`
+answers **selection** (does this law run here), a `satisfiedBy` key answers **guidance**
+(which technology the instructions are written for). They are orthogonal — no key maps
+onto a single stack, and `angular` sits on TypeScript-stack and universal laws too. The
+README now documents both axes and points renderers at `satisfiedByStacks.stackToKey`,
+which the JSON already shipped undocumented. It also states plainly that all 58 frontend
+laws carry Angular guidance only.
+
 ## [7.17.5] - 2026-08-08
 
 ### 🐛 Fixed — three git laws were blind to linked worktrees
diff --git a/package.json b/package.json
index ddf5c90..ea04ef1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ruleofcode",
-  "version": "7.17.5",
+  "version": "7.17.6",
   "description": "Constitutional-compliance CLI — audit a codebase against a catalog of laws and get one honest pass-or-fail verdict, with git hooks. Supports TypeScript, Angular and Python.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/src/hooks/installer.ts b/src/hooks/installer.ts
index 7f460bd..4032640 100644
--- a/src/hooks/installer.ts
+++ b/src/hooks/installer.ts
@@ -17,7 +17,7 @@ export interface HooksInstallOptions {
 }
 
 export class GitHooksInstaller {
-  private static readonly VERSION = '7.17.5';
+  private static readonly VERSION = '7.17.6';
   private static readonly PACKAGE_JSON_FILE = 'package.json';
   private static readonly HUSKY_DIR = '.husky';
   private static readonly PRE_COMMIT_HOOK = 'pre-commit';