diff --git a/.pre-pull-backup/agent/managed-skills/command-center-dotfiles-import/SKILL.md b/.pre-pull-backup/agent/managed-skills/command-center-dotfiles-import/SKILL.md deleted file mode 100644 index e06cfd9..0000000 --- a/.pre-pull-backup/agent/managed-skills/command-center-dotfiles-import/SKILL.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -name: command-center-dotfiles-import -description: Runbook for importing client env-layer configs into the command-center repo and deploying them via stow on new fleet machines; decisions agreed with Frank 2026-09-09 (pre-execution — verify execution state before assuming done). ---- - -Design agreed with Frank for importing client application/environment configs into the `~/.omp` command-center repo and deploying them on fresh machines. **Status: plan agreed, not yet executed** — check repo state (does `dotfiles/` or `scripts/deploy.sh` exist?) before re-deriving; if already implemented, this becomes the operating model, not a to-do. - -## Agreed decisions (each was an explicit user choice) -1. **Target**: unknown/TBD fresh machine → design stays host-agnostic; deploy derives overrides from `$(hostname)` at run time. Nothing hardcodes a target. -2. **Scope**: environment layer only — niri (+cfg includes), gtk-3.0/4.0 settings, ghostty, alacritty, shell rc files (`.zshrc`, `.bashrc`, `.profile`, `.p10k.zsh`), fish, systemd user units, autostart, dconf. App *data* (browser profiles, vaults, DBs) never imported. -3. **Layout**: stow-style package dirs `dotfiles//` inside the repo; repo clones to `~/.omp` on every host that runs the harness (full command-center clone, not env-layer only). -4. **Deploy mechanism**: symlink farm — `stow -t ~` from `~/.omp/dotfiles`; relative symlinks within `$HOME` work because repo root lives inside `$HOME`. -5. **Dogfood order**: convert the workstation itself (real dirs → symlinks via adopt) BEFORE any target import; iterate where the compositor reload is observable. -6. **Secrets policy**: never commit secret values. Split rc files into committed logic + untracked sourced-if-exists stub (`~/.config/environment.d/secrets.env` or `.zshrc.local`); real values provisioned out-of-band only on machines that need them. Pre-commit secret scanner stays as safety net, not gate of first resort. -7. **Divergence**: `zz-` override package stowed LAST with `--override`; only per-host diffs live there. (Stow descends into conflicting symlinked dirs — per-file overrides only work via this last-stowed `--override` pattern.) -8. **Deploy trigger**: explicit `scripts/deploy.sh` invocation, human- or agent-invoked. NO auto-deploy on pull — pull and deploy are separate decisions; `--check` = drift report mode. -9. **Ownership**: Frank is sole push authority; exactly one editing agent at a time → no multi-writer race machinery needed. Each host's agent edits only its own `zz-` package. -10. **Conflict policy**: pre-existing regular file that differs from repo truth → move to timestamped `.quarantine/` dir on the target (never `rm`, same convention as this repo's trash rule), symlink anyway, print every replacement in deploy output and `--check` report. Repo truth always wins; divergence recoverable from quarantine. -11. **First-clone auth**: human types credential once console-side (URL-with-token or prompt); the new machine's secrets exist only there afterward. - -## Implementation gotchas baked into the design -- `core.hooksPath` is a per-clone local setting — does NOT survive clone; bootstrap/deploy must set it on every fresh clone or the secret-gate pre-commit hook silently doesn't run there. -- dconf/gsettings are databases, not files: import as `dconf dump /` text into repo; deploy runs `dconf load` instead of symlinking. -- p10k installer and toolchain hooks append to rc files at install time — expect conflicts on `.zshrc`-class files at first adopt; quarantine-and-replace handles it, but diff live-vs-repo before adopting so pre-existing drift is seen, not silently adopted. -- Known secret at import time: `GITEA_TOKEN` export lived in `.zshrc` (line ~22) on the workstation — quarantine BEFORE importing rc files; consider token rotation at cutover since it had been exposed in plaintext rc + remote URL. - -## Deploy script spec agreed -`scripts/deploy.sh`: sets hooksPath → stows all base packages → stows `zz-$(hostname)` with `--override` → first run uses `--adopt` for pre-existing identical files → divergent files quarantined-and-reported; `--check` mode emits drift report (modified tracked files vs deployed symlinks) without mutating. diff --git a/.pre-pull-backup/agent/managed-skills/stash-supersession-audit-before-drop/SKILL.md b/.pre-pull-backup/agent/managed-skills/stash-supersession-audit-before-drop/SKILL.md deleted file mode 100644 index aebd555..0000000 --- a/.pre-pull-backup/agent/managed-skills/stash-supersession-audit-before-drop/SKILL.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -name: stash-supersession-audit-before-drop -description: "Before dropping a stale git stash, prove it's superseded by HEAD via per-file line-set diff of git show stash@{0}:file vs HEAD; archive as an annotated tag and drop only after auditing unique facts — zero-loss alternative to blind drop." ---- - -# Stash Supersession Audit Before Drop - -Use when a repo (especially a live-deployment checkout where the working tree IS the deployment, e.g. `~/.omp` command-center) has an old stash whose content may have been superseded by later commits, and dropping blindly risks losing unique facts. - -## Procedure - -1. **Inventory the stash** — see which files it touches: - ```bash - git stash show --stat stash@{0} - ``` -2. **Probe for unique content per file.** For each touched file, diff stash version against HEAD and count lines that exist only in the stash version: - ```bash - git show "stash@{0}:" > /tmp/stash_copy - # compare normalized line sets; report lines present in stash but absent from HEAD - ``` - A file with `unique-vs-HEAD = 0` is fully superseded — safe to drop for that file. -3. **Classify each unique-content hit**: - - *Stale fact* (superseded by a later refactor, e.g. old model/provider naming) → drop is correct. - - *Live durable fact* (e.g. an operational invariant never re-recorded) → extract it into the live memory/docs file or flag to the user before dropping. -4. **Archive before dropping** — zero-loss: tag the stash commit, then drop from the stash list: - ```bash - git tag archive/stash---wip "stash@{0}" - git stash drop "stash@{0}" - ``` - The tag pins the full stash object (including its index parent); recoverable later via `git show archive/stash-...` or `git checkout archive/stash-...^3 -- ` for the untracked-files third parent if present. - -## Why -Stashes are invisible in normal history and expire from reflogs (~90 days). A stash that *looks* superseded can still hold the only copy of a durable fact; tagging converts "drop" into a reversible archive with zero workflow cost. diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_0q858r.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_0q858r.jpg deleted file mode 100644 index fb80a96..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_0q858r.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:030e7f0af11a40cbd22b0237e58eaa968978086595f8e96b59a955d9d16defcc -size 6223683 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_1kdgpg.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_1kdgpg.jpg deleted file mode 100644 index 0c45676..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_1kdgpg.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:6f5af6ec67e6cb18b6b3bcadebb493fac218c63340ebee9923e686c4ff08c66b -size 9937848 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_28r759.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_28r759.jpg deleted file mode 100644 index ac2c8b9..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_28r759.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:683686e31a89b5805121de14a442ff5a3e3d2d3402d5bfa5a5aff113923d05f0 -size 797269 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4l6yvq.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4l6yvq.jpg deleted file mode 100644 index d9f71c5..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4l6yvq.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:275077b54fb350aeb824f28dea7f00b9a4c3a5e7de347154875563ca4a71906c -size 2116759 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4x17w3.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4x17w3.jpg deleted file mode 100644 index f30cc94..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_4x17w3.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:85daf09da70a40e207e90a395be6f41cc4819a8cf692a3255527035abe738a20 -size 7180914 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_6kzekl.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_6kzekl.jpg deleted file mode 100644 index cba9689..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_6kzekl.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:49e21bb223d0fdbf759919830065c8351c00e84417f571134b358767447b57b8 -size 1784886 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_73qev3.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_73qev3.jpg deleted file mode 100644 index d1ad729..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_73qev3.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:317ce45450649f67036d7438380f215d79f34e7a520e7edbaffd6908371c99f4 -size 335968 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_831k3y.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_831k3y.jpg deleted file mode 100644 index 4becd88..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_831k3y.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:9925a4098890fbcffc5797556e89d2019be5c2772649846e62cc3442cd80d88c -size 2140374 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_9m7vvx.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_9m7vvx.jpg deleted file mode 100644 index bd573ac..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_9m7vvx.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:ce48d344284fe97a9f05037907983412d726b8a3320493fb4ce58ce43b4bfaa0 -size 14109994 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_e7963w.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_e7963w.jpg deleted file mode 100644 index 823a9e1..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_e7963w.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:ddeb01436b6c33cadc3b1c55d9b88dd27b33a9e5c64035357ab72b5e5bb0e61f -size 9654852 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_g7r3vd.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_g7r3vd.jpg deleted file mode 100644 index fd7a210..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_g7r3vd.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:6b2c2e0f2c4ac98001ad4ca5df087c93c4b2283ae34564cde199154543b330d1 -size 2651295 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_l38ljr.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_l38ljr.jpg deleted file mode 100644 index 67f2f30..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_l38ljr.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:ca9826a61569625995e04f4045abd0bee8bb21761d4aefb2e8397eca555e3814 -size 1262942 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nro3qq.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nro3qq.jpg deleted file mode 100644 index 140df56..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nro3qq.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:a62c81d0de6e04eefba87235ea4a05221062519387af80aa3b600d9e591e424a -size 565479 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nzz3gy.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nzz3gy.jpg deleted file mode 100644 index 768ddc4..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_nzz3gy.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:2a51d455dde23686ad4d93701ec4d8720351eb83cac509205e82f53fa0842ea0 -size 784844 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_odl3r9.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_odl3r9.jpg deleted file mode 100644 index 0a413a2..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_odl3r9.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:b6c648158139ade45527839b11c9188da4a91a5785863ff4dd8d7ce96774d7ac -size 361938 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxex69.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxex69.jpg deleted file mode 100644 index 4097d05..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxex69.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:d04edfe13cebdf12a41a556bae1ea04f68b5b0582b05ddb55198ca7e9eb47d54 -size 619255 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxmpwl.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxmpwl.jpg deleted file mode 100644 index f745dcd..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_oxmpwl.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:73f7a68224df84bcdcabf7bebd1724f19bd8a3f7d2d388331af3c153b28ee060 -size 6927256 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_p8rzge.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_p8rzge.jpg deleted file mode 100644 index aed52ae..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_p8rzge.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:52d128f26bcbfba9dfa8f39c85f5ab23d1f15fb0bac317e7b09d17350e2980fd -size 8028011 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v93dk3.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v93dk3.jpg deleted file mode 100644 index 390d322..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v93dk3.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:9e337270aaea490ba193c240d705bbc6615d7f1f6f69300c91e7ebc8ab528b55 -size 2425046 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9e2w3.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9e2w3.jpg deleted file mode 100644 index dc7f9f5..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9e2w3.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:2d732352dff54efd7fa99f8980ff1cdf0104955338b60fb79c182262bfbb0788 -size 670009 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9w8r5.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9w8r5.jpg deleted file mode 100644 index 0acdbc6..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_v9w8r5.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:26949b998b4dce969199e9bae7999fae957a83f6593605b9cabf351ca5b095b2 -size 221479 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_y8ewzk.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_y8ewzk.jpg deleted file mode 100644 index e16cca4..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_y8ewzk.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:7aca0b84f82fcf785496061d4716b75b3fe07dfd77b817d252c2fa11484369b3 -size 1879777 diff --git a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_ymp267.jpg b/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_ymp267.jpg deleted file mode 100644 index 0537df5..0000000 --- a/dotfiles/noctalia/.local/share/noctalia/wallpapers/wallhaven_ymp267.jpg +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:6ce26ea77cc3811103188e16ca5b266ca09fc721dc2449615c11452362ea54d8 -size 3589820 diff --git a/home/dank/.omp/dotfiles/niri/.config/niri/cfg/autostart.kdl b/home/dank/.omp/dotfiles/niri/.config/niri/cfg/autostart.kdl deleted file mode 100644 index 1fea9d7..0000000 --- a/home/dank/.omp/dotfiles/niri/.config/niri/cfg/autostart.kdl +++ /dev/null @@ -1,4 +0,0 @@ -// ────────────── Startup Applications ────────────── -// https://github.com/YaLTeR/niri/wiki/Configuration:-Miscellaneous#spawn-sh-at-startup - - spawn-at-startup "noctalia" diff --git a/home/dank/.omp/dotfiles/niri/.config/niri/cfg/keybinds.kdl b/home/dank/.omp/dotfiles/niri/.config/niri/cfg/keybinds.kdl deleted file mode 100644 index 6e7de24..0000000 --- a/home/dank/.omp/dotfiles/niri/.config/niri/cfg/keybinds.kdl +++ /dev/null @@ -1,142 +0,0 @@ -binds { - - // ────────────── Keybindings ────────────── - // https://github.com/YaLTeR/niri/wiki/Configuration:-Key-Bindings - - // ─── noctalia-shell keybinds ─── - // https://docs.noctalia.dev/getting-started/keybinds/ - - Mod+Shift+Escape { show-hotkey-overlay; } - - // ─── Applications ─── - Mod+Return hotkey-overlay-title="Open Terminal: Ghostty" { spawn "ghostty"; } - Mod+CTRL+Return hotkey-overlay-title="Open App Launcher: noctalia launcher" { spawn-sh "noctalia msg panel-toggle launcher"; } - Mod+B hotkey-overlay-title="Open Browser: firefox" { spawn "firefox"; } - Mod+ALT+L hotkey-overlay-title="Lock Screen: noctalia lock" { spawn-sh "noctalia msg session lock"; } - Mod+Shift+Q hotkey-overlay-title="Session Menu: noctalia session" { spawn-sh "noctalia msg panel-toggle session"; } - - // Please choose your own file manager. - Mod+E hotkey-overlay-title="File Manager: Nautilus" { spawn "nautilus"; } - - // ─── Media Controls ─── - XF86AudioRaiseVolume allow-when-locked=true { spawn-sh "noctalia msg volume-up"; } - XF86AudioLowerVolume allow-when-locked=true { spawn-sh "noctalia msg volume-down"; } - XF86AudioMute allow-when-locked=true { spawn-sh "noctalia msg volume-mute"; } - XF86AudioMicMute allow-when-locked=true { spawn-sh "noctalia msg mic-mute"; } - XF86AudioNext allow-when-locked=true { spawn-sh "noctalia msg media next"; } - XF86AudioPrev allow-when-locked=true { spawn-sh "noctalia msg media previous"; } - XF86AudioPlay allow-when-locked=true { spawn-sh "noctalia msg media playPause"; } - XF86AudioPause allow-when-locked=true { spawn-sh "noctalia msg media playPause"; } - - // ─── Brightness Controls ─── - XF86MonBrightnessUp allow-when-locked=true { spawn-sh "noctalia msg brightness-up"; } - XF86MonBrightnessDown allow-when-locked=true { spawn-sh "noctalia msg brightness-down"; } - - // ─── Window Movement and Focus ─── - Mod+Q { close-window; } - - Mod+Left { focus-column-left; } - Mod+H { focus-column-left; } - Mod+Right { focus-column-right; } - Mod+L { focus-column-right; } - Mod+Up { focus-window-up; } - Mod+K { focus-window-up; } - Mod+Down { focus-window-down; } - Mod+J { focus-window-down; } - - // Win+Ctrl consume/expel windows to/from columns - Mod+CTRL+Left { consume-or-expel-window-left; } - Mod+CTRL+H { consume-or-expel-window-left; } - Mod+CTRL+Right { consume-or-expel-window-right; } - Mod+CTRL+L { consume-or-expel-window-right; } - Mod+CTRL+UP { expel-window-from-column; } - Mod+CTRL+K { expel-window-from-column; } - Mod+CTRL+Down { expel-window-from-column; } - Mod+CTRL+J { expel-window-from-column; } - Mod+Home { focus-column-first; } - Mod+End { focus-column-last; } - Mod+CTRL+Home { move-column-to-first; } - Mod+CTRL+End { move-column-to-last; } - - Mod+Shift+Left { focus-monitor-left; } - Mod+Shift+Right { focus-monitor-right; } - Mod+Shift+UP { focus-monitor-up; } - Mod+Shift+Down { focus-monitor-down; } - - Mod+Shift+CTRL+Left { move-column-to-monitor-left; } - Mod+Shift+CTRL+Right { move-column-to-monitor-right; } - Mod+Shift+CTRL+UP { move-column-to-monitor-up; } - Mod+Shift+CTRL+Down { move-column-to-monitor-down; } - - // ─── Workspace Switching ─── - Mod+WheelScrollDown cooldown-ms=150 { focus-workspace-down; } - Mod+WheelScrollUp cooldown-ms=150 { focus-workspace-up; } - Mod+CTRL+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; } - Mod+CTRL+WheelScrollUp cooldown-ms=150 { move-column-to-workspace-up; } - - Mod+WheelScrollRight { focus-column-right; } - Mod+WheelScrollLeft { focus-column-left; } - Mod+CTRL+WheelScrollRight { move-column-right; } - Mod+CTRL+WheelScrollLeft { move-column-left; } - - Mod+Shift+WheelScrollDown { focus-column-right; } - Mod+Shift+WheelScrollUp { focus-column-left; } - Mod+CTRL+Shift+WheelScrollDown { move-column-right; } - Mod+CTRL+Shift+WheelScrollUp { move-column-left; } - - Mod+1 { focus-workspace 1; } - Mod+2 { focus-workspace 2; } - Mod+3 { focus-workspace 3; } - Mod+4 { focus-workspace 4; } - Mod+5 { focus-workspace 5; } - Mod+6 { focus-workspace 6; } - Mod+7 { focus-workspace 7; } - Mod+8 { focus-workspace 8; } - Mod+9 { focus-workspace 9; } - - Mod+CTRL+1 { move-column-to-workspace 1; } - Mod+CTRL+2 { move-column-to-workspace 2; } - Mod+CTRL+3 { move-column-to-workspace 3; } - Mod+CTRL+4 { move-column-to-workspace 4; } - Mod+CTRL+5 { move-column-to-workspace 5; } - Mod+CTRL+6 { move-column-to-workspace 6; } - Mod+CTRL+7 { move-column-to-workspace 7; } - Mod+CTRL+8 { move-column-to-workspace 8; } - Mod+CTRL+9 { move-column-to-workspace 9; } - - Mod+TAB { focus-workspace-previous; } - - // ─── Layout Controls ─── - Mod+CTRL+F { expand-column-to-available-width; } - Mod+C hotkey-overlay-title="Calculator" { spawn "gnome-calculator"; } - Mod+CTRL+C { center-visible-columns; } - Mod+Minus { set-column-width "-10%"; } - Mod+Equal { set-column-width "+10%"; } - Mod+Shift+Minus { set-window-height "-10%"; } - Mod+Shift+Equal { set-window-height "+10%"; } - - // ─── Split / Consume / Expel ─── - Mod+Shift+H { consume-or-expel-window-left; } - Mod+Shift+L { consume-or-expel-window-right; } - Mod+Shift+J { expel-window-from-column; } - - // ─── Modes ─── - Mod+T { toggle-window-floating; } - Mod+F { fullscreen-window; } - Mod+W { toggle-column-tabbed-display; } - - // ─── Screenshots ─── - CTRL+Shift+1 hotkey-overlay-title="Screenshot: flameshot full" { spawn-sh "flameshot full"; } - CTRL+Shift+2 hotkey-overlay-title="Screenshot: flameshot screen" { spawn-sh "flameshot screen"; } - CTRL+Shift+3 hotkey-overlay-title="Screenshot: flameshot region" { spawn-sh "flameshot gui"; } - - // ─── Emergency Escape Key ─── - // Use this when a fullscreen app blocks your keybinds. - // It disables any active keyboard shortcut inhibitor, restoring control. - Mod+ESCAPE allow-inhibiting=false { toggle-keyboard-shortcuts-inhibit; } - - // ─── Exit / Power ─── - CTRL+ALT+Delete { quit; } // Also quits Niri - Mod+Shift+P { power-off-monitors; } // Turn off screens (useful for OLED or privacy) - Mod+O repeat=false { toggle-overview; } -} diff --git a/home/dank/.omp/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service b/home/dank/.omp/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service deleted file mode 100644 index ef5f63d..0000000 --- a/home/dank/.omp/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service +++ /dev/null @@ -1,18 +0,0 @@ -[Unit] -Description=swayidle idle lock (locks via noctalia-shell IPC, suspends on lid) -Documentation=https://github.com/swaywm/swayidle -After=graphical-session.target - -[Service] -# Locks via the noctalia v5 shell; `noctalia msg` resolves the running instance -# through the D-Bus session bus, so no WAYLAND_DISPLAY pinning is needed in unit context. -# deploy.sh enables it only where the ExecStart binary resolves, so it stays inert until swayidle is installed. -ExecStart=/usr/bin/swayidle -w \ - timeout 300 '/usr/bin/noctalia msg session lock' \ - before-sleep '/usr/bin/noctalia msg session lock' \ - after-resume '/usr/bin/noctalia msg session lock' -Restart=on-failure -RestartSec=5s - -[Install] -WantedBy=default.target diff --git a/omp-docs/log.md b/omp-docs/log.md index ec464bb..a7255a5 100644 --- a/omp-docs/log.md +++ b/omp-docs/log.md @@ -16,6 +16,32 @@ lesson, a few lines. Full incident narratives are recoverable from git (`git log --follow omp-docs/log.md`); knowledge that outlives an entry lives on its concept page, linked here. Never re-expand an entry in place. +## 2026-10-20 — the secret gate was reading the wrong files, and one credential had already escaped + +Found while deciding what else belongs in `dotfiles/`. (1) The gate whitelisted +extensions (`*.md *.yml *.json *.toml *.sh *.ts *.js`), so a `.env`, `.container`, +`.ini` or extension-less dotfile was never read — exactly the shapes the dotfiles +tier is made of. It now scans the whole staged diff for token shapes and, in +non-prose files, for credential assignments, and it fails closed when `git diff` +itself errors. That last clause earned its place: the rewrite's first attempt +passed `-I` to `git diff`, which is not valid there, got an empty file list, and +reported success on every commit — that is what a blind gate looks like, and it +looks identical to a clean tree. (2) A live credential had already escaped into +tracked content: a Caddy basicauth bcrypt hash, its plaintext password, and the +Pi-hole internal password, in an auto-learned memory file. Redacted — but both +credentials need **rotation**, because redaction does not un-leak history that +every machine has already pulled. (3) `home/dank/.omp/dotfiles/**` and +`.pre-pull-backup/**` were tracked fiction invisible to `deploy.sh`, and 23 +wallpaper JPEGs (80 MiB) rode along in every clone. Laws: a gate must fail closed, +since a silently-passing gate is worse than none — it buys the belief of safety; +auto-learned memory is written by a process that has read your terminal, so it is +a leak surface and gets gated like any config; `systemctl --user enable` +snapshots an absolute path, so enabling from a worktree means the seven-day reap +silently kills the unit while `is-enabled` goes on saying `enabled` +(`blankpad-desk-autoswitch.service` was dangling that way). Details: +[dotfiles-deploy](tools/dotfiles-deploy.md), +[home-config-census](inventory/home-config-census.md). + ## 2026-10-20 — engineering skills configured against this KB `setup-matt-pocock-skills` ran, and its output moved out of the skill's default diff --git a/omp-docs/tools/dotfiles-deploy.md b/omp-docs/tools/dotfiles-deploy.md new file mode 100644 index 0000000..0946003 --- /dev/null +++ b/omp-docs/tools/dotfiles-deploy.md @@ -0,0 +1,72 @@ +--- +type: reference +title: Dotfiles deployment tier +description: How dotfiles/ packages become live configuration — stow-equivalent symlinks, host override packages, and the two laws about theme media and systemd enable symlinks. +tags: + - dotfiles + - deployment + - systemd + - noctalia +timestamp: 2026-10-20 +verified: 2026-10-20 +--- + +# Dotfiles deployment tier + +`dotfiles/` holds home-relative trees and `scripts/deploy.sh` is a stow-equivalent: the +repo checkout **is** the deployment, and deploying replaces live files with symlinks into +the repo, so `git pull` + `deploy.sh` is the whole propagation story. One directory per +tool (`niri`, `ghostty`, `gtk-3.0`, `systemd-user`, …); a package named `zz-$(hostname)` +is stowed last and its files replace symlinks coming from base packages. + +| Mode | Effect | +|---|---| +| `deploy.sh --check` | dry run — adopts identicals, reports what would be linked, lists divergents, writes nothing. Run this first, always | +| `deploy.sh` (sync) | adopt identicals, link new, quarantine divergents into `.quarantine/` and replace them | +| `deploy.sh --adopt` | like sync, but divergents are reported and skipped rather than quarantined | + +Two package shapes are not symlinks: `dconf/dump.txt` is loaded with `dconf load /`, and +`systemd-user` units get `daemon-reload` plus `enable --now` only when their `ExecStart` +binary resolves on the current machine, so a unit belonging to another box stays inert +instead of crash-looping. + +**The tracked unit is the file, not the directory.** A live directory can be a real +directory and still be fully tracked, because every file inside it is a symlink into the +repo (`niri` is 12 tracked / 1 box-only; `gtk-3.0` is 3/0). Any audit that classifies by +directory mislabels the tree — classify per file with `readlink -f`. The live census and +its classifier command are in [home-config-census](/inventory/home-config-census.md). + +## Law: media the theme pipeline consumes is content, not config + +Wallpapers live at `dotfiles/noctalia/.local/share/noctalia/wallpapers/` and are +gitignored. They were tracked until 2026-10-20 — 23 files, 80 MiB — which meant every +clone of a *configuration* repo carried a media library no diff can review, and the +payload only ever grows because deleting a tracked blob from the tree does not delete it +from history. [Noctalia](noctalia-shell.md) reads +`~/.local/share/noctalia/wallpapers/`, which is a set of symlinks into that directory, so +the files stay on disk and untracking them broke nothing on this box. + +Restore on a fresh box: every filename is `wallhaven_.` and the ID is the whole +address — `curl -L -o "https://wallhaven.cc/w/"` puts the library back, then +`deploy.sh` relinks it. Losing the set is an acceptable outcome; 80 MB per clone forever +is not. + +## Law: never `systemctl --user enable` a unit from a worktree + +`enable` writes `~/.config/systemd/user/default.target.wants/` as a symlink to the +unit path it was handed, and that path is absolute. The heartbeat reaps `wt/*` worktrees +older than seven days ([live-sync](live-sync.md)), so a unit enabled from a worktree turns +into a dangling symlink while `systemctl --user is-enabled` still answers `enabled` — the +unit is dead and the status lies about it. Found on 2026-10-20: +`blankpad-desk-autoswitch.service` pointed into the reaped `wt/de-redesign-20261009`, so +desk auto-switching had been silently off since the reap. + +Check the link target before the unit file: + +```bash +ls -l ~/.config/systemd/user/default.target.wants/ +# every target must resolve; a dangling one is a reaped worktree, not a config bug +``` + +Fix is to relink into the deployment checkout (`~/.omp/dotfiles/…`), `systemctl --user +daemon-reload`, then confirm with `is-active` — `is-enabled` proves nothing. diff --git a/omp-docs/tools/index.md b/omp-docs/tools/index.md index b67c48d..820f9cb 100644 --- a/omp-docs/tools/index.md +++ b/omp-docs/tools/index.md @@ -9,6 +9,7 @@ Configuration guides and reference material for installed software. Each tool ha * [applications](applications.md) — Default userspace applications on CachyOS with Niri — browsers, editor, terminal, file manager, audio, screenshots, gaming. * [cachyos](cachyos.md) — Arch-based rolling release with performance-optimized kernels, repositories, and gaming stack. Running on the workstation. * [comfyui](comfyui/index.md) — Node-based AI image generation engine on dankclaw. FLUX.2 klein 4B, CPU backend, systemd managed. +* [dotfiles-deploy](dotfiles-deploy.md) — How `dotfiles/` packages become live config: `deploy.sh` modes, host override packages, and why theme media and worktree-enabled units are traps. * [ghostty](ghostty/index.md) — GPU-accelerated terminal emulator with extensive configuration, keybindings, and shaders. * [gitea](gitea/index.md) — Private Git hosting on dankclaw. Quadlet-managed containers: Gitea, PostgreSQL, Caddy. * [handy](handy.md) — Offline speech-to-text transcription with WebKitGTK backend and Tauri v2 UI.