live: heartbeat sync 2026-10-18T16:47:59-07:00 (Refs #11)

agent/memories/--home-blank-.omp--/learned.md

@@ -1,3 +1,4 @@
+- command-center (~/.omp) worktree-clean law, verified 2026-10-09: (1) The secret gate's PEM family regex (BEGIN, a space, a bracketed A-Z star class, PRIVATE KEY) does NOT self-match when the pattern is quoted in brackets form — a SKILL.md documenting the gate verbatim in regex-bracket shape is safe to stage; only the bare quoted literal (e.g. the plain two-word PEM header phrase, the xox[baprs] family prefix followed by 10+ token chars) trips it. Before any commit that stages prose about secrets, pre-scan with the exact gate one-liner: staged=$(git diff --cached --diff-filter=ACM -U0 -- '*.md' '*.yml' '*.yaml' '*.json' '*.toml' '*.sh' '*.ts' '*.js'); printf '%s\n' "$staged" | grep -Eic 'gate patterns' — 0 hits means the gate will pass; redact prose descriptively, never ALLOW_SECRETS. (2) The omp auto-learner mints managed skills under agent/managed-skills/name/ DURING a session — a "clean tree" declared mid-session goes dirty again when capture fires (observed: noctalia-bar-layout-edit appeared between commit and final status). Re-run git status as the LAST command of a cleanup pass. (3) Classification rule that made the tree clean in one pass: agent/memories/*/learned.md and agent/managed-skills/ are config → commit atomically; new top-level runtime dirs (webcache/, reports/, local/, wt/) are state → .gitignore. webcache/ (harness web-fetch cache) is gitignored as of commit 4d2b024.
 - Noctalia v5 config layering (verified live on blankpad 2026-10-09): bar widget layout lives in the GUI-override layer ~/.local/state/noctalia/settings.toml under [bar.name] keys start/center/end (defaults: start=["launcher","wallpaper","workspaces"], center=["clock"]); settings.toml loads LAST and wins over ~/.config/noctalia/config.toml. Both layers are watched and hot-reloaded — edit + noctalia config validate + screenshot is the full apply/verify loop (no restart, no reload IPC). Noctalia writes THROUGH symlinks and keeps the link, so keeping settings.toml symlinked from the command-center dotfiles repo is safe. Combine workspace+window indicator: [widget.taskbar] group_by_workspace=true (needs compositor per-window workspace data — niri has it) renders per-workspace capsules with disc labels, workspace_group_content = icons|count|dots (count/dots left-click activates the workspace); the workspaces widget itself has no window-display mode. Applied on blankpad: bar.default start=["launcher","wallpaper","workspaces","taskbar"], center=["cat"] (command-center commits 9255a8b, 0ccdd46). _(context: Blankpad noctalia 5.2.1 bar layout change 2026-10-09: taskbar moved to left section, group_by_workspace identified as the combining widget, verified via config validate + fullscreen screenshot)_
 - The command-center (~/.omp) pre-commit secret gate (.githooks/pre-commit, single grep -E of known token regexes) SELF-MATCHES its own documented pattern literals: committing prose that quotes them verbatim (e.g. a quoted PEM private-key header line, the xox[baprs] family prefix, the github-pat prefix, long sk- examples) trips SECRET GATE and blocks the commit (observed twice 2026-10-09 on agent/memories/--home-blank-.omp--/learned.md audit prose). Convention: redact pattern literals descriptively in prose ("PEM private-key headers", "the xox[baprs] family", "ghp 36") instead of setting ALLOW_SECRETS=1; the gate firing on prose is the gate working as designed. Note the gate covers only 10 families — no hf_/npm_/AIza/glpat-short/basic-auth-URL coverage — so clean-gate history is not proof of no leaks.
 - niri 26.04 event-stream (niri msg --json event-stream) has NO hotplug event: OutputConfigChanged is only an ACK that an IPC/config output change was Applied (per niri-ipc docs; proven live — mode flips via niri msg output NAME mode WxH@Hz and DPMS off/on emit zero output events). Detect monitor connect/disconnect by diffing the sorted unique set of .WorkspacesChanged.workspaces[].output across events (off/on cycle of eDP-1 emitted exactly WorkspacesChanged 2x). Debounce ~1.5s; OutputConfigChanged events are emitted in bursts on every config reload — ignoring them prevents hotplug-daemon echo loops. Implemented in dank/command-center scripts/desk-autoswitch.sh (blankpad-desk-autoswitch.service). Related trap: niri msg output 26.04 syntax is niri msg output NAME ACTION [args] (mode/off/on), not the old NAME WxH@Hz form.