Landing blocker for #61 and #63: the deployment checkout is 12 commits behind and
`merge --ff-only` refuses while tracked paths are dirty. Discard is not available here
(workspace policy: no `checkout`/`stash` on shared state), so the dirt is committed.
- `agent/APPEND_SYSTEM.md`: the point-of-use / one-work-log / PR-link doctrine, already
byte-identical to `origin/main` (`cmp` against the trunk blob: no difference). No new
prose — the commit exists so the trunk merge can proceed.
- `agent/config.yml` and `agent/managed-skills/**`: the machine-live tier the heartbeat
owns (AGENTS.md § Live-sync tiers).
`ALLOW_SECRETS=1` was used, deliberately and after auditing the staged diff by hand: the
only credential-shaped strings in it are two copies of `AKIA0000000000000EXAMPLE` — the
inert all-zero AWS example id — and they appear inside the two skill pages that teach
that exact placeholder shape. This checkout is still running the pre-#61 hook; the merged
gate (value-scoped placeholder filter, `71601f7`) exempts this value, so the refusal
dies with this landing. No `--no-verify` was used: the gate ran and its verdict is
recorded here.
Refs #61
The rich GUI-built layout (cat/clock/clock-utc/weather start, taskbar
center, capsule groups g1-g4 + control-cheat-sheet end, thickness 36,
font_scale 1.3, opacity 0.9) existed only in the working tree; it was
stashed at 16:46 during the trunk merge and the stash entry was later
destroyed. Recovered from dangling stash commit 7fe3ed8 via git fsck.
This commit is the durable copy the layout never had before.
Bar start = launcher, wallpaper, workspaces, taskbar; center keeps only the cat plugin widget. settings.toml is the GUI-override layer, symlinked from this repo.
Frank