A fresh Arch/CachyOS box must be able to reproduce this command-center deployment from a bare git clone into ~/.omp — the checkout IS the deployment (AGENTS.md § What this repo is). scripts/install.sh (package delta) and scripts/deploy.sh (stow-equivalent symlinks) already exist and are idempotent, but nothing chains them with the prerequisites around them: Gitea credentials, git-lfs, the bun/omp harness, the skills store, the secret gate, the systemd user units. Proposal: one scripts/workstation-init.sh entrypoint — --check by default, --apply to write — that calls the existing scripts in order and stops, loudly, at everything listed under known manual artifacts.
Bootstrap checklist (each step verified on blankpad, 2026-10-18)
Close the package gaps first: node/npm (/usr/bin/node), bun (/usr/bin/bun) and the desktop stack niri, noctalia, cachyos-niri-noctalia (repo cachyos-extra-v3) are live on this box but appear in none of packages/*.pkgs; add them, otherwise steps 7-9 have no interpreter. yay bootstrapping is already handled by install.sh.
Name the box deliberately: deploy.sh stows dotfiles/zz-$(hostname) last with override semantics and install.sh reads packages/$(hostname).pkgs. A hostname matching neither silently loses the niri keybinds/desks/autostart (dotfiles/zz-blankpad/…) and the host manifest — reuse an existing hostname or create both files first.
Gitea credential before the clone (remote is plain http): mkdir -p ~/.config/secrets && chmod 700 ~/.config/secrets, git config --global credential.helper 'store --file ~/.config/secrets/gitea', then write the single http://<user>:<token>@192.168.0.143 line at mode 600.
Arm the secret gate and install packages: git -C ~/.omp config core.hooksPath .githooks, then ~/.omp/scripts/install.sh (plan) and ~/.omp/scripts/install.sh --apply (honours FRANK_SUDO_PW; also enables sshd and opens ssh in firewalld).
Harness + test tooling: bun add -g @oh-my-pi/pi-coding-agent@18.8.7 @oh-my-pi/pi-natives@18.8.7 bats — pins taken from ~/.bun/install/global/package.json; omp and bats land in ~/.bun/bin.
Skills CLI global store — canonical dir ~/.agents/skills/, provenance lockfile ~/.agents/.skill-lock.json (v3). The tier law and the exact recipe are doctrine in omp-docs/tools/vercel-labs-skills/skill-store-wiring.md; the fresh-box sequence is three commands:
npx -y skills remove grilling -g — grilling ships in the repo as an authored override, so it must not also sit in the store.
No link/provider plumbing after step 8 (omp is deliberately absent from the skills CLI's 79-agent registry, so skills add never writes under ~/.omp): omp reads ~/.agents/skills/*/SKILL.md DIRECTLY through its own agents provider, skills.enableAgentsUser (default true) — no per-skill symlinks in the repo, and the repo must not mirror the store. The repo carries only the authored tier agent/skills/ (priority 100, wins name collisions against both the store and the auto-learn agent/managed-skills/ tier, priority 5, which nothing here touches). Verify jq '.skills|length' ~/.agents/.skill-lock.json == 38 and that agent/skills/ holds just grilling/ from the clone.
Dotfiles + units: ~/.omp/scripts/deploy.sh --check then ~/.omp/scripts/deploy.sh. That links ~/.config/niri/config.kdl and ~/.config/niri/cfg/*.kdl, ~/.config/noctalia/config.toml plus palettes/, ~/.local/state/noctalia/settings.toml, loads dotfiles/dconf/dump.txt via dconf load /, and daemon-reloads plus enables units whose ExecStart resolves on the box.
Timers on: systemctl --user enable --now live-sync.timer, then confirm the enabled set — live-sync.timer, swayidle-lock.service, shelly-notifications.service, blankpad-desk-autoswitch.service, fib-watchdog.timer — and run one heartbeat: ~/.omp/scripts/live-sync.sh.
Verify: bats tests/ green, the step 9 skill-store counts, git -C ~/.omp status --porcelain clean for the tracked tiers, niri starts on the intended cfg/display.kdl.
Known manual artifacts (the script must refuse to touch, only report)
~/.config/secrets/ — gitea, hf_token, hf_token_write, kagi_api_key (dir 700, files 600). Never tracked; the pre-commit secret gate is the backstop.
~/.ssh/ (config, id_ed25519*) for the BatchMode probes to dankclaw/dankserver, and the token embedded in the .git/config remote URL.
~/.config/ntfy/live-sync (mode 600, topic text only) — absent on blankpad today, so live-sync alerts are stderr-only; optional per box.
Host-local drift to surface, not fix: ~/.config/systemd/user/fib-watchdog.service and .timer (untracked), ~/.config/niri/noctalia.kdl (GUI-rewritten; tracked only under zz-blankpad), ~/.config/niri/cfg/display.kdl -> desk-1-home.kdl (chosen at runtime by blankpad-desk-autoswitch.service), ~/.local/state/noctalia/ runtime state.
Machine state gitignored by doctrine: install-id, logs/, wt/, .AGENTTRASH/, .quarantine, *.db.
Out of scope
No dotfile-manager adoption — chezmoi stays an open decision (omp-docs/research/chezmoi-evaluation.md); the deploy.sh symlink model stands.
No Ansible, no autoinstall/OS-installer profile, no server provisioning (dankclaw/dankserver stay on their vault runbooks).
## Context
A fresh Arch/CachyOS box must be able to reproduce this command-center deployment from a bare `git clone` into `~/.omp` — the checkout IS the deployment (AGENTS.md § What this repo is). `scripts/install.sh` (package delta) and `scripts/deploy.sh` (stow-equivalent symlinks) already exist and are idempotent, but nothing chains them with the prerequisites around them: Gitea credentials, git-lfs, the bun/omp harness, the skills store, the secret gate, the systemd user units. Proposal: one `scripts/workstation-init.sh` entrypoint — `--check` by default, `--apply` to write — that calls the existing scripts in order and stops, loudly, at everything listed under known manual artifacts.
## Bootstrap checklist (each step verified on blankpad, 2026-10-18)
1. Close the package gaps first: `node`/`npm` (`/usr/bin/node`), `bun` (`/usr/bin/bun`) and the desktop stack `niri`, `noctalia`, `cachyos-niri-noctalia` (repo `cachyos-extra-v3`) are live on this box but appear in none of `packages/*.pkgs`; add them, otherwise steps 7-9 have no interpreter. `yay` bootstrapping is already handled by `install.sh`.
2. Name the box deliberately: `deploy.sh` stows `dotfiles/zz-$(hostname)` last with override semantics and `install.sh` reads `packages/$(hostname).pkgs`. A hostname matching neither silently loses the niri keybinds/desks/autostart (`dotfiles/zz-blankpad/…`) and the host manifest — reuse an existing hostname or create both files first.
3. Gitea credential before the clone (remote is plain http): `mkdir -p ~/.config/secrets && chmod 700 ~/.config/secrets`, `git config --global credential.helper 'store --file ~/.config/secrets/gitea'`, then write the single `http://<user>:<token>@192.168.0.143` line at mode 600.
4. Clone: `git clone http://192.168.0.143:3000/dank/command-center.git ~/.omp`
5. LFS for the wallpapers (`.gitattributes` tracks `*.jpg *.jpeg *.png *.webp`): `git -C ~/.omp lfs install && git -C ~/.omp lfs pull`
6. Arm the secret gate and install packages: `git -C ~/.omp config core.hooksPath .githooks`, then `~/.omp/scripts/install.sh` (plan) and `~/.omp/scripts/install.sh --apply` (honours `FRANK_SUDO_PW`; also enables `sshd` and opens ssh in firewalld).
7. Harness + test tooling: `bun add -g @oh-my-pi/pi-coding-agent@18.8.7 @oh-my-pi/pi-natives@18.8.7 bats` — pins taken from `~/.bun/install/global/package.json`; `omp` and `bats` land in `~/.bun/bin`.
8. Skills CLI global store — canonical dir `~/.agents/skills/`, provenance lockfile `~/.agents/.skill-lock.json` (v3). The tier law and the exact recipe are doctrine in `omp-docs/tools/vercel-labs-skills/skill-store-wiring.md`; the fresh-box sequence is three commands:
- `npx -y skills add mattpocock/skills --all -g`
- `npx -y skills add vercel-labs/skills --skill find-skills --agent universal -g`
- `npx -y skills remove grilling -g` — `grilling` ships in the repo as an authored override, so it must not also sit in the store.
9. No link/provider plumbing after step 8 (omp is deliberately absent from the skills CLI's 79-agent registry, so `skills add` never writes under `~/.omp`): omp reads `~/.agents/skills/*/SKILL.md` DIRECTLY through its own `agents` provider, `skills.enableAgentsUser` (default true) — no per-skill symlinks in the repo, and the repo must not mirror the store. The repo carries only the authored tier `agent/skills/` (priority 100, wins name collisions against both the store and the auto-learn `agent/managed-skills/` tier, priority 5, which nothing here touches). Verify `jq '.skills|length' ~/.agents/.skill-lock.json` == 38 and that `agent/skills/` holds just `grilling/` from the clone.
10. Dotfiles + units: `~/.omp/scripts/deploy.sh --check` then `~/.omp/scripts/deploy.sh`. That links `~/.config/niri/config.kdl` and `~/.config/niri/cfg/*.kdl`, `~/.config/noctalia/config.toml` plus `palettes/`, `~/.local/state/noctalia/settings.toml`, loads `dotfiles/dconf/dump.txt` via `dconf load /`, and daemon-reloads plus enables units whose `ExecStart` resolves on the box.
11. Timers on: `systemctl --user enable --now live-sync.timer`, then confirm the enabled set — `live-sync.timer`, `swayidle-lock.service`, `shelly-notifications.service`, `blankpad-desk-autoswitch.service`, `fib-watchdog.timer` — and run one heartbeat: `~/.omp/scripts/live-sync.sh`.
12. Verify: `bats tests/` green, the step 9 skill-store counts, `git -C ~/.omp status --porcelain` clean for the tracked tiers, niri starts on the intended `cfg/display.kdl`.
## Known manual artifacts (the script must refuse to touch, only report)
- `~/.config/secrets/` — `gitea`, `hf_token`, `hf_token_write`, `kagi_api_key` (dir 700, files 600). Never tracked; the pre-commit secret gate is the backstop.
- `~/.omp/.env` — holds `GITEA_TOKEN`, gitignored (AGENTS.md § Environment gotchas).
- `~/.ssh/` (`config`, `id_ed25519*`) for the BatchMode probes to dankclaw/dankserver, and the token embedded in the `.git/config` remote URL.
- `~/.config/ntfy/live-sync` (mode 600, topic text only) — absent on blankpad today, so live-sync alerts are stderr-only; optional per box.
- Host-local drift to surface, not fix: `~/.config/systemd/user/fib-watchdog.service` and `.timer` (untracked), `~/.config/niri/noctalia.kdl` (GUI-rewritten; tracked only under `zz-blankpad`), `~/.config/niri/cfg/display.kdl -> desk-1-home.kdl` (chosen at runtime by `blankpad-desk-autoswitch.service`), `~/.local/state/noctalia/` runtime state.
- Machine state gitignored by doctrine: `install-id`, `logs/`, `wt/`, `.AGENTTRASH/`, `.quarantine`, `*.db`.
## Out of scope
- No dotfile-manager adoption — chezmoi stays an open decision (`omp-docs/research/chezmoi-evaluation.md`); the `deploy.sh` symlink model stands.
- No Ansible, no autoinstall/OS-installer profile, no server provisioning (dankclaw/dankserver stay on their vault runbooks).
---
cwd: /home/blank/.omp/wt/wt-20261018-170616-7c8a99d · session: wt-issue-init-script
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context
A fresh Arch/CachyOS box must be able to reproduce this command-center deployment from a bare
git cloneinto~/.omp— the checkout IS the deployment (AGENTS.md § What this repo is).scripts/install.sh(package delta) andscripts/deploy.sh(stow-equivalent symlinks) already exist and are idempotent, but nothing chains them with the prerequisites around them: Gitea credentials, git-lfs, the bun/omp harness, the skills store, the secret gate, the systemd user units. Proposal: onescripts/workstation-init.shentrypoint —--checkby default,--applyto write — that calls the existing scripts in order and stops, loudly, at everything listed under known manual artifacts.Bootstrap checklist (each step verified on blankpad, 2026-10-18)
node/npm(/usr/bin/node),bun(/usr/bin/bun) and the desktop stackniri,noctalia,cachyos-niri-noctalia(repocachyos-extra-v3) are live on this box but appear in none ofpackages/*.pkgs; add them, otherwise steps 7-9 have no interpreter.yaybootstrapping is already handled byinstall.sh.deploy.shstowsdotfiles/zz-$(hostname)last with override semantics andinstall.shreadspackages/$(hostname).pkgs. A hostname matching neither silently loses the niri keybinds/desks/autostart (dotfiles/zz-blankpad/…) and the host manifest — reuse an existing hostname or create both files first.mkdir -p ~/.config/secrets && chmod 700 ~/.config/secrets,git config --global credential.helper 'store --file ~/.config/secrets/gitea', then write the singlehttp://<user>:<token>@192.168.0.143line at mode 600.git clone http://192.168.0.143:3000/dank/command-center.git ~/.omp.gitattributestracks*.jpg *.jpeg *.png *.webp):git -C ~/.omp lfs install && git -C ~/.omp lfs pullgit -C ~/.omp config core.hooksPath .githooks, then~/.omp/scripts/install.sh(plan) and~/.omp/scripts/install.sh --apply(honoursFRANK_SUDO_PW; also enablessshdand opens ssh in firewalld).bun add -g @oh-my-pi/pi-coding-agent@18.8.7 @oh-my-pi/pi-natives@18.8.7 bats— pins taken from~/.bun/install/global/package.json;ompandbatsland in~/.bun/bin.~/.agents/skills/, provenance lockfile~/.agents/.skill-lock.json(v3). The tier law and the exact recipe are doctrine inomp-docs/tools/vercel-labs-skills/skill-store-wiring.md; the fresh-box sequence is three commands:npx -y skills add mattpocock/skills --all -gnpx -y skills add vercel-labs/skills --skill find-skills --agent universal -gnpx -y skills remove grilling -g—grillingships in the repo as an authored override, so it must not also sit in the store.skills addnever writes under~/.omp): omp reads~/.agents/skills/*/SKILL.mdDIRECTLY through its ownagentsprovider,skills.enableAgentsUser(default true) — no per-skill symlinks in the repo, and the repo must not mirror the store. The repo carries only the authored tieragent/skills/(priority 100, wins name collisions against both the store and the auto-learnagent/managed-skills/tier, priority 5, which nothing here touches). Verifyjq '.skills|length' ~/.agents/.skill-lock.json== 38 and thatagent/skills/holds justgrilling/from the clone.~/.omp/scripts/deploy.sh --checkthen~/.omp/scripts/deploy.sh. That links~/.config/niri/config.kdland~/.config/niri/cfg/*.kdl,~/.config/noctalia/config.tomlpluspalettes/,~/.local/state/noctalia/settings.toml, loadsdotfiles/dconf/dump.txtviadconf load /, and daemon-reloads plus enables units whoseExecStartresolves on the box.systemctl --user enable --now live-sync.timer, then confirm the enabled set —live-sync.timer,swayidle-lock.service,shelly-notifications.service,blankpad-desk-autoswitch.service,fib-watchdog.timer— and run one heartbeat:~/.omp/scripts/live-sync.sh.bats tests/green, the step 9 skill-store counts,git -C ~/.omp status --porcelainclean for the tracked tiers, niri starts on the intendedcfg/display.kdl.Known manual artifacts (the script must refuse to touch, only report)
~/.config/secrets/—gitea,hf_token,hf_token_write,kagi_api_key(dir 700, files 600). Never tracked; the pre-commit secret gate is the backstop.~/.omp/.env— holdsGITEA_TOKEN, gitignored (AGENTS.md § Environment gotchas).~/.ssh/(config,id_ed25519*) for the BatchMode probes to dankclaw/dankserver, and the token embedded in the.git/configremote URL.~/.config/ntfy/live-sync(mode 600, topic text only) — absent on blankpad today, so live-sync alerts are stderr-only; optional per box.~/.config/systemd/user/fib-watchdog.serviceand.timer(untracked),~/.config/niri/noctalia.kdl(GUI-rewritten; tracked only underzz-blankpad),~/.config/niri/cfg/display.kdl -> desk-1-home.kdl(chosen at runtime byblankpad-desk-autoswitch.service),~/.local/state/noctalia/runtime state.install-id,logs/,wt/,.AGENTTRASH/,.quarantine,*.db.Out of scope
omp-docs/research/chezmoi-evaluation.md); thedeploy.shsymlink model stands.cwd: /home/blank/.omp/wt/wt-20261018-170616-7c8a99d · session: wt-issue-init-script