Frank
04f93133fc
The gate scanned only `*.md *.yml *.yaml *.json *.toml *.sh *.ts *.js`. A `postgres.env`, a `.container` quadlet, an `.ini`, or an extension-less dotfile — exactly the shapes the dotfiles tier is made of — was never read at all. Discovered while deciding what else belongs in `dotfiles/`: `~/.config` carries `containers/systemd/postgres.env` with a real `POSTGRES_PASSWORD`, which the ignore list did not cover either (`git check-ignore` says so: `.env` does not match `postgres.env`). Token SHAPES now scan the entire staged diff, every file type; bcrypt hashes and `Authorization: Basic` headers joined the shape list. Credential ASSIGNMENTS are scanned in non-prose files only — the auto-learned memory tier is prose *about* credentials (7 such hits measured on the tracked tree), and a gate that fires there gets overridden until it means nothing. Markdown keeps shape detection, which is what it had before. Three invariants, each pinned by a test in tests/secret-gate.bats (13 tests, black-box: the hook is copied into a scratch repo and git itself runs it): - Fail closed. The first version of this rewrite passed `-I` to `git diff`, which is not valid there; the empty file list made every secret commit sail through, and a blind gate looks exactly like a clean tree. If the hook cannot read the staged diff it now refuses the commit. - Only ADDED lines can leak. The gate refused the redaction commit in this branch because the diff still carried the removed password — a gate that blocks the removal of a secret holds the leak hostage. - Path-valued variables (`…_FILE=`, `…_PATH=`) and placeholder/indirected values are not secrets, so the gate stays worth listening to. `.gitignore` quarantines `*.env` at any name, and gains the theme-media rule whose untracking lands in the next commit. `AGENTS.md` states the new contract. Refs #40
Command Center
Configuration repository for Frank's Userspace configurations (i.e. his desktop setup)
AI Disclosures:
- Slop rating: 3/5 - Actively using, actively de-slopping, repository still mostly AI owned
- Completeness: Unfinished, planning planned, no plan yet
- Datacenter model/spend: Less than $5 of Deepseek 4.1 Flash
- Local model: Qwen 3.8 27B
slop rating of 3 or higher indicates human reading is a waste of time outside of this README, and that you might as well ask an agent for help with this.
slop rating 3 indicates Frank is comfortable using this for professional use -- but barely.
The Fleet
| Host | Role | IP |
|---|---|---|
| Workstation | Client box (CachyOS, Niri/Wayland) | — |
| Dankclaw | Server (Podman, reverse proxy, Gitea, NPU) | 192.168.0.143 |
| Dankserver | LLM inference backend | 192.168.0.235 |
The workstation hosts the primary checkout — this repository lives at ~/.omp/ and drives the OMP agent harness.
Structure at a Glance
~/.omp/
├── agent/ # OMP harness runtime
│ ├── config.yml # Live agent configuration
│ ├── models.yml # Model providers (single source of truth)
│ ├── APPEND_SYSTEM.md # System prompt extensions
│ ├── managed-skills/ # Managed skills (SKILL.md bundles)
│ ├── models.db # Model cache
│ └── sessions/ # Persistent session state
├── dotfiles/ # stow-style env-layer packages (home-relative trees)
│ └── deploy via scripts/deploy.sh (check|adopt|sync; quarantine-and-replace)
├── omp-docs/ # Knowledge base (source of truth)
│ ├── index.md # KB index — start here
│ ├── system/ # Fleet hardware, OS, network
│ ├── tools/ # Installed software (llama.cpp, Gitea, Caddy, niri…)
│ ├── core/ # Agent config conventions (settings, models, AGENTS.md)
│ ├── pi/ # Legacy pi-era config reference
│ ├── engineering/ # SDLC, languages, infra, skills ecosystem
│ ├── research/ # Decision-support research (not yet facts)
│ ├── references/ # OKF spec, maintenance procedures
│ ├── caddy/ # Reverse proxy configuration
│ ├── packages/ # Pi packages and extensions
│ ├── inventory/ # Userspace config census
│ ├── reports/ # Investigation reports
│ ├── log.md # Change log
│ └── .okf/ # OKF v0.1 conformance config
├── scripts/ # Utility scripts (kb-lint.sh)
├── plugins/ # npm plugins (pi-peon, etc.)
├── puppeteer/ # Browser automation config
├── .githooks/ # Pre-commit hook
├── .gitignore # Runtime state ignored (databases, logs, cache)
├── AGENTS.md # Agent conventions (niri reload, keybindings)
└── README.md # This file
What Lives Here
Config in, state out. Everything tracked is something an agent reads or writes. Runtime databases (*.db, *.sqlite), logs, caches, and session state are git-ignored — git history captures configuration changes, not agent heartbeat.
Quick Start
| Task | How |
|---|---|
| Read the knowledge base | omp-docs/index.md — every concept linked from here |
| Check agent config | agent/config.yml + agent/models.yml |
| Lint the KB | scripts/kb-lint.sh (OKF v0.1 conformance) |
| View change log | omp-docs/log.md |
| Run a pre-commit | .githooks/pre-commit |
Conventions
- OKF v0.1 — every doc file carries YAML frontmatter with a
type:field.index.mdfiles are directory listings (no frontmatter). - Progressive disclosure —
index.mdis a landing page; drill into subdirectories for detail. - Verified facts — stamped with
verified:when probed against the live fleet. Trust over memory. - Single config source —
~/.omp/agent/models.ymlis the only model registry; OMP is the primary harness and there is no second copy to keep in sync.
Legacy Notes
omp-docs/pi/ and omp-docs/core/ retain general documentation about the pi-coding-agent harness (its config format, packages, skill system) for reference. OMP at ~/.omp/ is the live harness; managed skills live in ~/.omp/agent/managed-skills/.