command-center/.pre-pull-backup/agent/managed-skills/command-center-dotfiles-import/SKILL.md

name, description

name	description
command-center-dotfiles-import	Runbook for importing Dankware env-layer configs into the command-center repo and deploying them via stow on new fleet machines; decisions agreed with Frank 2026-09-09 (pre-execution — verify execution state before assuming done).

Design agreed with Frank for importing Dankware application/environment configs into the ~/.omp command-center repo and deploying them on fresh machines. Status: plan agreed, not yet executed — check repo state (does dotfiles/ or scripts/deploy.sh exist?) before re-deriving; if already implemented, this becomes the operating model, not a to-do.

Agreed decisions (each was an explicit user choice)

1. Target: unknown/TBD fresh machine → design stays host-agnostic; deploy derives overrides from $(hostname) at run time. Nothing hardcodes a target.
2. Scope: environment layer only — niri (+cfg includes), gtk-3.0/4.0 settings, ghostty, alacritty, shell rc files (.zshrc, .bashrc, .profile, .p10k.zsh), fish, systemd user units, autostart, dconf. App data (browser profiles, vaults, DBs) never imported.
3. Layout: stow-style package dirs dotfiles/<pkg>/<home-relative path> inside the repo; repo clones to ~/.omp on every host that runs the harness (full command-center clone, not env-layer only).
4. Deploy mechanism: symlink farm — stow -t ~ from ~/.omp/dotfiles; relative symlinks within $HOME work because repo root lives inside $HOME.
5. Dogfood order: convert Dankware itself (real dirs → symlinks via adopt) BEFORE any target import; iterate where the compositor reload is observable.
6. Secrets policy: never commit secret values. Split rc files into committed logic + untracked sourced-if-exists stub (~/.config/environment.d/secrets.env or .zshrc.local); real values provisioned out-of-band only on machines that need them. Pre-commit secret scanner stays as safety net, not gate of first resort.
7. Divergence: zz-<hostname> override package stowed LAST with --override; only per-host diffs live there. (Stow descends into conflicting symlinked dirs — per-file overrides only work via this last-stowed --override pattern.)
8. Deploy trigger: explicit scripts/deploy.sh invocation, human- or agent-invoked. NO auto-deploy on pull — pull and deploy are separate decisions; --check = drift report mode.
9. Ownership: Frank is sole push authority; exactly one editing agent at a time → no multi-writer race machinery needed. Each host's agent edits only its own zz-<hostname> package.
10. Conflict policy: pre-existing regular file that differs from repo truth → move to timestamped .quarantine/ dir on the target (never rm, same convention as this repo's trash rule), symlink anyway, print every replacement in deploy output and --check report. Repo truth always wins; divergence recoverable from quarantine.
11. First-clone auth: human types credential once console-side (URL-with-token or prompt); the new machine's secrets exist only there afterward.

Implementation gotchas baked into the design

• core.hooksPath is a per-clone local setting — does NOT survive clone; bootstrap/deploy must set it on every fresh clone or the secret-gate pre-commit hook silently doesn't run there.
• dconf/gsettings are databases, not files: import as dconf dump / text into repo; deploy runs dconf load instead of symlinking.
• p10k installer and toolchain hooks append to rc files at install time — expect conflicts on .zshrc-class files at first adopt; quarantine-and-replace handles it, but diff live-vs-repo before adopting so pre-existing drift is seen, not silently adopted.
• Known secret at import time: GITEA_TOKEN export lived in .zshrc (line ~22) on Dankware — quarantine BEFORE importing rc files; consider token rotation at cutover since it had been exposed in plaintext rc + remote URL.

Deploy script spec agreed

scripts/deploy.sh: sets hooksPath → stows all base packages → stows zz-$(hostname) with --override → first run uses --adopt for pre-existing identical files → divergent files quarantined-and-reported; --check mode emits drift report (modified tracked files vs deployed symlinks) without mutating.