dotfiles/MIGRATION-NOTES.md

# dotstate → chezmoi Migration Notes (Pass 1)

Source of truth for content: **live `$HOME` on rogz** (dotstate storage snapshot may be stale).
dotstate repo: `~/.config/dotstate/storage` (profiles: Noctalia, Inir, Rogz, Vertical-Rogz_AppleStudio, CachyOS).
Live `~/.config` entries were symlinks into dotstate storage; content copied with `chezmoi add --follow`.

## Disposition table — every dotstate synced path

| Path | Profiles | Decision | Notes |
|---|---|---|---|
| `.config/fish` | Noctalia, Inir, Rogz | **universal** | Live (Rogz storage) is the superset and canonical in practice; Noctalia conf.d only had `atuin.env`, `deno`, `inir-env`, `rustup` — stale subset. `secrets.fish` → **secret** (age). Delta: Noctalia carries `deno.fish` (`source ~/.deno/env.fish`) absent from live — folded into universal conf.d with existence guard |
| `.config/nvim` (+`init.lua`) | Noctalia | **universal** | AstroNvim; static, no templating |
| `.config/tmux/tmux.conf` | Vertical-Rogz_AppleStudio | **universal** | Only dotstate source for tmux; verified against live. No vertical-display geometry found in it — nothing to gate |
| `.config/kitty` | Noctalia, Inir, Rogz | **universal** | Live wins (has `goliath.conf`, newer kitty.conf); Noctalia-only `koda-*.conf`, `kitty.conf.old`, `get_layout.py` dropped as stale |
| `.config/yazi` | Noctalia | **universal** | Opener rules OS-branched (`xdg-open` vs `open`); `plugins/`, `flavors/` stay unmanaged (package-managed by `ya pack`) |
| `.config/lazygit` | Noctalia | **universal** | Static |
| `.gitconfig` | all | **universal** | Templated: email/name from chezmoi data. Live (simpler) wins; Noctalia extras (sonr.org credential helper, coderabbit machineId, safe.directory) are machine-state — dropped |
| `.config/starship.toml` | Noctalia, Inir, Rogz | **universal** | Kept (user decision; omp migration rejected). Noctalia auto-regenerates the palette block in place on linux — acceptable drift |
| `.config/niri` | Noctalia, Inir, Rogz | **arch-gated** | `config.d/` split preserved via `exact_` dir |
| `.config/noctalia` | Noctalia, Rogz, Vertical | **arch-gated** | Live symlink points at Vertical storage (active profile) — live wins |
| `.config/niri-dynamic-workspaces` | Inir, Rogz | **arch-gated** | Single `config.toml`, part of niri stack |
| `.config/fontconfig` | Inir, Rogz | **arch-gated** | |
| `.config/mimeapps.list` | Noctalia, Inir, Rogz | **arch-gated** | |
| `.config/systemd/user` | Noctalia, Inir, Rogz | **arch-gated** | Unit *files* only; `*.wants/` enable-state not managed. Enable script only handles session-critical units; personal automation (brain-lens, omp-loop, rclone, hermes, voxtype) ships as files, enabled manually per-machine |
| `.local/bins` | Noctalia | **arch-gated** | Contains only `niri-launch` (referenced by niri binds) → `dot_local/bin/executable_niri-launch` |
| `.bash_profile` `.bashrc` `.bash_logout` | all | **drop** | Fish is the shell; bash files are distro defaults |
| `.zshrc` `.zprofile` `.zshenv` `.p10k.zsh` | Noctalia, Inir, Rogz | **drop** | zsh managed by `cachyos-zsh-config` package |
| `.profile` | Noctalia | **drop** | Distro default |
| `.ssh/known_hosts` | all | **drop** | Machine state, not config |
| `.config/alacritty` | Noctalia, Inir, Rogz | **drop** | kitty is the terminal (niri spawns kitty only); alacritty not live |
| `.config/foot` | Inir, Rogz | **drop** | Same — not live |
| `.config/ghostty` | Noctalia | **defer** | Installed but not primary; revisit pass 2 |
| `.config/glance` | Noctalia | **defer** | |
| `.config/mods` | Noctalia, Rogz | **defer** | mods config carries API endpoint config; audit before adding |
| `.config/opencode/*` | Noctalia | **defer** | `antigravity-accounts.json` is account state — secret risk; whole tree deferred |
| `.config/vicinae` | Noctalia, Vertical | **defer** | Arch desktop launcher; pass 2 |
| `.config/television` | Vertical | **defer** | Vertical profile deferred |
| `.config/mango` | Vertical | **defer** | Vertical profile deferred |
| `.config/illogical-impulse` | Inir | **defer** | Inir profile deferred (future `.role` value) |
| `.agents/skills` | Inir, Rogz | **defer** | Agent tooling, pass 2 |
| `.omp/agent/config.yml` | Vertical | **defer** | Not oh-my-posh — separate agent tool; deferred |
| `.npmrc` | Inir, Rogz | **secret** | Contains `_auth` registry token — deferred from pass 1, goes encrypted if needed later |
| `.yarnrc` | Noctalia | **defer** | |
| `Pictures/Wallpapers/wallhaven-k81776.jpg` | Inir, Rogz | **defer** | Binary asset; not config |
| `.ssh/known_hosts` | all | **drop** | (dup, listed once above) |

## Universal additions not tracked by dotstate (from live `$HOME`)

| Path | Decision | Notes |
|---|---|---|
| `.config/lazydocker` | universal | |
| `.config/gh/config.yml` | universal | `hosts.yml` **excluded** — contains OAuth token (secret) |
| gh extensions | universal | Declarative list in `packages.yaml` (`shared.gh_extensions`): clean-branches, commit, dash, notify |
| `.claude/` subset | universal | `settings.json`, `CLAUDE.md`, `commands/`, `hooks/`, `skills/` only. Never `.credentials.json`, `history.jsonl`, `projects/`, `sessions/`, caches |
| `.ssh/config` | universal | `private_dot_ssh/config`, mode 0600 |
| `.config/topgrade.toml` | universal | User request; topgrade in packages (AUR on arch — cargo-installed today, brew on mac) |

## Decisions

- **starship stays**: the migration plan called for porting starship → oh-my-posh; user rejected this during pass 1. `starship.toml` ships as universal, fish keeps `starship init fish` + transient prompt. oh-my-posh is not installed and not managed.
- **Terminal**: kitty only in pass 1. foot/alacritty configs exist in dotstate but nothing live references them.
- **Rogz vs Noctalia**: live machine *is* Rogz-backed for fish/niri/gitconfig; Noctalia storage was stale for every diverging path inspected (fish conf.d subset, older kitty.conf, gitconfig with dead credential helpers). Pass 1 content = live. Noctalia-only artifacts worth revisiting: `kitty/koda-{dark,light}.conf` themes, `fish/conf.d/deno.fish` (folded in).
- **Inir / Vertical-Rogz_AppleStudio / CachyOS**: deferred entirely (except tmux.conf, claimed above). Future `.role` values.
- **systemd user units**: unit files managed, enable-state not (except session-critical via `run_once` script).
- **Compiled tools in `~/.local/bin`**: never vendored; installed via `packages.yaml`. Only hand-written scripts ship in `dot_local/bin/`.
- **gitconfig `insteadOf` → `pushInsteadOf`**: live config rewrote *all* GitHub https URLs to ssh, which breaks every anonymous clone (lazy.nvim, tpm, fisher) on a machine without SSH keys — i.e. the bootstrap one-liner. `pushInsteadOf` keeps keyless https fetches working; pushes still use ssh; private https fetches use the `gh auth git-credential` helper. Found by the Arch container validation.
- **`core.pager = git-split-diffs`**: npm-installed tool, not in `packages.yaml` (no node package management in pass 1). Interactive-only; git works without it (pager errors degrade to no pager). Same for the `tea` credential helper (prad.codes host only).

## Secrets audit results

- `fish/conf.d/secrets.fish`: live API keys (OpenAI, Groq, GitLab PAT, Linear, Tavily, etc.) → `encrypted_secrets.fish.age` via age. Key at `~/.config/chezmoi/key.txt`, distributed manually.
- `gh/hosts.yml`: `oauth_token` → excluded from repo (gh re-auths per machine via `gh auth login`).
- `.npmrc`: `_auth` token → deferred, not added.
- `opencode/antigravity-accounts.json`: account state → deferred, not added.
- Full grep for `sk-`, `ghp_`, `glpat-`, `Bearer`, `token`, `key =` run across all added content before commit; see secrets-audit issue.