feat(chezmoi): add gating skeleton — config template, templated ignore, packages manifest

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.beads/interactions.jsonl

@@ -0,0 +1,4 @@
+{"id":"int-236249fd","kind":"field_change","created_at":"2026-08-09T18:44:22.524398795Z","actor":"Prad Nukala","issue_id":"chezmoi-rnv","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
+{"id":"int-9e6172d7","kind":"field_change","created_at":"2026-08-09T18:45:27.623863823Z","actor":"Prad Nukala","issue_id":"chezmoi-rnv","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
+{"id":"int-6bf2e4e2","kind":"field_change","created_at":"2026-08-09T18:45:27.838098287Z","actor":"Prad Nukala","issue_id":"chezmoi-byc","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
+{"id":"int-f4aa6fe4","kind":"field_change","created_at":"2026-08-09T18:45:27.978881011Z","actor":"Prad Nukala","issue_id":"chezmoi-1a0","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}

.beads/issues.jsonl

@@ -0,0 +1,19 @@
+{"_type":"issue","id":"chezmoi-1a0","title":"Secrets audit: grep all candidate content for tokens before any chezmoi add","description":"Grep sk-, ghp_, glpat-, Bearer, token, key = across all files destined for repo. secrets.fish goes to age-encrypted encrypted_ path (key ~/.config/chezmoi/key.txt, manual distribution, document in README). Claude: never .credentials.json.","status":"in_progress","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:45:28Z","dependency_count":0,"dependent_count":3,"comment_count":0}
+{"_type":"issue","id":"chezmoi-byc","title":"Gating skeleton: .chezmoi.toml.tmpl + .chezmoiignore.tmpl + packages.yaml skeleton","description":"promptOnce name/email/role (desktop|laptop|mac|server); chezmoiignore gates linux-only trees on darwin and vice versa; .chezmoidata/packages.yaml skeleton {arch:{pacman,aur},darwin:{brew,cask},shared:{gh_extensions,go,cargo}}. Machinery before content.","status":"in_progress","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:45:28Z","dependency_count":0,"dependent_count":13,"comment_count":0}
+{"_type":"issue","id":"chezmoi-rnv","title":"Inventory: disposition table for all dotstate synced paths","description":"Parse .dotstate-profiles.toml (Noctalia/Inir/Rogz/Vertical-Rogz_AppleStudio). Every synced path gets decision: universal / arch-gated / defer / drop / secret. Output table in MIGRATION-NOTES.md. Blocks all content.","status":"closed","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:44:23Z","closed_at":"2026-08-09T18:45:28Z","close_reason":"Closed","dependency_count":0,"dependent_count":13,"comment_count":0}
+{"_type":"issue","id":"chezmoi-42m","title":"Validation: Arch fresh bring-up in container","description":"docker run archlinux: bootstrap one-liner, packages install, chezmoi doctor clean, niri validate, fish -n all files, nvim --headless +Lazy! sync, tmux -f cfg new -d; kill-server, gh extension list matches manifest. Plus live machine chezmoi diff ~ empty.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-21v","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-4sj","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-9sg","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-a2k","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-exq","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-fde","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-hou","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-iu2","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-sd9","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-utl","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-uw2","type":"blocks","created_at":"2026-08-09T14:42:57Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-x7f","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-xi5","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"chezmoi-5by","title":"Cutover: freeze dotstate for migrated paths","description":"After both validations: remove migrated paths from .dotstate-profiles.toml, tag dotstate pre-chezmoi-freeze, stop Dolt sync for those paths. Archive, never delete.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-42m","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-udp","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"chezmoi-9sg","title":"Arch layer: niri, noctalia, fontconfig, mimeapps, systemd user units — linux-gated","description":"niri config.d split preserved with exact_ dir; noctalia; fontconfig; mimeapps.list; systemd user units; foot/alacritty if live. All gated in .chezmoiignore.tmpl for darwin. niri validate must pass.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-9sg","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-9sg","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-iu2","title":"packages.yaml: translate dotstate manifests + live state into declarative manifest","description":"Curate Noctalia pacman list (drop base-system noise), custom installers, cargo/go tools, shared gh_extensions; darwin brew/cask section. Install scripts run_onchange keyed on yaml hash: pacman --needed + paru | brew loop; gh extension install loop; linux systemctl --user enable; post: fc-cache, bat cache.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-iu2","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:53Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-iu2","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:53Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-udp","title":"Validation: darwin simulation","description":"chezmoi execute-template with os=darwin on every .tmpl; darwin-mode dry-run apply writes zero linux-gated paths, errors on nothing. Full Mac apply deferred until hardware available.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-21v","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-4sj","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-9sg","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-a2k","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-exq","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-fde","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-hou","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-iu2","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-sd9","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-utl","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-uw2","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-x7f","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-xi5","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"chezmoi-21v","title":"gh: config file + declarative extension list","description":"~/.config/gh config.yml (hosts.yml has oauth token - exclude/encrypt). Extensions: clean-branches, commit, dash, notify into packages.yaml shared.gh_extensions.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-1a0","type":"blocks","created_at":"2026-08-09T14:42:24Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":3,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-4sj","title":"lazydocker: static config from live","description":"~/.config/lazydocker (not in dotstate).","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-4sj","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-4sj","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-a2k","title":"claude: settings, commands, agents, hooks, skills only","description":"~/.claude: settings.json, commands/, hooks/, skills/, CLAUDE.md. Never credentials/history/projects/sessions.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-1a0","type":"blocks","created_at":"2026-08-09T14:42:24Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":3,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-exq","title":"git: dot_gitconfig.tmpl with templated email/signing key","description":"~/.gitconfig from live; email + signing key from chezmoi data.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-exq","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-exq","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-fde","title":"oh-my-posh: theme + fish init, port starship customizations","description":"~/.config/oh-my-posh. Port ~/.config/starship.toml customizations into omp theme; drop starship from apply set; record decision in MIGRATION-NOTES.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-fde","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-fde","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-x7f","title":"lazygit: static config","description":"~/.config/lazygit. Already partially in repo — reconcile.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:06Z","dependencies":[{"issue_id":"chezmoi-x7f","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-x7f","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-hou","title":"yazi: config, opener rules OS-branched","description":"~/.config/yazi. open vs xdg-open template branch.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:05Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:05Z","dependencies":[{"issue_id":"chezmoi-hou","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-hou","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-sd9","title":"nvim: AstroNvim config, static","description":"chezmoi add ~/.config/nvim as-is, no templating. Exclude lazy-lock churn decision noted.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:05Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:05Z","dependencies":[{"issue_id":"chezmoi-sd9","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:49Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-sd9","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:49Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-utl","title":"kitty: live config, OS-branch fonts/paths if needed","description":"~/.config/kitty. Keybinds shared.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:05Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:05Z","dependencies":[{"issue_id":"chezmoi-utl","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-utl","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-uw2","title":"fish: config, conf.d, functions, completions, bindings","description":"Live ~/.config/fish (Rogz storage superset; Noctalia canonical, deltas to MIGRATION-NOTES). OS-branch clipboard/open/package paths. secrets.fish excluded (own issue). fish -n all files.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:05Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:05Z","dependencies":[{"issue_id":"chezmoi-uw2","depends_on_id":"chezmoi-1a0","type":"blocks","created_at":"2026-08-09T14:42:24Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-uw2","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:49Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-uw2","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:49Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":3,"dependent_count":2,"comment_count":0}
+{"_type":"issue","id":"chezmoi-xi5","title":"tmux: config from live, strip vertical geometry","description":"~/.config/tmux (tmux.conf symlink from Vertical-Rogz_AppleStudio). Verify live, gate vertical-display-specific bits if present. Plugins dir decision.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:05Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:05Z","dependencies":[{"issue_id":"chezmoi-xi5","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-xi5","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:50Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}

.chezmoi.toml.tmpl

@@ -0,0 +1,16 @@
+{{- $name := promptStringOnce . "name" "Full name" "Prad Nukala" -}}
+{{- $email := promptStringOnce . "email" "Email" "prad@sonr.io" -}}
+{{- $roleDefault := "desktop" -}}
+{{- if eq .chezmoi.os "darwin" -}}{{- $roleDefault = "mac" -}}{{- end -}}
+{{- $role := promptChoiceOnce . "role" "Machine role" (list "desktop" "laptop" "mac" "server") $roleDefault -}}
+
+encryption = "age"
+
+[age]
+    identity = "~/.config/chezmoi/key.txt"
+    recipient = "age19tdqgavaekhvgqsd75n8a09vvshen2ykzy8kw6tenczz73449anqc3l7a6"
+
+[data]
+    name = {{ $name | quote }}
+    email = {{ $email | quote }}
+    role = {{ $role | quote }}

.chezmoidata/packages.yaml

@@ -0,0 +1,93 @@
+packages:
+  arch:
+    pacman:
+      # shell + editors
+      - fish
+      - neovim
+      - tmux
+      - micro
+      # terminal
+      - kitty
+      # tui tools
+      - yazi
+      - lazygit
+      - lazydocker
+      - btop
+      - fastfetch
+      # vcs + forge
+      - git
+      - github-cli
+      - git-delta
+      - diffnav
+      # search / files
+      - fzf
+      - fd
+      - ripgrep
+      - zoxide
+      - eza
+      - bat
+      - jq
+      - duf
+      # media / preview (yazi deps)
+      - ffmpeg
+      - ffmpegthumbnailer
+      - poppler
+      - resvg
+      - imagemagick
+      - 7zip
+      - unzip
+      # misc cli
+      - gum
+      - glow
+      - atuin
+      - wget
+    aur:
+      - oh-my-posh-bin
+    desktop:
+      # linux desktop layer (role desktop|laptop)
+      pacman:
+        - niri
+        - xdg-user-dirs
+      aur:
+        - noctalia-shell
+  darwin:
+    brew:
+      - fish
+      - neovim
+      - tmux
+      - yazi
+      - lazygit
+      - lazydocker
+      - btop
+      - fastfetch
+      - git
+      - gh
+      - git-delta
+      - fzf
+      - fd
+      - ripgrep
+      - zoxide
+      - eza
+      - bat
+      - jq
+      - duf
+      - ffmpeg
+      - ffmpegthumbnailer
+      - poppler
+      - resvg
+      - imagemagick
+      - sevenzip
+      - gum
+      - glow
+      - atuin
+      - oh-my-posh
+    cask:
+      - kitty
+  shared:
+    gh_extensions:
+      - davidraviv/gh-clean-branches
+      - prdlk/gh-commit
+      - dlvhdr/gh-dash
+      - meiji163/gh-notify
+    go: []
+    cargo: []

.chezmoiignore

@@ -1,4 +0,0 @@
-.config/lazygit/.omc/**
-.config/yazi/plugins/**
-.config/tmux/plugins/**
-.config/yazi/flavors/**

.chezmoiignore.tmpl

@@ -0,0 +1,27 @@
+# Repo docs — never applied to $HOME
+MIGRATION-NOTES.md
+README.md
+
+# Runtime/plugin state living inside managed trees — not managed
+.config/lazygit/.omc/**
+.config/yazi/plugins/**
+.config/yazi/flavors/**
+.config/tmux/plugins/**
+.config/fish/fish_variables
+.config/nvim/lazy-lock.json
+
+{{ if ne .chezmoi.os "linux" }}
+# Arch desktop layer — linux only
+.config/niri
+.config/niri/**
+.config/noctalia
+.config/noctalia/**
+.config/niri-dynamic-workspaces
+.config/niri-dynamic-workspaces/**
+.config/fontconfig
+.config/fontconfig/**
+.config/mimeapps.list
+.config/systemd
+.config/systemd/**
+.local/bin/niri-launch
+{{ end }}

MIGRATION-NOTES.md

@@ -0,0 +1,73 @@
+# dotstate → chezmoi Migration Notes (Pass 1)
+
+Source of truth for content: **live `$HOME` on rogz** (dotstate storage snapshot may be stale).
+dotstate repo: `~/.config/dotstate/storage` (profiles: Noctalia, Inir, Rogz, Vertical-Rogz_AppleStudio, CachyOS).
+Live `~/.config` entries were symlinks into dotstate storage; content copied with `chezmoi add --follow`.
+
+## Disposition table — every dotstate synced path
+
+| Path | Profiles | Decision | Notes |
+|---|---|---|---|
+| `.config/fish` | Noctalia, Inir, Rogz | **universal** | Live (Rogz storage) is the superset and canonical in practice; Noctalia conf.d only had `atuin.env`, `deno`, `inir-env`, `rustup` — stale subset. `secrets.fish` → **secret** (age). Delta: Noctalia carries `deno.fish` (`source ~/.deno/env.fish`) absent from live — folded into universal conf.d with existence guard |
+| `.config/nvim` (+`init.lua`) | Noctalia | **universal** | AstroNvim; static, no templating |
+| `.config/tmux/tmux.conf` | Vertical-Rogz_AppleStudio | **universal** | Only dotstate source for tmux; verified against live. No vertical-display geometry found in it — nothing to gate |
+| `.config/kitty` | Noctalia, Inir, Rogz | **universal** | Live wins (has `goliath.conf`, newer kitty.conf); Noctalia-only `koda-*.conf`, `kitty.conf.old`, `get_layout.py` dropped as stale |
+| `.config/yazi` | Noctalia | **universal** | Opener rules OS-branched (`xdg-open` vs `open`); `plugins/`, `flavors/` stay unmanaged (package-managed by `ya pack`) |
+| `.config/lazygit` | Noctalia | **universal** | Static |
+| `.gitconfig` | all | **universal** | Templated: email/name from chezmoi data. Live (simpler) wins; Noctalia extras (sonr.org credential helper, coderabbit machineId, safe.directory) are machine-state — dropped |
+| `.config/starship.toml` | Noctalia, Inir, Rogz | **drop** | Replaced by oh-my-posh (see decision below) |
+| `.config/niri` | Noctalia, Inir, Rogz | **arch-gated** | `config.d/` split preserved via `exact_` dir |
+| `.config/noctalia` | Noctalia, Rogz, Vertical | **arch-gated** | Live symlink points at Vertical storage (active profile) — live wins |
+| `.config/niri-dynamic-workspaces` | Inir, Rogz | **arch-gated** | Single `config.toml`, part of niri stack |
+| `.config/fontconfig` | Inir, Rogz | **arch-gated** | |
+| `.config/mimeapps.list` | Noctalia, Inir, Rogz | **arch-gated** | |
+| `.config/systemd/user` | Noctalia, Inir, Rogz | **arch-gated** | Unit *files* only; `*.wants/` enable-state not managed. Enable script only handles session-critical units; personal automation (brain-lens, omp-loop, rclone, hermes, voxtype) ships as files, enabled manually per-machine |
+| `.local/bins` | Noctalia | **arch-gated** | Contains only `niri-launch` (referenced by niri binds) → `dot_local/bin/executable_niri-launch` |
+| `.bash_profile` `.bashrc` `.bash_logout` | all | **drop** | Fish is the shell; bash files are distro defaults |
+| `.zshrc` `.zprofile` `.zshenv` `.p10k.zsh` | Noctalia, Inir, Rogz | **drop** | zsh managed by `cachyos-zsh-config` package |
+| `.profile` | Noctalia | **drop** | Distro default |
+| `.ssh/known_hosts` | all | **drop** | Machine state, not config |
+| `.config/alacritty` | Noctalia, Inir, Rogz | **drop** | kitty is the terminal (niri spawns kitty only); alacritty not live |
+| `.config/foot` | Inir, Rogz | **drop** | Same — not live |
+| `.config/ghostty` | Noctalia | **defer** | Installed but not primary; revisit pass 2 |
+| `.config/glance` | Noctalia | **defer** | |
+| `.config/mods` | Noctalia, Rogz | **defer** | mods config carries API endpoint config; audit before adding |
+| `.config/opencode/*` | Noctalia | **defer** | `antigravity-accounts.json` is account state — secret risk; whole tree deferred |
+| `.config/vicinae` | Noctalia, Vertical | **defer** | Arch desktop launcher; pass 2 |
+| `.config/television` | Vertical | **defer** | Vertical profile deferred |
+| `.config/mango` | Vertical | **defer** | Vertical profile deferred |
+| `.config/illogical-impulse` | Inir | **defer** | Inir profile deferred (future `.role` value) |
+| `.agents/skills` | Inir, Rogz | **defer** | Agent tooling, pass 2 |
+| `.omp/agent/config.yml` | Vertical | **defer** | Not oh-my-posh — separate agent tool; deferred |
+| `.npmrc` | Inir, Rogz | **secret** | Contains `_auth` registry token — deferred from pass 1, goes encrypted if needed later |
+| `.yarnrc` | Noctalia | **defer** | |
+| `Pictures/Wallpapers/wallhaven-k81776.jpg` | Inir, Rogz | **defer** | Binary asset; not config |
+| `.ssh/known_hosts` | all | **drop** | (dup, listed once above) |
+
+## Universal additions not tracked by dotstate (from live `$HOME`)
+
+| Path | Decision | Notes |
+|---|---|---|
+| `.config/lazydocker` | universal | |
+| `.config/gh/config.yml` | universal | `hosts.yml` **excluded** — contains OAuth token (secret) |
+| gh extensions | universal | Declarative list in `packages.yaml` (`shared.gh_extensions`): clean-branches, commit, dash, notify |
+| `.config/oh-my-posh/` | universal | See starship→omp decision |
+| `.claude/` subset | universal | `settings.json`, `CLAUDE.md`, `commands/`, `hooks/`, `skills/` only. Never `.credentials.json`, `history.jsonl`, `projects/`, `sessions/`, caches |
+| `.ssh/config` | universal | `private_dot_ssh/config`, mode 0600 |
+
+## Decisions
+
+- **starship → oh-my-posh**: dotstate ships `starship.toml`; requirement is omp. Starship customizations (catppuccin-style palette, git status verbosity, language modules, transient prompt) ported into `~/.config/oh-my-posh/prad.omp.json`. Fish init switched from `starship init fish` to `oh-my-posh init fish`. `starship.toml` dropped from apply set. Transient prompt: omp equivalent enabled in theme.
+- **Terminal**: kitty only in pass 1. foot/alacritty configs exist in dotstate but nothing live references them.
+- **Rogz vs Noctalia**: live machine *is* Rogz-backed for fish/niri/gitconfig; Noctalia storage was stale for every diverging path inspected (fish conf.d subset, older kitty.conf, gitconfig with dead credential helpers). Pass 1 content = live. Noctalia-only artifacts worth revisiting: `kitty/koda-{dark,light}.conf` themes, `fish/conf.d/deno.fish` (folded in).
+- **Inir / Vertical-Rogz_AppleStudio / CachyOS**: deferred entirely (except tmux.conf, claimed above). Future `.role` values.
+- **systemd user units**: unit files managed, enable-state not (except session-critical via `run_once` script).
+- **Compiled tools in `~/.local/bin`**: never vendored; installed via `packages.yaml`. Only hand-written scripts ship in `dot_local/bin/`.
+
+## Secrets audit results
+
+- `fish/conf.d/secrets.fish`: live API keys (OpenAI, Groq, GitLab PAT, Linear, Tavily, etc.) → `encrypted_secrets.fish.age` via age. Key at `~/.config/chezmoi/key.txt`, distributed manually.
+- `gh/hosts.yml`: `oauth_token` → excluded from repo (gh re-auths per machine via `gh auth login`).
+- `.npmrc`: `_auth` token → deferred, not added.
+- `opencode/antigravity-accounts.json`: account state → deferred, not added.
+- Full grep for `sk-`, `ghp_`, `glpat-`, `Bearer`, `token`, `key =` run across all added content before commit; see secrets-audit issue.