dotfiles/MIGRATION-NOTES.md

dotstate → chezmoi Migration Notes (Pass 1)

Source of truth for content: live $HOME on rogz (dotstate storage snapshot may be stale). dotstate repo: ~/.config/dotstate/storage (profiles: Noctalia, Inir, Rogz, Vertical-Rogz_AppleStudio, CachyOS). Live ~/.config entries were symlinks into dotstate storage; content copied with chezmoi add --follow.

Disposition table — every dotstate synced path

Path	Profiles	Decision	Notes
.config/fish	Noctalia, Inir, Rogz	universal	Live (Rogz storage) is the superset and canonical in practice; Noctalia conf.d only had atuin.env, deno, inir-env, rustup — stale subset. secrets.fish → secret (age). Delta: Noctalia carries deno.fish (source ~/.deno/env.fish) absent from live — folded into universal conf.d with existence guard
.config/nvim (+init.lua)	Noctalia	universal	AstroNvim; static, no templating
.config/tmux/tmux.conf	Vertical-Rogz_AppleStudio	universal	Only dotstate source for tmux; verified against live. No vertical-display geometry found in it — nothing to gate
.config/kitty	Noctalia, Inir, Rogz	universal	Live wins (has goliath.conf, newer kitty.conf); Noctalia-only koda-*.conf, kitty.conf.old, get_layout.py dropped as stale
.config/yazi	Noctalia	universal	Opener rules OS-branched (xdg-open vs open); plugins/, flavors/ stay unmanaged (package-managed by ya pack)
.config/lazygit	Noctalia	universal	Static
.gitconfig	all	universal	Templated: email/name from chezmoi data. Live (simpler) wins; Noctalia extras (sonr.org credential helper, coderabbit machineId, safe.directory) are machine-state — dropped
.config/starship.toml	Noctalia, Inir, Rogz	universal	Kept (user decision; omp migration rejected). Noctalia auto-regenerates the palette block in place on linux — acceptable drift
.config/niri	Noctalia, Inir, Rogz	arch-gated	config.d/ split preserved via exact_ dir
.config/noctalia	Noctalia, Rogz, Vertical	arch-gated	Live symlink points at Vertical storage (active profile) — live wins
.config/niri-dynamic-workspaces	Inir, Rogz	arch-gated	Single config.toml, part of niri stack
.config/fontconfig	Inir, Rogz	arch-gated
.config/mimeapps.list	Noctalia, Inir, Rogz	arch-gated
.config/systemd/user	Noctalia, Inir, Rogz	arch-gated	Unit files only; *.wants/ enable-state not managed. Enable script only handles session-critical units; personal automation (brain-lens, omp-loop, rclone, hermes, voxtype) ships as files, enabled manually per-machine
.local/bins	Noctalia	arch-gated	Contains only niri-launch (referenced by niri binds) → dot_local/bin/executable_niri-launch
.bash_profile .bashrc .bash_logout	all	drop	Fish is the shell; bash files are distro defaults
.zshrc .zprofile .zshenv .p10k.zsh	Noctalia, Inir, Rogz	drop	zsh managed by cachyos-zsh-config package
.profile	Noctalia	drop	Distro default
.ssh/known_hosts	all	drop	Machine state, not config
.config/alacritty	Noctalia, Inir, Rogz	drop	kitty is the terminal (niri spawns kitty only); alacritty not live
.config/foot	Inir, Rogz	drop	Same — not live
.config/ghostty	Noctalia	defer	Installed but not primary; revisit pass 2
.config/glance	Noctalia	defer
.config/mods	Noctalia, Rogz	defer	mods config carries API endpoint config; audit before adding
.config/opencode/*	Noctalia	defer	antigravity-accounts.json is account state — secret risk; whole tree deferred
.config/vicinae	Noctalia, Vertical	defer	Arch desktop launcher; pass 2
.config/television	Vertical	defer	Vertical profile deferred
.config/mango	Vertical	defer	Vertical profile deferred
.config/illogical-impulse	Inir	defer	Inir profile deferred (future .role value)
.agents/skills	Inir, Rogz	defer	Agent tooling, pass 2
.omp/agent/config.yml	Vertical	defer	Not oh-my-posh — separate agent tool; deferred
.npmrc	Inir, Rogz	secret	Contains _auth registry token — deferred from pass 1, goes encrypted if needed later
.yarnrc	Noctalia	defer
Pictures/Wallpapers/wallhaven-k81776.jpg	Inir, Rogz	defer	Binary asset; not config
.ssh/known_hosts	all	drop	(dup, listed once above)

Universal additions not tracked by dotstate (from live $HOME)

Path	Decision	Notes
.config/lazydocker	universal
.config/gh/config.yml	universal	hosts.yml excluded — contains OAuth token (secret)
gh extensions	universal	Declarative list in packages.yaml (shared.gh_extensions): clean-branches, commit, dash, notify
.claude/ subset	universal	settings.json, CLAUDE.md, commands/, hooks/, skills/ only. Never .credentials.json, history.jsonl, projects/, sessions/, caches
.ssh/config	universal	private_dot_ssh/config, mode 0600
.config/topgrade.toml	universal	User request; topgrade in packages (AUR on arch — cargo-installed today, brew on mac)

Decisions

• starship stays: the migration plan called for porting starship → oh-my-posh; user rejected this during pass 1. starship.toml ships as universal, fish keeps starship init fish + transient prompt. oh-my-posh is not installed and not managed.
• Terminal: kitty only in pass 1. foot/alacritty configs exist in dotstate but nothing live references them.
• Rogz vs Noctalia: live machine is Rogz-backed for fish/niri/gitconfig; Noctalia storage was stale for every diverging path inspected (fish conf.d subset, older kitty.conf, gitconfig with dead credential helpers). Pass 1 content = live. Noctalia-only artifacts worth revisiting: kitty/koda-{dark,light}.conf themes, fish/conf.d/deno.fish (folded in).
• Inir / Vertical-Rogz_AppleStudio / CachyOS: deferred entirely (except tmux.conf, claimed above). Future .role values.
• systemd user units: unit files managed, enable-state not (except session-critical via run_once script).
• Compiled tools in ~/.local/bin: never vendored; installed via packages.yaml. Only hand-written scripts ship in dot_local/bin/.
• gitconfig insteadOf → pushInsteadOf: live config rewrote all GitHub https URLs to ssh, which breaks every anonymous clone (lazy.nvim, tpm, fisher) on a machine without SSH keys — i.e. the bootstrap one-liner. pushInsteadOf keeps keyless https fetches working; pushes still use ssh; private https fetches use the gh auth git-credential helper. Found by the Arch container validation.
• core.pager = git-split-diffs: npm-installed tool, not in packages.yaml (no node package management in pass 1). Interactive-only; git works without it (pager errors degrade to no pager). Same for the tea credential helper (prad.codes host only).

Secrets audit results

• fish/conf.d/secrets.fish: live API keys (OpenAI, Groq, GitLab PAT, Linear, Tavily, etc.) → encrypted_secrets.fish.age via age. Key at ~/.config/chezmoi/key.txt, distributed manually.
• gh/hosts.yml: oauth_token → excluded from repo (gh re-auths per machine via gh auth login).
• .npmrc: _auth token → deferred, not added.
• opencode/antigravity-accounts.json: account state → deferred, not added.
• Full grep for sk-, ghp_, glpat-, Bearer, token, key = run across all added content before commit; see secrets-audit issue.