nixbot

1RELEASE-PLAN-CLONE-START: https://github.com/cameronraysmith/vanixiets.git #3304 833e67133e6f87364bc316604494ebb61d8194302RELEASE-PACKAGES-ACTION: plan (#3304 at 833e67133e6f87364bc316604494ebb61d819430 onto main at f41e741270e9a382a9b1de33bbe278568f17e00f)3packages discovered: [{"name":"docs","path":"packages/docs"},{"name":"evidence-worker","path":"packages/evidence-worker"}]4RELEASE-PACKAGE-ITERATION: packages/docs5running semantic-release in packages/docs...6[5:46:21 AM] [[secure]] › ℹ  Running [secure] version 25.0.97[5:46:22 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/changelog"8[5:46:22 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/github"9[5:46:22 AM] [[secure]] › ✔  Loaded plugin "prepare" from "@[secure]/changelog"10[5:46:22 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/github"11[5:46:22 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/github"12[5:46:22 AM] [[secure]] › ✔  Loaded plugin "success" from "@[secure]/github"13[5:46:22 AM] [[secure]] › ✔  Loaded plugin "success" from "[secure]-major-tag"14[5:46:23 AM] [[secure]] › ⚠  Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode15[5:46:23 AM] [[secure]] › ✔  Allowed to push to the Git repository16[5:46:23 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/changelog"17[5:46:23 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/changelog"18[5:46:23 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/github"19[5:46:23 AM] [[secure]] [@[secure]/github] › ℹ  Verify GitHub authentication20[5:46:23 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/github"21[5:46:24 AM] [[secure]] › ℹ  Found git tag @vanixiets/docs-v0.13.0 associated with version 0.13.0 on branch main22[5:46:24 AM] [[secure]] › ℹ  Found 8 commits since last release23[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"24[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"25[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Found 2 commits for package @vanixiets/docs since last release26[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: docs(concepts): explain browser evidence comments, storage and receipts2728Change-Id: Ia7ec55a1cab44d83f4e66553426fa0d96a6a696429[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release30[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions3132Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a696433[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release34[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analysis of 2 commits complete: no release35[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"36[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"37[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"38[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/release-notes-generator" does not provide step "analyzeCommits"39[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"40[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"41[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/changelog" does not provide step "analyzeCommits"42[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"43[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"44[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/github" does not provide step "analyzeCommits"45[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"46[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"47[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "[secure]-major-tag" does not provide step "analyzeCommits"48[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"49[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"50[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins51[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"52[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"53[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins54[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"55[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"56[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins57[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"58[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"59[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins60[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"61[5:46:24 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"62[5:46:24 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins63[5:46:24 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"64[5:46:24 AM] [[secure]] › ℹ  There are no relevant changes, so no new version is released.65RELEASE-PLAN: docs 0.13.0 -> no release66RELEASE-PACKAGE-ITERATION: packages/evidence-worker67running semantic-release in packages/evidence-worker...68[5:46:26 AM] [[secure]] › ℹ  Running [secure] version 25.0.969[5:46:26 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/npm"70[5:46:26 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/github"71[5:46:26 AM] [[secure]] › ✔  Loaded plugin "analyzeCommits" from "@[secure]/commit-analyzer"72[5:46:26 AM] [[secure]] › ✔  Loaded plugin "generateNotes" from "@[secure]/release-notes-generator"73[5:46:26 AM] [[secure]] › ✔  Loaded plugin "prepare" from "@[secure]/npm"74[5:46:26 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/npm"75[5:46:26 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/github"76[5:46:26 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/npm"77[5:46:26 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/github"78[5:46:26 AM] [[secure]] › ✔  Loaded plugin "success" from "@[secure]/github"79[5:46:26 AM] [[secure]] › ✔  Loaded plugin "fail" from "@[secure]/github"80[5:46:27 AM] [[secure]] › ⚠  Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode81[5:46:27 AM] [[secure]] › ✔  Allowed to push to the Git repository82[5:46:27 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/npm"83[5:46:27 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/npm"84[5:46:27 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/github"85[5:46:27 AM] [[secure]] [@[secure]/github] › ℹ  Verify GitHub authentication86[5:46:27 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/github"87[5:46:27 AM] [[secure]] › ℹ  Found git tag v0.6.3 associated with version 0.6.3 on branch main88[5:46:28 AM] [[secure]] › ℹ  Found 2275 commits since last release89[5:46:28 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"90[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Simulated merge of pull request #3304 into main for the release plan91[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release92[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(concepts): explain browser evidence comments, storage and receipts9394Change-Id: Ia7ec55a1cab44d83f4e66553426fa0d96a6a696495[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release96[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions9798Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a696499[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release100[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): publish browser evidence on build_finished and main pushes101102Change-Id: Iefc0a86c16780cfc0e3510a99d9844416a6a6964103[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor104[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(publish-evidence): publish each distinct report once and comment only on pull requests that change it105106Change-Id: I10c6813e147769c60a45d62b4153d7de6a6a6964107[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor108[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(evidence-worker): serve browser evidence read-only from R2109110Change-Id: I74a6a4974b4dd6c81fb45a27267e87786a6a6964111[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor112[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(terranix): adopt the sciexp R2 bucket and own its lifecycle rules113114Change-Id: I72ccef728d044fca6ac751d3412629636a6a6964115[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor116[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): provision R2 evidence credentials for the effects runner117118Change-Id: If5d2b9f244dece12246fe7962d4224086a6a6964119[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor120[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 1f817ce55e449026c169c51d0db567d1c335fb93 into gitea-mq/batch/57121[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release122[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(clan): replace per-machine builder modules with a nix-builders service123124Change-Id: I190a8bbe177d27389703a5f887d3e86e6a6a6964125[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor126[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(jj): mark queued pull requests and add a dequeue key127128PR tags now show whether a PR is queued to land: an open PR with auto-merge129enabled, or carrying the merge-queue label (a stack's top), renders #N⇡130next to its bookmark. Merged (✓) and closed (✗) still take precedence, and131the reused-branch rule is unchanged. jj-pr-sync fetches the two extra fields132in the same request.133134`jj-pr dequeue`, bound to G d in jjui, withdraws the GitHub signal that135authorized landing: auto-merge is disabled, or the merge-queue label is136removed. gitea-mq treats both as a dequeue, including from an in-flight137batch. An unqueued PR is a no-op; a merged PR reports when it merged, since138a landed batch cannot be undone. Each change refreshes the tags at once.139140jj-pr-tags-rehearsal gains rows for the queued marker on a single PR and a141labelled stack top, and for every dequeue outcome, judged by the gh142mutations made.143144Change-Id: Ic011d2e749a8b10228253cf10ff018376a6a6964145[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor146[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix147148Change-Id: Ie1ca1c075cb5cc70fe50173fcc480d096a6a6964149[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release150[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep runner-control deadlines above browser setup under load151152Playwright's test deadline also covers context and page setup. Under builder153load setup exceeded the 5 s deadline, so controls failed as test-level154deadlines (infrastructure) before their own failure ran (nixbot builds 1000,1551001). Each control's failure stays bounded by its own mechanism.156157Change-Id: Ic05f5683ec74a702033b0c40688995e56a6a6964158[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch159[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge bec748fc0a820563329385f1a04e0096b94da7be into gitea-mq/batch/55160[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release161[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(jj): show pull request numbers next to bookmarks162163jj has no forge integration, so which bookmark is which PR was invisible in164`jj log` and jjui, and enqueueing meant leaving the graph for gh-dash.165166- `jj-pr-sync`, run once in a repository, registers it and caches167  `gh pr list` as a jj config file in conf.d scoped to that repository168  (`--when.repositories`). A branch name reused across PRs maps to its open169  PR, else its newest; merged and closed PRs are marked ✓ and ✗.170- A user service (launchd agent on darwin, systemd timer on Linux) runs171  `jj-pr-sync --all` every five minutes at background priority. A refresh172  that cannot reach GitHub keeps the previous mapping; a repository that no173  longer exists is unregistered; a lock prevents overlapping runs.174- An override of `format_commit_labels(commit)` keeps jj's builtin labels and175  appends each bookmark's PR number, in `jj log` and jjui alike.176- jjui, on a revision's bookmark: `G o` opens its PR; `G m` enqueues a single177  PR (auto-merge, rebase) and `G M` labels the topmost PR of a stack178  merge-queue, mirroring gh-dash's m/M. `jj-pr` applies the landing179  protocol: it refuses drafts, auto-merge on stack members, and labels on180  anything but a stack's top, and is a no-op when already enqueued. Each181  action refreshes the tags immediately.182183jj-pr-tags-rehearsal runs against a stubbed gh in scratch jj repositories:184registration and rendering (reused, merged, slash-named and PR-less185bookmarks; no leakage into another repository), --all refresh, offline186retention and unregistration, every enqueue decision judged by the gh187mutations made, no G-prefix collision with the packaged jjui's default188bindings, and drift of jj's builtin format_commit_labels.189190Change-Id: I7468279a834fb1fea2876295a64c921a6a6a6964191[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor192[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(secrets): rotate the Cloudflare effects token193194The docs preview and production effects, and the local docs recipes, used195a user API token that expires on 2026-10-24. They now use an account API196token (vanixiets-effects, expiring 2027-10-02) limited to Workers: Editor197on the account and Workers Routes: Write on the cameronraysmith.net zone,198which serves the docs custom domain. Updated in secrets/shared.yaml and in199magnetite's vanixiets-effects-secrets var; the account ID and GitHub token200are unchanged, only re-encrypted.201202Change-Id: I24963c05cb0bfc454231e0280b6709476a6a6964203[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release204[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: claude-code: 2.1.286 -> 2.1.288205206Change-Id: Iacd4ed321e4898358b12d43f02590c366a6a6964207[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release208[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix209210Change-Id: I09dee06e0e5db47e519e3bc3354891416a6a6964211[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release212[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix213[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release214[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update dependency @types/node to ^26.6.4215[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release216[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep WebKit failure screenshots in Darwin build reports217218On aarch64-darwin, Nix build users have no LaunchServices database, so WebKit's image encoder returns an empty data URL and Playwright writes a 0-byte failure screenshot without raising an error. The report validator rightly rejects empty attachments, so a WebKit product failure on Darwin kept no report. A shared test fixture now replaces a 0-byte WebKit screenshot with the latest screencast frame, or fails the attempt as infrastructure if none exists. e2e-webkit-negative-control proves that a WebKit failure keeps a real PNG.219220Change-Id: I01c2ad58cb950529278fb87dda109414ead21c09221[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch222[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): give each browser report build its own preview ports223224Darwin Nix builds are unsandboxed and share the host network, so report derivations built at once all served on localhost:4321 and raced for the workerd inspector port from 9229; one build's server broke another's tests. The report build now picks a free loopback port and passes it to Playwright as DOCS_PREVIEW_PORT, and sets DOCS_DISABLE_WORKER_INSPECTOR so astro preview opens no inspector. Local runs keep 4321 and the inspector.225226Change-Id: Ia0c3192bbfed2940fbd062e68105432e6a6a6964227[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch228[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep the homepage hero within narrow viewports229230The homepage hero uses raw <img width="400"> markup inside Starlight's .hero-html wrapper, which Starlight sizes but does not constrain. On phones the image overflowed and widened the layout viewport past the device, cutting off the logo and header search. The mobile scenario now requires no horizontal overflow and a hero image inside the viewport; it failed on all three engines before the CSS fix and passes after it.231232Change-Id: Id64a1dfa32e0a68946327dba89fc8362f7f62473233[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch234[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(docs): publish validated browser evidence from finished builds235236publish-evidence is the trusted build_finished sidecar. It finds the docs report check through nixbot's build API, validates it with its own copy of validate-report.mjs, and copies run.json, completion.json and the referenced PNG screenshots beside a deterministic receipt. Unsafe paths, symlinks, non-PNG data and identity mismatches are rejected; missing outputs are reported, never rebuilt. No effect runs it yet: storage, access and retention are undecided, so publication ends at a local --out directory. publish-evidence-rehearsal covers each case against a loopback API and a chroot store.237238Change-Id: I9adcceeed84b3fe7e7c86c572fdc8f5b5a0d7b02239[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor240[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(agents): relock root apm lock for the playwright-cli skill241242The planning-and-development plugin gained the microsoft/playwright-cli skill dependency in #3265. The root lock follows published plugin refs on main, so it could only record that dependency after the merge.243244Change-Id: I9d4bfe9b21276c10c2ef01b88c6d689389875957245[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release246[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge cb6fceccfd628dca78c94bf290a8012922987d56 into gitea-mq/batch/51247[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release248[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 81224d254ba7ee571a4299b021c7eec338b0bc48 into gitea-mq/batch/50249[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release250[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(docs): type the browser evidence tooling251252Change-Id: I356b84749e0208e8cb45b4cfa884595b6a6a6964253[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release254[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep browser evidence valid under CI build contention255256nixbot build 951 failed correct docs changes with navigation timeouts while three PRs built on magnetite. The builders run cores = 0, so each concurrent report build got NIX_BUILD_CORES=16 and started 16 workers against its own astro preview, and the validator rejected the run even where retries recovered, because it required every failed attempt to be a product failure.257258Report builds now run at most four workers. Navigations no longer have their own 10 s deadline, since a failed navigation is never product evidence. An infrastructure-class attempt, including a test deadline, is accepted only when a later attempt of the same test completed, and is counted as infrastructureRetries; a terminal one still invalidates the report. The negative controls inherit the suite's retries and require every attempt to fail with a product-class terminal attempt.259260Change-Id: I50a0cab69083ddca584cdea07880a5d7a03f0963261[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch262[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge d23c077f79b6e0df7e6f89cc5a15629882201f39 into gitea-mq/batch/49263[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release264[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(flake): track playwright-cli's flake upstream instead of a rev pin265266The input was pinned to a commit of halfwhey/nix-playwright-nightly, but267the CLI release is already fixed in pkgs/by-name/playwright-cli268(version 0.1.21, read from the flake's pins/cli/0.1.21.json), and269apm-skills-compose guards that version against the skill's apm.yml ref.270Upstream keeps every release pin (0.1.5 through 0.1.22, none ever271deleted), so tracking its default branch cannot change what we build;272the commit pin only routed this input through Renovate digest PRs273instead of the flake-updater bot like the other inputs.274275Relocking advances to 59e4df6 (the commit #3268 proposed); the CLI stays2760.1.21.277278Change-Id: If28f81c80c8c25ae75eb31597cc4413e6a6a6964279[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch280[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 3fa357c817941e5ec5128060962347991454ddc9 into gitea-mq/batch/48281[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release282[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 42d26efa13b47b99956ee33f3a973412c99b9bb1 into gitea-mq/batch/48283[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release284[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: openspec: update artifacts for 1.11.0 -> 1.14.0285286Regenerated with `just openspec-regen`. The vendored workflow skills were287last generated by 1.11.0 while the packaged CLI is 1.14.0. Every removed288line traces to OpenSpec v1.11.0's own templates, so no local text is289lost; the skill set is unchanged.290291Change-Id: I30a25ccf3763955308b686890f9e10786a6a6964292[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release293[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix294295Change-Id: Idfa8f8dee160ce27f5c3a900de4c4e616a6a6964296[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release297[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(darwin): stop the DNS resolver check aborting activation298299The post-activation check read the active resolver with300`scutil --dns | awk '... { print; exit }'`. awk exited after the first301match while scutil was still writing; scutil then died of SIGPIPE, and302under the activation's pipefail the `$(...)` assignment failed with 141303and set -e aborted activation (seen on stibnite once its resolver list304grew). awk now keeps reading to the end and prints only the first match.305306Change-Id: I677b7ec56ea4b1350aceeb8f3d4304156a6a6964307[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch308[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: ci: evaluate without import-from-derivation309310nixbot now evaluates with allow-import-from-derivation = false, through311NIX_CONFIG on its unit, which nixbot forwards into its evaluator sandbox;312buildbot-nix and interactive use are unaffected. `just check-ifd` runs the313same evaluation locally for all three systems without building anything.314The flake deliberately leaves the setting out of nixConfig: with315accept-flake-config it would override both the command line and nixbot's316NIX_CONFIG.317318preferences-nix-development records the rule: why IFD is avoided, the319IFD-free patterns, the enforcement, and the bar for an exception.320321Change-Id: I98fc5ca74a8db78ac2dd8bc96f97a0e66a6a6964322[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release323[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(cryolite): require import-from-derivation-free rendering324325The cryolite tree and the capi-cryolite render must evaluate on every326system with import-from-derivation disallowed: charts, CRDs and upstream327YAML enter evaluation only as committed JSON goldens or flake-input328files, and a sandboxed regulator re-renders and diffs them. Adds R17,329SP24 and AC24 to the charter, requirements and tasks to both OpenSpec330changes, tightens the platform VM regulator's chart sourcing, and331corrects the statements that still listed the retired nixidy checks.332333Change-Id: I25b495d6d47706cc95b1432f4173d9b76a6a6964334[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release335[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(checks): retire the local k8s and nixidy checks336337The k8s-manifests-local*, nixidy-*-local-k3d and k8s-cilium-compat checks338and the k8s-deploy-* apps in apps-build rendered Helm charts and YAML at339evaluation time, about 29 evaluation-time builds per system for output340identical on every system. The local cluster is a frozen prototype; the341code stays and remains buildable on demand. The cryolite programme342reintroduces cluster checks with IFD-free rendering.343344Change-Id: Ie302e3d90e4f0b754b2014694eff54866a6a6964345[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release346[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(omnigent): test the credential policy without a synthetic clan machine347348omnigent-worker-credentials evaluated a synthetic clan machine over a349committed tree of fake sops secrets, only so clan's sops backend would350resolve vars paths, and mostly asserted that options forwarded those351paths. It also needed import-from-derivation.352353- flake.lib.omnigentCredentialPolicy is the one pure boundary from clan354  vars to the worker credential policy; the Home Manager module consumes355  only the policy record, including the rendered Linear credentials.356- Value-level cases cover what the boundary decides: disabled sources are357  omitted, Linear requires the rendered template, no Linear means no358  template.359- Delivery ordering (secrets installed before workers start, readiness in360  the host unit, rendered template required instead of the raw key) is361  asserted on the real worker hosts: magnetite, pyrite and stibnite.362- Runtime behaviour (credentials.py readiness, the TS loader, gh and363  Linear mocks, disclosure audit) stays a hermetic build fed synthetic364  paths.365366The fixture tree and the forwarding assertions are deleted.367368Change-Id: Iafadccceba9fa05233c7ede63ceb61c36a6a6964369[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release370[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(catppuccin): read bottom and starship themes from flake inputs371372catppuccin's bottom and starship ports importTOML their theme from373whiskers build outputs, the only import-from-derivation in the374configurations of christophersmith, janettesmith, raquel, tara and375ubuntu. Both ports stay enabled and read the committed themes/ of the376same upstream revisions, pinned as flake = false inputs.377378Change-Id: Ia61f24b77f899c75edae5055a7f9f22b6a6a6964379[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch380[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(skills): enumerate skills from a committed index381382Skill delivery read the built apm-skills-compose output with readDir at383evaluation and wrapped every skill in builtins.path, realising that384unsubstitutable output once per skill per sink (514 realisations per AI385user, 1028 for stibnite). Every NixOS, darwin and home configuration of386the AI users therefore needed a builder for its own platform just to387evaluate.388389- pkgs/by-name/apm-skills-compose/skills.json lists the composed skill390  names; the compose build fails, printing the corrected index, when the391  two drift, and `just agents-skills-index` regenerates it.392- Skills are `"${composed}/.claude/skills/<name>"` strings with context:393  no read, no builtins.path. Home Manager passes such sources through.394- aiSkills.extraSkillDirs (directories read with readDir) is replaced by395  aiSkills.extraSkills (name to directory) for linear-cli, tuicr and396  omnigraph.397398The delivered skill set is byte-identical: 696 home.file entries per AI399user before and after.400401Change-Id: If1ae8e9f5a648670680e900fdf37ceac6a6a6964402[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release403[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(nixpkgs): expose flake packages only for supported systems404405nixpkgs re-applies the default overlay to nested package sets such as406pkgsi686Linux. withSystem on i686-linux then evaluated a whole perSystem407whose packages read per-system flake outputs that do not exist there408(playwright-cli), so nixosConfigurations.scheelite failed to evaluate409with `attribute 'i686-linux' missing`. The overlay now adds the flake's410packages only for systems in config.systems.411412Change-Id: Iab8193713bde096ba3b9543ffa3e48fa6a6a6964413[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch414[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(incidents): record the magnetite concurrent-evaluation OOMs415416Accounting for the 2026-09-27 and 2026-10-01 OOM kills: nixbot's417evaluation overlapping a remote check-fast evaluation, the swap-blind418nix-eval-jobs governor, the uncharged zram pool, and victim selection by419nix-daemon's OOMScoreAdjust; the mitigations shipped and the measurements420left for phase two.421422Change-Id: Ifa6aeee15ba01cd5f7711787f65f55626a6a6964423[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release424[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(just): choose the remote host for check-fast425426check-fast takes a fourth parameter, remote (magnetite by default, or427pyrite), and sizes evaluation for it: magnetite keeps 4 eval workers,428pyrite runs 2 with a 2 GiB per-worker cap. Remote evaluations now queue429behind nixbot's on the host lock. The skill, agent-context fragment and430docs describe the parameter and the waiting message.431432Change-Id: I367b756e6a4ec00cf61bd42ebd398b136a6a6964433[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor434[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(magnetite,pyrite): enable the evaluation lock and memory guards435436Both hosts enable the evaluation lock and MGLRU protection. pyrite also437caps zram's resident pool at 55% of RAM, the recorded livelock mode;438gives nix-daemon OOMScoreAdjust 250 and user@ -100, so builds and439evaluators are killed before niri and DankMaterialShell; and caps its two440omnigent workers at 8G combined, which previously could reach 16G on a44115.5 GiB machine. Stale headroom comments on magnetite and in buildbot.nix442are corrected. nixbot's worker count, memory limits and magnetite's zram443are unchanged. nix-eval-lock-wiring asserts nixbot and buildbot resolve444nix-eval-jobs to the wrapper on both hosts.445446Change-Id: Iba3b9e2f3975daae2e61dee23989ff416a6a6964447[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor448[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(nixos): add memory-pressure guards and an omnigent slice cap449450services.memoryPressureGuards enables MGLRU thrashing protection451(min_ttl_ms = 1000), which makes sustained thrashing end in a prompt452kill instead of a livelock. services.omnigent-host.workerSliceMemoryMax453places all omnigent workers in one omnigent.slice with a combined454MemoryMax; unset keeps the existing per-unit limits.455456Change-Id: Ib183fb9a53c9cd7c920166b1f486d1096a6a6964457[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor458[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(nix): serialize nix-eval-jobs behind a host-wide evaluation lock459460Two concurrent nix-eval-jobs evaluations on magnetite (nixbot's 8 workers461plus a remote `just check-fast`) exhausted RAM and zram twice. A wrapper462now takes an exclusive flock on /etc/nix/eval.lock before evaluating, so463evaluations on a host queue instead of overlapping; a waiter prints every46430 s which process holds the lock and since when (or that the holder is465not visible from its sandbox). The evaluator then raises its own466oom_score_adj to 900: nix-eval-jobs requeues a worker the kernel kills,467so it is the cheapest victim.468469services.nixEvalLock provides the wrapper; nixbot, buildbot-nix and the470home-manager nix-eval-jobs on PATH use it when enabled, which also covers471remote nix-fast-build sessions. nix-eval-lock-rehearsal drives the472wrapper: uncontended exec, waiting with and without a visible holder,473release on holder death, exit status propagation.474475Change-Id: I9e6643ac44790eb0ffe00294d082b5956a6a6964476[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor477[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix478[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release479[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update cloudflare-workers-tooling480[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release481[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs: describe both verdict wiring negative fixtures482483Change-Id: Ied7532ff7d45fdf5c6e2c2feb7412d246a6a6964484[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release485[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): run report verdict CLI through symlinked paths486487Change-Id: I2084d4f6f61b99a554bb7330b8ae09136a6a6964488[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch489[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): retain browser regression evidence and version observations490491Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964492[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch493[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: test(nix): verify report dependencies and aggregate capabilities494495Change-Id: If6d1644ec30318b99cf7addf56e59b2a6a6a6964496[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release497[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(effects): require permission guards for credentialed build-finished events498499Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964500[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch501[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs: specify the closed-loop web verification reference design502503Change-Id: If14f8d7b146627ee546faa5eacbd97cc6a6a6964504[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release505[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(docs): preserve browser evidence behind a required verdict gate506507Change-Id: Iaf02384766e531cc30c510abd62877cf6a6a6964508[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor509[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): support build-finished event registration510511Change-Id: I0489702282e4a89827bcd0b02a3caa906a6a6964512[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor513[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(ai): compose Playwright skills through shared APM capabilities514515Change-Id: Ifef0eea7fb531d088f68e89f482799a16a6a6964516[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor517[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(packages): add pinned Playwright CLI with matching browsers518519Change-Id: I1c568c44d8960ffd22c1bdb04965b3826a6a6964520[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor521[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix522[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release523[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate flake.lock524[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release525[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(deps): update dependency @astrojs/starlight to v0.42.5526[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch527[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update dependency argoproj/argo-helm to argo-cd-10.9.6528[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release529[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(omp): plan with Opus 5.5 instead of Fable530531Opus 5.5 now runs planning as well as the session and delegated work,532so the plan comes from the model that executes it, at 40% of Fable's533price. Fable stays available when picked deliberately, and the Anthropic534server-side fallback stays on for those sessions.535536Change-Id: Ic790baf18c08c434908f94e7fb52c7446a6a6964537[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor538[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(atomic): use Opus 5.5 instead of Opus 5539540atomic stayed on claude-opus-5 because its bundled model registry541(@bastani/pi-ai) did not know claude-opus-5-5. Since atomic 0.9.24 it542does (providers/data/anthropic.json; `atomic --list-models` lists it),543so the Opus fallback, the codebase-* research agents and the Opus544thinking level move to claude-opus-5-5, matching omp and Claude Code.545The omp comment recording the exception is removed.546547Change-Id: I4722e4acb437418ce1dc6d024b61f9526a6a6964548[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor549[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(claude-code): default to Opus 5.5 instead of Fable550551The session model was Fable 5.1 with Opus 5.5 only for subagents. Opus5525.5 is now the default for both: `model = "opus"`, which resolves to553claude-opus-5-5 through ANTHROPIC_DEFAULT_OPUS_MODEL. Fable stays one554alias away (ccfable) and keeps its medium effort setting.555556fallbackModel moves from Opus, which is pointless as its own fallback,557to Sonnet 5.558559Change-Id: Ic5cd168d981e22c119a154e8d41fa1796a6a6964560[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor561[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(moshi): reconcile hooks after managedConfigs562563moshi-hook install writes into every supported agent's config, devin's564included, which turned devin's store symlink into a regular file and565made every second activation block on a .before-home-manager backup566collision. The reconcile step was ordered after a hand-kept list of four567per-agent steps that did not include devin.568569It now runs after the single managedConfigs step, which rewrites every570file moshi touches, and managed-config-wiring asserts both halves: every571config moshi writes for an enabled agent is a managed config and none is572also a home.file target, and moshi orders after managedConfigs.573574Change-Id: I086a785cc40a31183d04eb0d4778ed426a6a6964575[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch576[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(ai): manage agent config files with managedConfigs577578Eleven agent configuration files moved from five mechanisms (install579copies behind mutableSettings toggles, a shallow jq merge, two deep yq580merges, and plain store symlinks) to managedConfigs:581582- replace (no app-owned keys): claude-code and its glm and cerebras583  wrappers, codex, pi, devin, openspec, omp WATCHDOG.yml;584- with app-owned keys: atomic (onboarding and changelog versions), omp585  config.yml (setupVersion, dev.autoqaConsent), omnigent (host identity586  and server, 0600).587588The mutableSettings options, six activation steps, the three merge589scripts and flake.lib.omnigentMergeConfig are removed. devin and590openspec no longer render store symlinks; openspec declares591completionTipSeen and atomic declares enableAnalytics = false so the592first activation keeps both. crs58 declares the omp UI preferences593(tui.vimMode, tui.vimModeDisplay, composer.shape) instead of relying on594runtime state. The atomic, omnigent-worker and pi-agent-environment595checks exercise the new program and wiring.596597Change-Id: Ie3e1e56e8b65f66e1df9bf289b3522046a6a6964598[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release599[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(home): add managedConfigs for files applications also write600601A configuration file that its application rewrites at runtime cannot be602a home-manager store symlink: the first runtime write replaces the link603with a regular file, the next activation backs it up, and the one after604collides with that backup and blocks.605606managedConfigs.<name> writes such a file as a real file on every607activation: the declared settings, plus the `appOwned` key paths copied608from the existing file. Every other key is dropped and reported by name,609never by value, so state that leaked in at runtime is either declared,610listed as app-owned, or removed, and keys Nix stops declaring are611retracted. `externalPaths` keeps subtrees that a later activation step612rewrites out of the report. Writes are atomic, honour `fileMode`, and a613target that cannot be read is left untouched when app-owned keys would614have to be preserved from it.615616The module lives in modules/home/modules beside agents-md because it is617not specific to any aggregate. managed-config-rehearsal drives the618program over json, yaml and toml targets, including preservation,619retraction, the name-only report, unreadable targets, file modes and620multi-spec failure.621622Change-Id: I989f1589b7c10542e045a9c4c88308c36a6a6964623[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor624[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix625626Change-Id: Id494be9893dc2095a1fe045d6b3d6e8a6a6a6964627[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release628[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(apm): relock apm.lock.yaml for the linear-cli dependency629630Records schpet/linear-cli at 196315343d2b (v2.6.0), added to631planning-and-development by #3262, with the ownership ledger for the 22632files its skill deploys, and moves the self-dependency entries to d5d75ca5.633apm 0.32.0; 173 skills deployed.634635Change-Id: I45b6531bef4542b526eb8373ffc445cd6a6a6964636[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release637[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 3fb87c3881da98fe3f2b18b60ffeeccd9953f25a into gitea-mq/batch/43638[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release639[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 19610a72e7d680cd426bdb52d58795935f22ac15 into gitea-mq/batch/43640[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release641[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(flake): track niri-flake and zen-browser upstream instead of rev pins642643The pyrite desktop check once asserted niri-flake's revision as a literal,644so every flake-updater lock bump failed by construction (#3101, #3102,645#3169). #3232 answered that by pinning the URL by revision and having the646check assert `pinnedToDeclaredRev`, which passes only when flake.nix names647a revision: the check enforced the pin it was meant to justify, and648niri-flake and zen-browser moved to Renovate digest PRs while every other649unpinned input goes through the flake-updater bot.650651Both inputs now track their upstream default branch like the rest, and652the two pinnedToDeclaredRev clauses and their helpers are gone. The653behavioural assertions stay: niri's options come from nixpkgs' module,654and the installed Zen package is the one zen-browser provides, built655against our nixpkgs. dms-src keeps its release-tag pin, which encodes a656real coupling to nixpkgs' dms-shell version.657658Relocking advances niri-flake to dd2f795 (the commit #3261 proposed);659zen-browser's upstream head is the commit it was pinned to.660nixos-pyrite and every pyrite-* check build on x86_64-linux.661662Change-Id: I16223a5ba0d1e1889c94f935d868a9aa6a6a6964663[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch664[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(skills): list companion skills for marketplace consumers665666Add a Companion skills section to the consuming-marketplace-plugins guide667with upstream `apm install` lines for omnigraph, tuicr, duckdb-skills,668dagster-expert, hf-cli and huggingface-datasets. They complement669plugins here but are deliberately not bundled: bundling would add their670descriptions to every consumer's sessions and hold them at our pins.671Each command was run with apm 0.32.0 and installs exactly the named672skills; tagged upstreams use release tags per the pinning policy, the673tagless ones carry commit SHAs with the policy's caveat.674675Transitive dependencies now names the linear-cli skill that676planning-and-development brings.677678Change-Id: I99457cfd1e89b6128737470e9d3a8ded6a6a6964679[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release680[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(omnigraph): deliver the upstream omnigraph skill with the client681682Wire `${programs.omnigraph.package.src}/skills` into aiSkills.extraSkillDirs,683as tuicr does, so the skill comes from the same pinned source the client684and server are built from and always describes the deployed version685(currently v0.11.0).686687The definition lives on the ai aggregate in the same file, guarded on the688omnigraph option existing and being enabled: tools reaches users without689ai (christophersmith, janettesmith, raquel, tara), where an aiSkills690definition would fail to evaluate.691692Change-Id: I4ae90fe76122ef1c0423bb07a4b917e66a6a6964693[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor694[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(skills): propagate the linear-cli skill through planning-and-development695696openspec-linear-sync, which planning-and-development ships to marketplace697consumers, drives the linear CLI, but the upstream linear-cli skill698reached only Nix users (flake.lib.linearSkillDirs). A consumer who699installed the plugin with apm got a skill whose dependency was missing.700701- apm.yml declares `git: schpet/linear-cli`, ref 196315343d2b (the v2.6.0702  tag commit), `skills: [linear-cli]`; a scratch-project703  `apm install schpet/linear-cli/skills/linear-cli#<sha>` with apm 0.32.0704  installs exactly that skill.705- pkgs.linear-cli.src pins that commit instead of the tag name, so one706  pin serves the package, apm's offline cache in apm-skills-compose, and707  the drift guard. update.sh resolves the tag commit and rewrites both708  package.nix and the apm.yml ref, and its platform map now lists only709  the two Darwin binaries package.nix pins (Linux builds from source; the710  Linux prefetches were downloads with no hash line to update).711- apm-skills-compose pre-seeds the cache from pkgs.linear-cli.src and712  guards the apm.yml ref against it; the composed tree goes from 172 to713  173 skills.714- Nix delivery is unchanged: linear-cli joins excludedUpstreamSkills, and715  Nix users keep receiving it from linearSkillDirs only where they opt in,716  from the same pin.717718Change-Id: I048122dca5256fb58cc503d4c19fd4b06a6a6964719[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor720[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(omnigraph): fail startup fast and bootstrap new storage roots once721722Deploying #3257 stalled magnetite's switch-to-configuration for the full723start timeout. omnigraph-server v0.11.0 loads the cluster ledger and opens724every graph before binding, and any boot failure (here725[cluster_state_missing] on the new, never-applied dev-graph-v9 root)726exits the process within seconds. The ExecStartPost readiness probe kept727polling /healthz until readinessTimeout because it never noticed the main728process had died.729730Readiness probe (flake.lib.omnigraphReadinessProbe):731- polls /readyz and exits 1 at once when $MAINPID is gone, naming the732  journal and the apply remedy;733- treats quarantined graphs and, under requireAllGraphs, fewer served734  graphs than declared as permanent: the server has no runtime graph735  registration, and an imported-but-never-applied root boots empty yet736  passes /healthz;737- keeps 503 and ready=false transient until the timeout.738739Create-once bootstrap (flake.lib.omnigraphBootstrap, unit740omnigraph-cluster-bootstrap, option cluster.bootstrap.enable, default on741with the cluster): `cluster status` decides whether the root has state,742and a marker at <parent>/_omnigraph-markers/<root>.initialized (outside743the root's key prefix, so deleting the root never deletes it) records744that it ever had state:745- state and marker: nothing;746- state, no marker: adopt the existing root by writing the marker;747- no state, no marker: first initialization, runs the existing748  converge program, then writes the marker;749- no state, marker: a lost root; refuse without applying.750That initializes a new storageUri on deploy while keeping the protection751that holds apply.auto off: a lost root is never recreated empty. S3752markers use curl SigV4 path-style requests with credentials passed on753stdin; local roots must sit under /var/lib/omnigraph, the only directory754the hardened units can write. The server Wants (not Requires) the755bootstrap, so a refusal stays visible and the server then fails fast.756757Checks: omnigraph-readiness-rehearsal and omnigraph-bootstrap-rehearsal758drive the real scripts against loopback HTTP/S3 stubs and a stub CLI759(every probe outcome; the truth table for both marker backends, apply760and status failures, S3 errors, missing endpoint, rejected roots,761SigV4 path-style signing). omnigraph-wiring asserts magnetite's unit762ordering and that the server's ExecStartPost is the new probe.763764Change-Id: I931bf6ff300ba859422474546798e1d96a6a6964765[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch766[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(apm): relock apm.lock.yaml against main and apm 0.32.0767768Follows #3257. The vanixiets self-dependency moves to 8aa5fb47; the769transitive worktrunk and mergify-cli entries move to the v0.80.0 and7702026.9.16.1 commits that version-control-and-forge/apm.yml now pins; the771comment-cleanup ledger records uncomment.toml instead of772uncommentrc.toml; content hashes follow the updated skills.773774Change-Id: I5a8c3678bf1382d0eaf1a42edb5a5b556a6a6964775[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release776[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(apm-skills-install): relock from an empty apm_modules cache777778apm 0.32.0 `install --update` re-fetches an already-materialized779dependency only when its ref is a semver range780(should_force_ref_recheck, src/apm_cli/drift.py:174-193). A literal781commit pin that changed in a dependency's own manifest reuses the cached782checkout and writes the old resolved_commit back into apm.lock.yaml.783Plain `apm install` does detect that drift; --update does not.784785Observed after #3257 moved the worktrunk and mergify-cli refs in786version-control-and-forge/apm.yml: the relock kept de0052d8 and787727ce50b. Relock now removes the git-ignored apm_modules/ cache first,788so every dependency is resolved from its declaring manifest. Ownership789of deployed files lives in the lockfile ledger, so the only cost is a790re-fetch.791792Reproduced and verified: with main's lock and the old worktrunk checkout793materialized, the patched relock resolves b49ca7ee/e7c1ebbc and matches794a cache-free relock byte for byte apart from generated_at.795796Change-Id: I802a23af0d15cbaa526857556f6eede06a6a6964797[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch798[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(omnigent): 0.15.0 -> 0.16.0799800Upstream: https://github.com/omnigent-ai/omnigent/compare/v0.15.0...v0.16.0801802omnigent, omnigent-client and omnigent-ui-sdk move together (wheel803hashes from the PyPI JSON digests). Only the version-locked pins change804in pyproject; the existing relaxations and overrides still hold.805806acp-readiness.patch is still needed (0.16.0 still reports acp readiness807only for the bare `acp` harness) and is rebased: the ACP branch moved808into _harness_availability_core behind a new Windows guard. The readiness809test passes in the build.810811Upstream breaking notes #8137/#8143 (65,535-byte caps on saved812preferences and inference snapshots) affect server-side data only. The813host CLI surface, config keys and environment variables our modules use814are unchanged.815816Change-Id: I242bf10d54e879d31acbef5573af65ed6a6a6964817[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release818[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(mergify-cli): 2026.8.31.1 -> 2026.9.16.1819820Upstream: https://github.com/Mergifyio/mergify-cli/compare/2026.8.31.1...2026.9.16.1821822Bumps mergify-cli-bin and, in lockstep, agent-plugins/mergify-cli823(version, releaseTag, tag commit) and the version-control-and-forge824apm.yml ref.825826#1833 removes `mergify stack push --github-native`: native stack827registration is now the default (opt out with --no-github-native or828mergify-cli.stack-github-native=false). The git-stacked-pr-integration829skill and the adopt-queue-landing-protocol specs now publish with830`mergify stack push --trunk origin/main -R` and require the default to831stay on; the ADR note and its review keep their history with a dated832note.833834#1803/#1806/#1807 add `mergify auth login|logout|status`; the835mergify.nix comment now documents the non-stack credential chain.836837Change-Id: I323e343a51842dcf02a1a198766125796a6a6964838[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release839[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(nix-fast-build): do not propagate python into consumers840841The package's propagated build inputs put its site-packages on842PYTHONPATH in every devshell that includes it, which overrides the843wrapper of any other nix-fast-build binary run from that shell (a newly844built one loads the old module). Remove845$out/nix-support/propagated-build-inputs in postFixup, exactly as846upstream's default.nix does.847848Change-Id: I5ce01d321cdfe1770858b78250f573856a6a6964849[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch850[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(nix-fast-build): 1.6.0 -> 2.0.4851852Upstream: https://github.com/Mic92/nix-fast-build/compare/1.6.0...2.0.48538542.x renders build logs itself: nix-output-monitor is dropped from the855wrapper PATH, --no-nom now selects the non-interactive renderer, and856interactive mode turns itself off without a TTY. --no-link is a857deprecated no-op (no out-links is the default), so check-fast stops858passing it. Every other flag our recipes pass is unchanged; --option now859reaches every nix call. The CI/CD skill's --no-nom description follows.860861Change-Id: Icc74b794021b6725bbdc47cd2277bc356a6a6964862[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release863[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(worktrunk): 0.76.0 -> 0.80.0864865Upstream: https://github.com/max-sixty/worktrunk/compare/v0.76.0...v0.80.0866867Bumps worktrunk-bin and, in lockstep, the agent-plugins/worktrunk source868and the version-control-and-forge apm.yml ref (the apm-skills-compose869drift guard requires both to name the v0.80.0 commit).870871Breaking upstream changes (0.77-0.80): wt list --format=json defaults to872schema 2; hook JSON context keys renamed to worktree_path / repo_path /873repo / primary_worktree_path; `wt config update --print` removed;874oh-my-pi plugin moved to `wt config plugins omp`; `{{ branch }}` unset in a875detached worktree. None is used here: the only config is876programs.worktrunk enable + package.877878Change-Id: I08b82b5e98fec40122348980c3481fb76a6a6964879[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release880[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(uncomment): 3.6.0 -> 3.10.2881882Upstream: https://github.com/Goldziher/uncomment/compare/v3.6.0...v3.10.28838843.8.0 makes .uncomment.toml the preferred config name (.uncommentrc.toml885still loads with a deprecation warning) and makes unknown config keys a886load error; scan, keep and lint subcommands are new.887888Rename the repository-root config to .uncomment.toml and the889preferences-comment-cleanup template to uncomment.toml. The skill now890states behaviour measured against 3.10.2: census via `scan --only891removable --group-identical`, `keep --id` to write ~keep markers, and892`--check` as the completion gate. XXX and tflint-ignore are default-kept893now, so the template drops them.894895Change-Id: Ie379fdf60fa2c6e5650467189469dc856a6a6964896[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release897[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(ouroboros): 0.42.0 -> 0.55.3898899Upstream: https://github.com/Q00/ouroboros/compare/v0.42.0...v0.55.39009010.55 pins mcp==2.0.0 in the [mcp] extra and mcp==1.28.1 in902[claude]/[claude-sdk] and declares them conflicting, so the old903`ouroboros-ai[mcp,claude,tui]` spec no longer resolves. Following the904upstream README, the wrapper uses [mcp,claude-cli,tui] with905`uvx --isolated --python '>=3.12'`, and the claude-code MCP server entry906uses [mcp] with `--runtime claude-cli --llm-backend claude_code`, as907upstream's own .mcp.json does, keeping our exact version pin.908909agent-plugins/ouroboros moves to the v0.55.3 tag peel.910911Change-Id: I5ac2e15a511b418dc5fa5bb5cbad3f2b6a6a6964912[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release913[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(omnigraph): 0.9.0-unstable-2026-08-05 -> 0.11.0914915Upstream: https://github.com/ModernRelay/omnigraph/compare/12a8596626c80a7dceed0fd72182d421052ff8d1...v0.11.0916917The unstable pin existed only because upstream published no releases;918it now does, and v0.11.0 contains the old pin. rev stays a commit sha919(the v0.11.0 tag peel) because OMNIGRAPH_SOURCE_VERSION is read from920src.rev and upstream stamps it with a sha. update.sh now tracks the921latest stable vX.Y.Z release instead of main.922923The lance-linalg AVX-512 VNNI postPatch moves to lance-linalg-11.0.0;924the three deleted lines are still present verbatim there.925926Cluster config migrated to the v0.11.0 policy schema (strict since927v0.9.0):928- server.policy.yaml drops `kind`; a bundle's kind follows its929  `applies_to` in cluster.yaml, which already scopes it to `cluster`.930- dev.policy.yaml drops the `stream_ingest`/`stream_manage` rules and931  the `cluster` group: upstream removed the RFC-026 streaming-ingest932  path (e1cd395) before v0.9.0, loads go through `change`, which933  operators already hold, and cluster apply no longer evaluates policy.934- the omnigraph-cluster wrapper passes `--as` to `apply`/`approve` only;935  `cluster stream` no longer exists.936937Deploy note: the old pin wrote internal manifest schema v19, an938abandoned format that 0.11 refuses and that `omnigraph upgrade` cannot939migrate. magnetite's storageUri therefore moves to a parallel root940(clusters/dev-graph-v9), following upstream's upgrade.md "same graph ID941in a parallel cluster root" procedure; the old root is untouched as the942export source and rollback copy. Carrying data over is a manual943export (old binary) / load (new binary) on magnetite.944945Change-Id: I4db767af7224204fa83f52a56b7f96e86a6a6964946[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release947[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(buzz): 0.5.20 -> 0.5.26948949Upstream: https://github.com/block/buzz/compare/desktop-v0.5.20...desktop-v0.5.26950951Only the shared source changes (src hash, passthru.rev, vendored cargo952hash); buzz-cli, git-credential-nostr and git-sign-nostr inherit it. The953line references in their comments are unchanged at the new tag.954955Change-Id: If97c50c44e8c19db3d109f98c235b15d6a6a6964956[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release957[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(no-mistakes): 1.60.2 -> 1.84.0958959Upstream: https://github.com/kunchenguid/no-mistakes/compare/v1.60.2...v1.84.0960961No release in the range is marked breaking. The package's assumptions962hold: internal/buildinfo.Version, empty telemetry host defaults, and the963NO_MISTAKES_TELEMETRY / NO_MISTAKES_NO_UPDATE_CHECK variables.964965Change-Id: Ie2d6877297cee4239c1b0f66f3faf4936a6a6964966[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release967[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(treehouse): 2.1.1 -> 3.1.0968969Upstream: https://github.com/kunchenguid/treehouse/compare/v2.1.1...v3.1.09709713.0.0 makes `treehouse return` (and `treehouse get` when its subshell972leaves the worktree dirty) exit 3 instead of 0; callers need --force or973must treat 3 as not-returned. 3.0.1 adopts pre-3.0 pool state974automatically. The only consumer, modules/home/ai/firstmate, lists the975package without invoking it. The -X main.version ldflag and976TREEHOUSE_NO_UPDATE_CHECK still exist. vendorHash is unchanged.977978Change-Id: I9e8389a12507f0270db99e2fa9f03b616a6a6964979[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release980[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(atomic): 0.9.19 -> 0.9.24981982Upstream: https://github.com/bastani-inc/atomic/compare/0.9.19...0.9.24983984update.sh verified the npm tarball against the registry sha512,985regenerated npm-dist-repairs.patch and manifest.json, and learned the new986npmDepsHash from the build.9879880.9.20 renames TYPESAFE_AI_API_KEY to TYPESAFE_API_KEY and the Jev router989models from typesafe-ai/jev* to typesafe/jev-latest; nothing here uses990either. 0.9.21-0.9.24 are features and fixes.991992Change-Id: Ic89cc417078e62bf7f338e24d6bcd3e16a6a6964993[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release994[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6995996Upstream: https://public.cdn.getdbt.com/fs/versions.json (latest.tag v2.0.6)997Repository: https://github.com/dbt-labs/dbt-fusion998999dbt Fusion is out of preview. Upstream no longer publishes the standalone1000dbt-lsp artifact (fs/lsp/fs-lsp-v2.0.6-* returns 404; install.sh says to1001run `dbt lsp` instead), so the package builds one src per platform and no1002longer installs bin/dbt-lsp. update.sh drops the LSP fetch and rewrites1003the single per-platform hash.10041005BREAKING CHANGE: pkgs.dbt-fusion no longer provides dbt-lsp; use1006`dbtf lsp`. Nothing in this repository referenced dbt-lsp.10071008Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a69641009[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is major1010[5:46:32 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analysis of 2275 commits complete: major release1011[5:46:32 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"1012[5:46:32 AM] [[secure]] › ℹ  The next release version is 1.0.01013[5:46:32 AM] [[secure]] › ℹ  Start step "generateNotes" of plugin "@[secure]/release-notes-generator"1014[5:46:37 AM] [[secure]] › ✔  Completed step "generateNotes" of plugin "@[secure]/release-notes-generator"1015[5:46:37 AM] [[secure]] › ⚠  Skip step "prepare" of plugin "@[secure]/npm" in dry-run mode1016[5:46:37 AM] [[secure]] › ⚠  Skip v1.0.0 tag creation in dry-run mode1017[5:46:37 AM] [[secure]] › ⚠  Skip step "publish" of plugin "@[secure]/npm" in dry-run mode1018[5:46:37 AM] [[secure]] › ⚠  Skip step "publish" of plugin "@[secure]/github" in dry-run mode1019[5:46:37 AM] [[secure]] › ⚠  Skip step "success" of plugin "@[secure]/github" in dry-run mode1020[5:46:37 AM] [[secure]] › ✔  Published release 1.0.0 on default channel1021[5:46:37 AM] [[secure]] › ℹ  Release note for version 1.0.0:1022# 1.0.0 (https://github.com/cameronraysmith/vanixiets/compare/v0.6.3...v1.0.0) (2026-10-03)10231024    * chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6 ([3ad03e9](https://github.com/cameronraysmith/vanixiets/commit/3ad03e9457194869f340fa607bf9b98fa1ff89c5))10251026### Bug Fixes10271028    * **agents-md:** lint vim rewrap at col 80 ([cb866ad](https://github.com/cameronraysmith/vanixiets/commit/cb866add13d017d240c71fdf5baee91fb09a5a61))1029    * **agents-md:** nits ([da4b7da](https://github.com/cameronraysmith/vanixiets/commit/da4b7da98f8a5a1e780594aafeb0c075ba5fb1ba))1030    * **agents:** record every deployed skill in the lockfile ledger ([0d55418](https://github.com/cameronraysmith/vanixiets/commit/0d5541887ae85249b89c7a7d3273ff1c3e66938d))1031    * **agents:** validate instructions packages, not just skills packages ([a294e05](https://github.com/cameronraysmith/vanixiets/commit/a294e0572edc55ce57c5b9abd69f4ce8fb9615d7))1032    * **ai:** declare .apm/skills container in plugin manifests ([3443101](https://github.com/cameronraysmith/vanixiets/commit/3443101f4c44f620ede4814497542349998b28e9))1033    * **apm-skills-install:** relock from an empty apm_modules cache ([83b45e2](https://github.com/cameronraysmith/vanixiets/commit/83b45e2dfcc2433bba713dbffd2572790006bac7)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257)1034    * **apm:** preserve offline cache hits with APM 0.31 ([4244103](https://github.com/cameronraysmith/vanixiets/commit/4244103505fcb44891e50e56ff917845e9abde8e))1035    * **apps:** add update-golem-cli ([c67213d](https://github.com/cameronraysmith/vanixiets/commit/c67213d13d6ca32fedf56637ab7dec40f9ed2811))1036    * **apps:** build apm-context-compile locally instead of querying caches ([05069eb](https://github.com/cameronraysmith/vanixiets/commit/05069eb3f2da35fdcf5b1e549f6cff655a5b7b7d))1037    * **apps:** drop update-beads flake app (beads uses nix-update-script) ([c2bacce](https://github.com/cameronraysmith/vanixiets/commit/c2baccee2a496086e2243cc13004e0617cfca59c))1038    * **apps:** drop update-dolt flake app (dolt uses nix-update-script) ([90cac5f](https://github.com/cameronraysmith/vanixiets/commit/90cac5fc8035785320e106d839298326e37ce530))1039    * **apps:** read the served marketplace manifest from apm.yml marketplace.output ([4f387cd](https://github.com/cameronraysmith/vanixiets/commit/4f387cd67fee06e5ca3a7e29f4a5818cde78565e)), closes [.#apm-marketplace-validate](https://github.com/./issues/apm-marketplace-validate)1040    * **apps:** reference seed-age-key through the per-system packages ([970c4ba](https://github.com/cameronraysmith/vanixiets/commit/970c4ba499f0b25dab9e7e8895902124c823120f))1041    * **argocd-repo-credentials:** roll local-k3d-argo-cd token ([d459a6d](https://github.com/cameronraysmith/vanixiets/commit/d459a6dbf6b899d952c0e152d75ef9f5cfdccb21))1042    * **atomic:** default new sessions to Astra medium ([541e7d2](https://github.com/cameronraysmith/vanixiets/commit/541e7d2f0969c3e0a44533536551f9b3d3c1e936))1043    * **atomic:** stop registering the statusline extension with atomic ([894558f](https://github.com/cameronraysmith/vanixiets/commit/894558f0e4f0dc42a6d1344062fc0797edfd2258))1044    * **atomic:** update to 0.9.17 ([27ad231](https://github.com/cameronraysmith/vanixiets/commit/27ad231101bfdba4d7b11be7d1f71df71eabc6c7)), closes [.#atomic](https://github.com/./issues/atomic)1045    * **atomic:** update to 0.9.18 ([add188e](https://github.com/cameronraysmith/vanixiets/commit/add188edd22874cb35743ed376a4882bc36c2cb0)), closes [.#update-atomic](https://github.com/./issues/update-atomic) [.#atomic](https://github.com/./issues/atomic)1046    * **bootstrap:** enable flakes and support hosts without systemd ([5dc2005](https://github.com/cameronraysmith/vanixiets/commit/5dc2005271d7774cd45729563b48a028a86ba9c5))1047    * **bootstrap:** trust the admin group on debian and ubuntu ([e029f9d](https://github.com/cameronraysmith/vanixiets/commit/e029f9de3e94aab7eb1c4146179441724e72acb9))1048    * **caddy:** rewrite Origin to loopback for hermes.zt dashboard WS ([c2f9e95](https://github.com/cameronraysmith/vanixiets/commit/c2f9e959d87ef4b0c3bb81e2f0e4f18e0fa63936))1049    * **casks:** remove riptide ([f86a2d3](https://github.com/cameronraysmith/vanixiets/commit/f86a2d3a96f55b86af7c38cc9b2df5972960f6f1))1050    * **catppuccin:** read bottom and starship themes from flake inputs ([e578a63](https://github.com/cameronraysmith/vanixiets/commit/e578a636c00af5bd96807537a695e35a9ddfd867))1051    * **catppuccin:** set autoEnable=true to make implicit port enrollment explicit ([3f4d4a3](https://github.com/cameronraysmith/vanixiets/commit/3f4d4a3fb13a74f29f147e7871892897e3744391))1052    * **ccstatusline:** declare settings version 4 for ccstatusline 2.2.29 ([36c23e3](https://github.com/cameronraysmith/vanixiets/commit/36c23e3c30abe786f1707ea40eff303a0c09d05f))1053    * **checks:** assert nixbot uploads via the uploaders option ([6652839](https://github.com/cameronraysmith/vanixiets/commit/665283994723f16cdd0b40470b716bf829a0cc5e))1054    * **checks:** defer scheelite from machine checks (uncacheable CUDA closure) ([8717103](https://github.com/cameronraysmith/vanixiets/commit/8717103d52a2df84343e76c571dae6bc7e673c0f))1055    * **checks:** derive pyrite input pins from their declarations and bump them ([0faa430](https://github.com/cameronraysmith/vanixiets/commit/0faa4300f65d3b2c83d8bd86929454417e1d8e17)), closes [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102)1056    * **checks:** drop the volatile pi version pin from the structural oracle ([fd63e9f](https://github.com/cameronraysmith/vanixiets/commit/fd63e9faa49e6284ee6ef9ce445784981bbabe96))1057    * **checks:** drop tsconfig baseUrl for typescript 7.0.2 ([023d635](https://github.com/cameronraysmith/vanixiets/commit/023d63596bc2bed1d5ec67bf6dd5405b748a1f8e))1058    * **checks:** expect pi 0.84.2 in pi-agent-environment ([93d9600](https://github.com/cameronraysmith/vanixiets/commit/93d9600667aaf615d86241ec967537d3bf3dd823))1059    * **checks:** refresh the golden without stale keys; state what the check pins ([b24e5ec](https://github.com/cameronraysmith/vanixiets/commit/b24e5ec80426a83207379dde0a2b079a9111bf0b))1060    * **checks:** report omnigent obligation failures legibly ([7d341d0](https://github.com/cameronraysmith/vanixiets/commit/7d341d0e418069bc46b61542343db7c1f7c03380))1061    * **checks:** stop the hook harness reporting crashes as allow ([e07f7f0](https://github.com/cameronraysmith/vanixiets/commit/e07f7f0a1f6852d4848b7a971527658fd4370fa0))1062    * **checks:** warm the zerotier controller's unfree build in the fleet cache ([c185bbc](https://github.com/cameronraysmith/vanixiets/commit/c185bbc639aaa5928c4682c4fc93b60d9012e7f1))1063    * **checks:** write clan-inventory-consistency scratch to $TMPDIR not /tmp ([9b0a6b5](https://github.com/cameronraysmith/vanixiets/commit/9b0a6b52041fd6cac3e51f216e6dbcb965281b4d))1064    * **cinnabar/caddy:** bind ZeroTier mesh addresses via ip_nonlocal_bind ([432efb8](https://github.com/cameronraysmith/vanixiets/commit/432efb840be2383b173bd77558ef2f0928ddbadb))1065    * **cinnabar/caddy:** rewrite Host header for hermes dashboard reverse-proxy ([72eae12](https://github.com/cameronraysmith/vanixiets/commit/72eae126dd02addaec73dc066a4672f1babd34bf))1066    * **cinnabar:** migrate zerotier to clanService API + bump clan-core to 004bb87d ([021d4fd](https://github.com/cameronraysmith/vanixiets/commit/021d4fdba4697ab3b6e904249c7741aa35c6317d))1067    * **ci:** separate KVM-only VM tests from PR checks ([7eb7fb8](https://github.com/cameronraysmith/vanixiets/commit/7eb7fb8c148a16ec718b46c672afd768969aa9b1))1068    * **clan/hermes-agent:** deliver matrix bootstrap vars via environment ([20d31cb](https://github.com/cameronraysmith/vanixiets/commit/20d31cb3887d37c58ebb60d3e9d77f0eefff0fb2))1069    * **clan/hermes-agent:** derive stateDir from config.users.users.<user>.home ([74d4570](https://github.com/cameronraysmith/vanixiets/commit/74d4570a46ed13ccc2fca8058ef78bff54d52b11))1070    * **clan/hermes-agent:** restore MATRIX_HOMESERVER/MATRIX_USER_ID env ([a0ac221](https://github.com/cameronraysmith/vanixiets/commit/a0ac221473f924140422477a8d9ecd9592aff40a))1071    * **claude-code:** 4-* -> 5 ([3de72a9](https://github.com/cameronraysmith/vanixiets/commit/3de72a9e5b4c8f13b6ed93494a4a1d38e47e9c1e))1072    * **claude-code:** pin editorMode = vim ([c8fcdf7](https://github.com/cameronraysmith/vanixiets/commit/c8fcdf7a5191f20fb457903b032c21345ce07f80))1073    * **claude:** disable cloudflare and ouroboros plugins ([d8129e6](https://github.com/cameronraysmith/vanixiets/commit/d8129e6da0c0ae645a2748ec2354717970525ddb))1074    * **cluster:** drive the CI integration run off the local-k3d-ci environment ([08c2e55](https://github.com/cameronraysmith/vanixiets/commit/08c2e55ef76cbfd9547e7d131d877519ec33e115))1075    * **cognee-cli-wrapper:** python313 -> python3 ([c32482e](https://github.com/cameronraysmith/vanixiets/commit/c32482ec4e98a98462388dffd5f1ceb6834c3488))1076    * **cognee:** bound DB connection leaks via role-level idle_in_transaction_session_timeout (safety net for the cognee session-lifecycle leak) ([470dd8d](https://github.com/cameronraysmith/vanixiets/commit/470dd8d927f0c5542e53fcc79625ac7d667fd16b))1077    * **cognee:** loopback TCP + scram so API startup migrations run ([0c539e1](https://github.com/cameronraysmith/vanixiets/commit/0c539e1e85693ebd33da8ea9c624fc48aedec8bf))1078    * **cognee:** own db-password secret by postgres for ALTER ROLE ([4d03d6e](https://github.com/cameronraysmith/vanixiets/commit/4d03d6ec19391649ec93f7b27657076d19d98f68))1079    * **cognee:** re-pin cognee-nix to 16167c00 for correct IPv6 --bind ([053d98f](https://github.com/cameronraysmith/vanixiets/commit/053d98f7c3042505c1f97659223e9ccd34a8b256))1080    * **commands:** drop jj git push --allow-new removed in jj 0.42 ([cdfe0f2](https://github.com/cameronraysmith/vanixiets/commit/cdfe0f248b8c443bce451102838089f33aadf7c6))1081    * **containers:** expose Darwin variants via legacyPackages to escape strict flake-check forcing ([31adcdc](https://github.com/cameronraysmith/vanixiets/commit/31adcdcc1529d5a5ed4c3c5366544428b03865bd))1082    * **context:** fire the README habit on claims about a directory, not only edits ([ef48197](https://github.com/cameronraysmith/vanixiets/commit/ef481977a299da41a6ca8bf48c14adcb6d3ab0c4))1083    * **context:** retire beads references, restore reference-repo lookup policy, repair cross-references ([c80de68](https://github.com/cameronraysmith/vanixiets/commit/c80de68d8e83274029624307f6a864707e4e0de0))1084    * **darwin/homebrew:** add --force-cleanup for Homebrew >=5.1.15 cleanup guard (nix-darwin[#1787](https://github.com/cameronraysmith/vanixiets/issues/1787)) ([b6964bc](https://github.com/cameronraysmith/vanixiets/commit/b6964bcbb9628bab2519b849abb4e0de645c15c1))1085    * **darwin:** decouple homebrew self-update from the activation bundle run ([bf60c25](https://github.com/cameronraysmith/vanixiets/commit/bf60c25919789b53599644ffb741b09218d07edc))1086    * **darwin:** disable allowUnsupportedSystem in nixpkgs.config ([2fd4de7](https://github.com/cameronraysmith/vanixiets/commit/2fd4de73d4feac4f48be342ab8805a0b2f186f88))1087    * **darwin:** disable scheduled nix store optimise ([16d9eef](https://github.com/cameronraysmith/vanixiets/commit/16d9eef1f9f096d0e9f1da39baf32f3c3f0f6f1b))1088    * **darwin:** keep DNS encrypted on every network adapter ([bf2424f](https://github.com/cameronraysmith/vanixiets/commit/bf2424f926038f416402c718b7f052c952c613fa))1089    * **darwin:** stop Sparkle apps installing updates unattended ([832f30d](https://github.com/cameronraysmith/vanixiets/commit/832f30d2bb6ddf39efddd3d0ea0952d8ba9fc0c0))1090    * **darwin:** stop the DNS resolver check aborting activation ([a767bc2](https://github.com/cameronraysmith/vanixiets/commit/a767bc2419199066430c3e1438409f01b0d02d3a))1091    * **deps:** pin conventional-changelog preset to the v9 line ([ab6c91e](https://github.com/cameronraysmith/vanixiets/commit/ab6c91e880de2e58895f4710063e71cbb9468666))1092    * **deps:** update astro ([29b174f](https://github.com/cameronraysmith/vanixiets/commit/29b174f345e5897eddea9b39fae6f01bf4c74ee4))1093    * **deps:** update astro monorepo ([60734de](https://github.com/cameronraysmith/vanixiets/commit/60734dee18f8016a3367cbbf99bed7221b16d8a6))1094    * **deps:** update astro monorepo ([6ebd2c6](https://github.com/cameronraysmith/vanixiets/commit/6ebd2c628be8a276a216f01afeb407ecb70bfdde))1095    * **deps:** update astro monorepo ([540a215](https://github.com/cameronraysmith/vanixiets/commit/540a215257a110c96aa0c9acb5a723d6f8e1b093))1096    * **deps:** update dependency @astrojs/starlight to v0.38.5 ([a4bc1dd](https://github.com/cameronraysmith/vanixiets/commit/a4bc1dd910614b790136baabdbc48a1790370634))1097    * **deps:** update dependency @astrojs/starlight to v0.41.10 ([9a7fd54](https://github.com/cameronraysmith/vanixiets/commit/9a7fd54508cfaca41be0558d39156a527d03026e))1098    * **deps:** update dependency @astrojs/starlight to v0.41.2 ([be57ecb](https://github.com/cameronraysmith/vanixiets/commit/be57ecb75d52873305846b6a834d3ebc499d3fb9))1099    * **deps:** update dependency @astrojs/starlight to v0.41.3 ([a5f3e20](https://github.com/cameronraysmith/vanixiets/commit/a5f3e208cfefa770d5ade0c3563a2a984ec52800))1100    * **deps:** update dependency @astrojs/starlight to v0.42.5 ([5d5e492](https://github.com/cameronraysmith/vanixiets/commit/5d5e49299201a1f1e68c83520aa2153030e89784))1101    * **development-packages:** elixir -> beamPackages ([c765939](https://github.com/cameronraysmith/vanixiets/commit/c76593907f1ab41f21a8bb35b2257ff94b780ffb))1102    * **development-packges:** use rclone home-manager module ([54aa120](https://github.com/cameronraysmith/vanixiets/commit/54aa1202907c737dcc1ef534fe131a9be772b711))1103    * **devin:** activate the home profile without secrets at snapshot build and reactivate at session start ([ac14ae3](https://github.com/cameronraysmith/vanixiets/commit/ac14ae301f8af1b34022b83b9ef4cec736346252))1104    * **devin:** activate without secrets in maintenance as well ([590f751](https://github.com/cameronraysmith/vanixiets/commit/590f75195cc7acbb3926d39397bf860c2c6efc65))1105    * **devshell:** platform-conditional playwright browsers ([6a47121](https://github.com/cameronraysmith/vanixiets/commit/6a4712105bcb5901cb24ea04a4035a9dc0a42ba6))1106    * **devshells:** match the project nix client to the fleet default ([4d97b62](https://github.com/cameronraysmith/vanixiets/commit/4d97b621c3d1864be87859160b47cebf63542854))1107    * **dnscrypt-proxy:** set blackphos userHome to /private/var to match on-disk user ([40593ec](https://github.com/cameronraysmith/vanixiets/commit/40593ece32b37ce95b90f35e35bb51171234b790))1108    * **docs-deploy:** pass wrangler globals after the subcommand ([3835e40](https://github.com/cameronraysmith/vanixiets/commit/3835e40b58e92f76cf49901616e830f0f670cfcb))1109    * **docs:** adapt starlight sidebar for v0.39 breaking changes ([5e6fb56](https://github.com/cameronraysmith/vanixiets/commit/5e6fb56997b3d250f4947d6773543fff20a556b6))1110    * **docs:** give each browser report build its own preview ports ([9caddea](https://github.com/cameronraysmith/vanixiets/commit/9caddeafdb03753fea0bb2aa3d994b91a1b68c4c))1111    * **docs:** isolated bun linker for local astro-7 dev ([4fec259](https://github.com/cameronraysmith/vanixiets/commit/4fec259e1782c80dc472d05da426f11a2e8d0860))1112    * **docs:** keep browser evidence valid under CI build contention ([3f8dbba](https://github.com/cameronraysmith/vanixiets/commit/3f8dbbaad23ff799c2b466924b5ba2b5719612a5))1113    * **docs:** keep runner-control deadlines above browser setup under load ([50ae451](https://github.com/cameronraysmith/vanixiets/commit/50ae45182a4e4d7f8d58d3b30ebf06531efe45a6))1114    * **docs:** keep the homepage hero within narrow viewports ([88a39fb](https://github.com/cameronraysmith/vanixiets/commit/88a39fbb7c24d2afcf2d13854cb64e04d73ed8a9))1115    * **docs:** keep WebKit failure screenshots in Darwin build reports ([1c82caa](https://github.com/cameronraysmith/vanixiets/commit/1c82caa79bcc0e2f801bd4c63f1002fdd84251d0))1116    * **docs:** pin unified() markdown processor for astro 7 ([e47a035](https://github.com/cameronraysmith/vanixiets/commit/e47a03515402828f0cf1796545e63e630e38eac8))1117    * **docs:** retain browser regression evidence and version observations ([075412d](https://github.com/cameronraysmith/vanixiets/commit/075412d01b14b0ef7178b884270a5ab4aee685cc))1118    * **docs:** run report verdict CLI through symlinked paths ([6345440](https://github.com/cameronraysmith/vanixiets/commit/6345440fc07af4d1593ce47e0661f6db37532d64))1119    * **docs:** run tests under node and fix wrangler path for cloudflare 14 ([c668a47](https://github.com/cameronraysmith/vanixiets/commit/c668a474aca64d99a64312bc802447c25ecca1d6))1120    * **docs:** source darwin playwright webkit from patched flake fork ([f32b987](https://github.com/cameronraysmith/vanixiets/commit/f32b9874bcae5bcca9cf46d79bb5bdebdc655084))1121    * **effects:** act only on pull requests that are open at the event's head ([ac676a0](https://github.com/cameronraysmith/vanixiets/commit/ac676a011e7211c353c8b1143cee79228b27f24a)), closes [#3245](https://github.com/cameronraysmith/vanixiets/issues/3245)1122    * **effects:** require permission guards for credentialed build-finished events ([c000f0c](https://github.com/cameronraysmith/vanixiets/commit/c000f0c43c27b41a8f6dd1c86edbebd3d2323449))1123    * **effects:** run nixbot effects only on pushes to main ([640fc17](https://github.com/cameronraysmith/vanixiets/commit/640fc173dd242c6b1aac604d6b5cea9bd9c1fac8))1124    * **flake:** drop unused input pins ([dd864cd](https://github.com/cameronraysmith/vanixiets/commit/dd864cdd12f6c130850d08483e540f683ef0bba0))1125    * **flake:** track niri-flake and zen-browser upstream instead of rev pins ([bd915fd](https://github.com/cameronraysmith/vanixiets/commit/bd915fd3997eed0406f8dda4385d4aecc1721e98)), closes [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169) [#3232](https://github.com/cameronraysmith/vanixiets/issues/3232) [#3261](https://github.com/cameronraysmith/vanixiets/issues/3261)1126    * **flake:** track playwright-cli's flake upstream instead of a rev pin ([81224d2](https://github.com/cameronraysmith/vanixiets/commit/81224d254ba7ee571a4299b021c7eec338b0bc48)), closes [#3268](https://github.com/cameronraysmith/vanixiets/issues/3268)1127    * **fonts:** correct Monaspace Nerd Font family name ([b1d14bf](https://github.com/cameronraysmith/vanixiets/commit/b1d14bfb76b0ce4e87c7c30216aa26710e1fd63e))1128    * **fonts:** use Mono Nerd Font cut for terminal grid ([598724e](https://github.com/cameronraysmith/vanixiets/commit/598724e45673c2db2a065ae857779787985f2e66))1129    * **fzf:** disable Ctrl-R history widget so atuin owns it ([876a25d](https://github.com/cameronraysmith/vanixiets/commit/876a25d209233e3e6f874f0f07c2b2d853ab2598))1130    * **gitea-mq:** match the required-check fallback to the authoritative ruleset ([00a7c20](https://github.com/cameronraysmith/vanixiets/commit/00a7c20ce5ebe353e891d5ea4565e41e531ee7a7))1131    * **gitignore:** anchor the archive pattern to the repository root ([9805d59](https://github.com/cameronraysmith/vanixiets/commit/9805d595f0a7600edd1c3f73aa31824c47a280c6))1132    * **gpg:** disable the darwin gpg-agent launchd service ([594b32f](https://github.com/cameronraysmith/vanixiets/commit/594b32f19393f927cede2df3a93fa381a9e7275f))1133    * **herdr:** restore the default pane-swap keybindings ([832f887](https://github.com/cameronraysmith/vanixiets/commit/832f887a77c746e323c4e4271b41f115fb50ac56))1134    * **hermes-agent:** break the config.yaml corruption loop with moshi-hook ([872679a](https://github.com/cameronraysmith/vanixiets/commit/872679a534bf477534ce0cc28cafece912f1f942))1135    * **hermes-agent:** set codex default ([c63754c](https://github.com/cameronraysmith/vanixiets/commit/c63754ce5e455b2744f96a488ea262be2c2a600e))1136    * **hermes-agent:** update configuration ([67cd7cc](https://github.com/cameronraysmith/vanixiets/commit/67cd7ccadb097ec6c0e4e745e218a8892608a136))1137    * **hermes:** bind dashboard to loopback for v0.17.0 ([#50551](https://github.com/cameronraysmith/vanixiets/issues/50551)) ([f264143](https://github.com/cameronraysmith/vanixiets/commit/f264143d1a1bb6a2617f435730806326815b080b))1138    * **home,clan/hermes-agent:** switch skills delivery to ~/.hermes/skills/ ([b169962](https://github.com/cameronraysmith/vanixiets/commit/b16996296f9c184b76e68d315beac974542e7059))1139    * **home/ai/claude-code:** drop unsupported "mcp__*" allow rule; MCP governed by defaultMode = "auto" ([5e231b1](https://github.com/cameronraysmith/vanixiets/commit/5e231b15a7bc813afcf51da0cd07243ffba705c8))1140    * **home/ai/claude-code:** use upstream marketplace name 'dagster' so dagster-expert plugin enables ([dc88ba4](https://github.com/cameronraysmith/vanixiets/commit/dc88ba49263f4ddf255f3a8f6f046fa4ef74b199))1141    * **home/ai/openspec:** anglicize vendored superpowers-bridge schema bundle ([c471dee](https://github.com/cameronraysmith/vanixiets/commit/c471dee7deab121f9f52da190c45e08e4515e772))1142    * **home/checks:** bind activationPackage directly to recover cache linkage ([f1ad224](https://github.com/cameronraysmith/vanixiets/commit/f1ad22402f58f7b3f5777f164981b6134639f094))1143    * **home/claude-code:** correct home.file override path to upstream's absolute key ([d6e727e](https://github.com/cameronraysmith/vanixiets/commit/d6e727e1ac9af598baa3a8994485780291da7d4f))1144    * **home/claude-code:** force-overwrite .claude/settings.json (nix-owned) ([b0e01f4](https://github.com/cameronraysmith/vanixiets/commit/b0e01f4b8924299f18d1b66c6086dff60ddb41a6))1145    * **home/core/ssh:** migrate matchBlocks to programs.ssh.settings ([8f1f691](https://github.com/cameronraysmith/vanixiets/commit/8f1f6917e26475d794beb2c9dff9d2d279c280d6))1146    * **home/core:** set GIT_OPTIONAL_LOCKS=0 to skip git status index writeback ([db970c9](https://github.com/cameronraysmith/vanixiets/commit/db970c98858c324dd53d013187c7bfeb59c8f87f))1147    * **home/crs58:** correct stale linear-cli bundled-skills comment (38 -> 1 dir/16 refs) ([930012a](https://github.com/cameronraysmith/vanixiets/commit/930012a6817fda0fe0138e4c4b70cbfe0a7ffb66))1148    * **home/direnv:** skip hanging direnv-instant tmux test in checkPhase ([730a7ae](https://github.com/cameronraysmith/vanixiets/commit/730a7ae7908ccd33771cf0387dbcfecb1400cc8a))1149    * **home/neovim:** pin git_config and fish treesitter parsers ([f927884](https://github.com/cameronraysmith/vanixiets/commit/f927884555f652dc6a8b33c789e4b309ca4907ec))1150    * **home/packages:** wrap gitmux with GIT_INDEX_FILE redirection in jj-colocated repos to avoid .git/index.lock races with jj export ([4c2429a](https://github.com/cameronraysmith/vanixiets/commit/4c2429a3bece06eacde21d3bf0e7b133590288f4))1151    * **home/starship:** set scan_timeout to 50ms ([5c4071d](https://github.com/cameronraysmith/vanixiets/commit/5c4071dcbc53c645e7b26bf1358ed1d15865b96a))1152    * **home/tools/agents-md:** correct jj-mode dispatch instruction to canonical wip-on-top recipe with --keep-emptied ([b16fe25](https://github.com/cameronraysmith/vanixiets/commit/b16fe25fb0e0364e1b07d6b2a5511fa0df640258))1153    * **home/tools/commands:** hermes-backup reads zip entries via bsdtar [@archive](https://github.com/archive) operand ([da917ff](https://github.com/cameronraysmith/vanixiets/commit/da917ffd762b89353e25b4076925e4b708d50ff7))1154    * **home/ubuntu:** use the sandbox's C.UTF-8 locale ([3e1a5fa](https://github.com/cameronraysmith/vanixiets/commit/3e1a5fa07d1f8181889b211c7ed86a345ba7f27d))1155    * **home/zed:** migrate agent.play_sound_when_agent_done to enum string ([bd4cc1c](https://github.com/cameronraysmith/vanixiets/commit/bd4cc1c6a280818ec5240d990e39582dcb3d4da8))1156    * **homebrew:** add element, itsycal, jayjay, linear, logi-options+ ([1800c41](https://github.com/cameronraysmith/vanixiets/commit/1800c41cc3650e66fca67c56955b89b1c431e3fe))1157    * **homebrew:** no-quarantine deprecated ([2325256](https://github.com/cameronraysmith/vanixiets/commit/2325256ee355d572e051901b50cf5c99175b8eb0))1158    * **homebrew:** update active dock items ([4b4d152](https://github.com/cameronraysmith/vanixiets/commit/4b4d1528570743618ca4c481928bce213f8d737b))1159    * **home:** let shell and development declare their own upstream imports ([7db2049](https://github.com/cameronraysmith/vanixiets/commit/7db20490e60a77c355c0d631ce4a761b22d777a2))1160    * **home:** let terminal aggregate declare its own nix-index import ([95d4d06](https://github.com/cameronraysmith/vanixiets/commit/95d4d06d869cf93b5b044bcc15d194984c7de3d6))1161    * **home:** migrate lazygit diff renderer config to the 0.65 schema ([27b0dad](https://github.com/cameronraysmith/vanixiets/commit/27b0dad1c62f6a7422d52388894f8a373186aded))1162    * **home:** name the queue each host serves instead of deriving it ([a6a8df6](https://github.com/cameronraysmith/vanixiets/commit/a6a8df65dd97634bf76bcdc8ae2015d39c6e7636))1163    * **home:** pass the configuration name to nh home switch ([7429300](https://github.com/cameronraysmith/vanixiets/commit/74293008f13ec7f26c9750555483f1449720914c))1164    * **home:** per-outpost credentials, id addressing, live registry values ([452c3b6](https://github.com/cameronraysmith/vanixiets/commit/452c3b67be0f8713925d33e6f0ef3463a73ef7a1))1165    * **home:** skip the sops-nix unit restart when no age key is present ([604d824](https://github.com/cameronraysmith/vanixiets/commit/604d82429aed1b75b43f828d0b06b82546d59e5d))1166    * **home:** state catppuccin auto-enrollment wherever the module is imported ([aea0f39](https://github.com/cameronraysmith/vanixiets/commit/aea0f39a94c1ee7297de112546261d12ca21f659))1167    * **home:** stop a tokenless darwin worker, and decouple the two hosts ([b81e1ef](https://github.com/cameronraysmith/vanixiets/commit/b81e1efcc28687a8404a34d287df683c8e1a70fd))1168    * **hooks/gate-dangerous-commands:** drop anchor on -b empty-body regex ([e0bcb53](https://github.com/cameronraysmith/vanixiets/commit/e0bcb53b326da899c55b0a90c63401d5a00ce7fa))1169    * **hooks:** assert the development join has exactly one child ([703350c](https://github.com/cameronraysmith/vanixiets/commit/703350c6121f0a995fdfbec9c027188a0fcd4ba2))1170    * **hooks:** don't gate kill word inside quoted search patterns ([108387f](https://github.com/cameronraysmith/vanixiets/commit/108387f46cdd01dc1a10b3e837abe65096f09694))1171    * **hooks:** gate kill by target hazard, not by the word kill ([dba57d1](https://github.com/cameronraysmith/vanixiets/commit/dba57d1f3eddbea241d368d247aeeb40e13bf46c))1172    * **hooks:** let permission notifications fire outside beads repositories ([ab47e98](https://github.com/cameronraysmith/vanixiets/commit/ab47e988cb70d181293b8148409d9f6be7e0853d))1173    * **hooks:** re-gate the destructive git push forms ([ce9c780](https://github.com/cameronraysmith/vanixiets/commit/ce9c7800dec819ad088964d2bd395d6bf8d443cb))1174    * **hooks:** repair the join detector and the diamond recovery text ([3bf142b](https://github.com/cameronraysmith/vanixiets/commit/3bf142b4ff84f71bdef5a376e8505c596936dc8d))1175    * **jj-linearize-join:** describe the reconstructed join from its actual parents ([f7d8cdb](https://github.com/cameronraysmith/vanixiets/commit/f7d8cdba0f6a3302ba9099ee2685de336403fde2))1176    * **jj-linearize-join:** stop the divergence marker reaching revision arguments ([41b3147](https://github.com/cameronraysmith/vanixiets/commit/41b3147d8709cdd710d01c8a7f852220981776df))1177    * **just:** retry remote check builds and document the ssh limit ([8b6f8d7](https://github.com/cameronraysmith/vanixiets/commit/8b6f8d7c6f710f4d84648d07dcd698660dbe3a75))1178    * **k3d:** run local integration through the offline CI path ([fb3ac14](https://github.com/cameronraysmith/vanixiets/commit/fb3ac140327aa0fdc20b9fd2756e91ad1975883a))1179    * **k8s:** follow sops-secrets-operator chart rename helm3 -> helm4 (0.21.2) ([fe1e9bc](https://github.com/cameronraysmith/vanixiets/commit/fe1e9bc79dbb379c9afea139c6f41b2997db5729)), closes [#3133](https://github.com/cameronraysmith/vanixiets/issues/3133) [#239](https://github.com/cameronraysmith/vanixiets/issues/239)1180    * **k8s:** repoint cilium CRD selector past upstream embed.go (v1.20.2) ([f074320](https://github.com/cameronraysmith/vanixiets/commit/f07432065aa42dfac9f769c364939f031ee89b0c)), closes [#3132](https://github.com/cameronraysmith/vanixiets/issues/3132)1181    * **kanidm:** enable online backups and align the branding cli package ([ebb45d8](https://github.com/cameronraysmith/vanixiets/commit/ebb45d81bfbe18b056c3ea8f597e3f2e9c276487))1182    * **kernel-modules:** move pyrite module boundary to Linux 6.18.52 ([16f068c](https://github.com/cameronraysmith/vanixiets/commit/16f068cdb3473bf4f639f68a8586e6e6d5769408))1183    * **linear-cli:** dispatch the denoDeps hash probe to the x86_64-linux remote builder ([1f575c6](https://github.com/cameronraysmith/vanixiets/commit/1f575c63d1259aae0c44cc666576f30bdc7b8d25))1184    * **linear-cli:** remove store references from vendored dependencies ([9518598](https://github.com/cameronraysmith/vanixiets/commit/9518598116f630d201cd0715329dcfff359c4c7f))1185    * **linear-cli:** update to 2.5.0 ([bd9a7ea](https://github.com/cameronraysmith/vanixiets/commit/bd9a7eaf0a7088c4dfe8da9943e8fca4a1c62410))1186    * **machines/magnetite:** enforce zfs quota and reservations against pool starvation ([aca5c70](https://github.com/cameronraysmith/vanixiets/commit/aca5c708baf1cc0b30d541fc7e88f38687d482fe))1187    * **machines/magnetite:** tighten nix gc and build-sandbox reaping for the build host ([e456caf](https://github.com/cameronraysmith/vanixiets/commit/e456caf62ffc7fe951f69db73d11c41374d6fb8e))1188    * **magnetite/kanidm:** add kanidm.service to oauth2-synapse restartUnits to re-run provision on rotation ([093549a](https://github.com/cameronraysmith/vanixiets/commit/093549a700b0980bab5d1bf45c58e1058c1f0b1b))1189    * **magnetite/kanidm:** manage matrix_users membership operationally to satisfy referential-integrity assertion ([9d5be21](https://github.com/cameronraysmith/vanixiets/commit/9d5be2120798fba11953e4f2b924741482e8d7db))1190    * **magnetite/kanidm:** reassign kanidm-oauth2-synapse secret ownership to kanidm:kanidm for provisioning access ([2fe9b91](https://github.com/cameronraysmith/vanixiets/commit/2fe9b914c0bcdfde2bc9d870cabe417d24db9100))1191    * **magnetite/kanidm:** replace trust_x_forward_for with http_client_address_info (V2 schema) ([3cd6dca](https://github.com/cameronraysmith/vanixiets/commit/3cd6dcae44933429d9005a41780feb3198f92d76))1192    * **magnetite/kanidm:** switch to enableACME + filesystem cert delivery ([c79f4bf](https://github.com/cameronraysmith/vanixiets/commit/c79f4bf4054c09120fe2bc54c2f39eb5f6785f2a))1193    * **magnetite/matrix:** expose federation OpenID userinfo endpoint for lk-jwt-service ([3966c86](https://github.com/cameronraysmith/vanixiets/commit/3966c86eb8e3fcdf2bd62df8d301f6535a6a8740))1194    * **magnetite/matrix:** grant nginx read access to acme cert via turnserver group membership ([6d68921](https://github.com/cameronraysmith/vanixiets/commit/6d68921f7e82ba293ad99a2827832bb93d9dd01b))1195    * **magnetite/matrix:** wire lk-jwt-service.livekitUrl and nginx /livekit/sfu proxy (nix-dk1) ([7d9d53b](https://github.com/cameronraysmith/vanixiets/commit/7d9d53b73e7d24c66959fb8cdceb4cf8032d17ab))1196    * **magnetite:** assert com.sun:auto-snapshot=false on root/nix at boot ([220b8a6](https://github.com/cameronraysmith/vanixiets/commit/220b8a6ba644fbc85c5e73c59057a6ee9f6dc26a))1197    * **magnetite:** confine the builder account's key to the nix protocol ([d3b3b64](https://github.com/cameronraysmith/vanixiets/commit/d3b3b646d383b164647fe3c7d25ddd3a489544e7))1198    * **magnetite:** drop dhparam options removed in nixpkgs 26.11 ([17c8b73](https://github.com/cameronraysmith/vanixiets/commit/17c8b735b1492e2c698c4c3d4975306eb401066c))1199    * **magnetite:** drop stale omnigraph systemPackages entry ([bc06590](https://github.com/cameronraysmith/vanixiets/commit/bc065901069d3b0b202b3f6194de51d9443d6f59))1200    * **magnetite:** raise sshd MaxStartups for the remote check lane ([45370c6](https://github.com/cameronraysmith/vanixiets/commit/45370c67cfa50b656b93b5bbf3e83b2adb1e60a1))1201    * **magnetite:** trust the builder account so distributed builds accept pushed paths ([b1d34d2](https://github.com/cameronraysmith/vanixiets/commit/b1d34d293c4a3bf0928e3a0b4323403c1b3ef7a8))1202    * **moshi:** reconcile hooks after managedConfigs ([3cc1559](https://github.com/cameronraysmith/vanixiets/commit/3cc155943c83230fd491643d51c36e66aaadc8e3))1203    * **neovim:** drop pplatex from lazyvim extraPackages ([2a5b261](https://github.com/cameronraysmith/vanixiets/commit/2a5b261f9b154cf698d238696fa732d406ff737d))1204    * **neovim:** mini_surround -> mini-surround ([18f7580](https://github.com/cameronraysmith/vanixiets/commit/18f75809f5bd2cff0c43d5e24d049a8a1968b71e))1205    * **neovim:** snacks_picker -> snacks-picker ([9a6550d](https://github.com/cameronraysmith/vanixiets/commit/9a6550dc9035e09c81997b4fbdcb30c756002261))1206    * **network:** clamp TCP MSS on zerotier for all NixOS hosts ([5725837](https://github.com/cameronraysmith/vanixiets/commit/5725837051d12e9f5f79f25b2e3f8faa60843b8c))1207    * **network:** make ZeroTier MSS rules lifecycle-safe ([2931154](https://github.com/cameronraysmith/vanixiets/commit/2931154b1f4bbf00bb5cfca24b69327a2b61f194))1208    * **nix-fast-build:** do not propagate python into consumers ([b200160](https://github.com/cameronraysmith/vanixiets/commit/b2001606ea6ade52f8a2e79285b3a543e6a57f32))1209    * **nix:** bound stalled substituter downloads to 60s ([03e7785](https://github.com/cameronraysmith/vanixiets/commit/03e7785965941d67b20b9f4cdaf9fe85e258fe5f))1210    * **nix:** declare KVM availability per host ([58765f2](https://github.com/cameronraysmith/vanixiets/commit/58765f23589773f56592493284715f5c90879ca2))1211    * **nix:** default fleet to Nix 2.35 for parallel cache queries ([aece57e](https://github.com/cameronraysmith/vanixiets/commit/aece57edc2865da308f37f58ffb8874420e75e58))1212    * **nixidy-push:** default to a sibling checkout and clone it when absent ([39216f1](https://github.com/cameronraysmith/vanixiets/commit/39216f1a0c4b383a9a2f8d972a823d2e1071f78b))1213    * **nixidy:** select the manifest repo by environment instead of getEnv ([dcc5acd](https://github.com/cameronraysmith/vanixiets/commit/dcc5acdae68cdf74e019005cf97fa0e1ad0f176f))1214    * **nixos/buildbot:** reap buildbot-nix gcroots that upstream's glob never matches ([0a62058](https://github.com/cameronraysmith/vanixiets/commit/0a62058b5803760ea239d8ce8614a11425883873))1215    * **nixpkgs:** expose flake packages only for supported systems ([cef64cc](https://github.com/cameronraysmith/vanixiets/commit/cef64cc79a300a0b52c294cef80da39df3ced625))1216    * **nixpkgs:** patch apm for SKILL_BUNDLE downloads ([855eba8](https://github.com/cameronraysmith/vanixiets/commit/855eba8a53dca01a08b1f44a748e78c4b2256303)), closes [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack)1217    * **nix:** replace retired CUDA binary cache ([69c0dff](https://github.com/cameronraysmith/vanixiets/commit/69c0dff7655a689e6e5b237742674e492a028e3c))1218    * **omnigent:** advertise registered ACP harness readiness ([421dcf2](https://github.com/cameronraysmith/vanixiets/commit/421dcf23c9c0a7edb0e7555544414c1068a690b8))1219    * **omnigent:** auto-approve worker OMP ACP tools ([32d5ffa](https://github.com/cameronraysmith/vanixiets/commit/32d5ffa221cbd8d949077e19d401718f596aa6fd))1220    * **omnigent:** avoid evaluator stack overflow in home guard ([a93430c](https://github.com/cameronraysmith/vanixiets/commit/a93430c2aef90f94d6eb1a88ae54cfcb82e8099c))1221    * **omnigent:** bind Darwin credential receipts to boot session ([2e4f3cc](https://github.com/cameronraysmith/vanixiets/commit/2e4f3cc71e84bd21cf7db5e5fd3529c67dc4d7bc))1222    * **omnigent:** create security sessions for Keychain workers ([d387509](https://github.com/cameronraysmith/vanixiets/commit/d3875091a466eebc054b7cca68d9266c07a4500a))1223    * **omnigent:** emit one script per worker credential generator ([d3e759c](https://github.com/cameronraysmith/vanixiets/commit/d3e759cf0bbc32fd8a73a0f269156c55ba57c874))1224    * **omnigent:** keep sops-rendered worker credentials out of home directories ([7984efc](https://github.com/cameronraysmith/vanixiets/commit/7984efc002d103d40853ebbcf5f8a4b60aea15c0))1225    * **omnigent:** omit platform-inapplicable worker checks ([2dfb253](https://github.com/cameronraysmith/vanixiets/commit/2dfb25332a523a29e18741f4a7a92fe016ea2be9))1226    * **omnigent:** relax openai cap for nixpkgs openai 2.53 ([83fff85](https://github.com/cameronraysmith/vanixiets/commit/83fff85e506fdd9f6e5beb9e5465e09910d44ce9))1227    * **omnigent:** resolve Linux worker groups by gid as well as name ([1bbac11](https://github.com/cameronraysmith/vanixiets/commit/1bbac11649a48fd1b1ea81c5fae961dd5ff2675e))1228    * **omnigent:** retire remaining legacy host services ([bebe0bc](https://github.com/cameronraysmith/vanixiets/commit/bebe0bc0beecd14cde8a5370ec4e8a20a04ddb43))1229    * **omnigraph:** assert apply convergence, bound restarts, add operator cluster cli ([0c11011](https://github.com/cameronraysmith/vanixiets/commit/0c110113e82851182fb8dc64351d330dac3a7fb5))1230    * **omnigraph:** fail startup fast and bootstrap new storage roots once ([3fb87c3](https://github.com/cameronraysmith/vanixiets/commit/3fb87c3881da98fe3f2b18b60ffeeccd9953f25a)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257)1231    * **omnigraph:** gate server start on readiness probe ([0904cf7](https://github.com/cameronraysmith/vanixiets/commit/0904cf74a2522ef957c33682f83b7ec7b8322eb6))1232    * **omnigraph:** pass --as only to actor-bound cluster subcommands ([faa2423](https://github.com/cameronraysmith/vanixiets/commit/faa24235406d455f0adde57b41920457b33195db))1233    * **omp:** adjust default model roles ([7c922cf](https://github.com/cameronraysmith/vanixiets/commit/7c922cf1d7719b0fe6772dd0481d7225bc6662d8))1234    * **openspec:** correct schema bundle provenance and drop the dead refresh recipe ([bdb104b](https://github.com/cameronraysmith/vanixiets/commit/bdb104b2946dae591111683e116072d10c4cdfe3))1235    * **openspec:** correct the cognee-memory-layer project id to its slugId ([73a5d0b](https://github.com/cameronraysmith/vanixiets/commit/73a5d0b6eed0a212b2daef38e00c3059fbfd5e7c))1236    * **openspec:** correct the fork and schemaDirs claims in the marketplace design ([2e7628d](https://github.com/cameronraysmith/vanixiets/commit/2e7628dba612fcbddae18464d1b4285de7199189))1237    * **openspec:** deliver schema directories as single symlinks ([801a73d](https://github.com/cameronraysmith/vanixiets/commit/801a73d931f0b6c09ee31a12233c591e81de4be4))1238    * **openspec:** make nixbot's world-assumptions delta a superset ([5fa7090](https://github.com/cameronraysmith/vanixiets/commit/5fa709073f2d450ecaae439f0208e1f69bbfaa3c))1239    * **openspec:** make the pre-install secrets gate fail closed ([54931cf](https://github.com/cameronraysmith/vanixiets/commit/54931cf3195c172f80678dba347c429b09e2453d))1240    * **openspec:** name the git-addressable projection path and correct archive ordering ([8687815](https://github.com/cameronraysmith/vanixiets/commit/86878157103fd2ca1d7d3aa6f7d33589418bf71a))1241    * **openspec:** point the irreversibility warning at task 7.12, not 7.9 ([b6ad271](https://github.com/cameronraysmith/vanixiets/commit/b6ad27185f6ec626cb1231b25d8a3c3a8a0a87c1))1242    * **openspec:** record the linear registry id as a slugId, not a defect ([41a1f7d](https://github.com/cameronraysmith/vanixiets/commit/41a1f7d105e9715531db1fea32ea9170cca9074d))1243    * **overlays/aeneas:** rebuild darwin charon from charon-unwrapped ([eabf3a9](https://github.com/cameronraysmith/vanixiets/commit/eabf3a9d14be3f666d00031565c1aef16ca9d069))1244    * **overlays:** use stdenv.hostPlatform predicates in stable fallbacks ([290017b](https://github.com/cameronraysmith/vanixiets/commit/290017b1d136e769dd50be06df52dce6bae41c81))1245    * **packages:** correct the llm-agents provenance comment ([f83341f](https://github.com/cameronraysmith/vanixiets/commit/f83341f661d6bc41442baeb625b765582b434c68))1246    * **pi-agent-extensions:** guard the direnv reload timer against a stale ctx ([7a9cfd1](https://github.com/cameronraysmith/vanixiets/commit/7a9cfd1f29b1976a7c43b98dc2a760ac29de0ee4))1247    * **pi:** block pi config package mutation ([d8eef7a](https://github.com/cameronraysmith/vanixiets/commit/d8eef7adb85ff4e7f63aec653aa0bb0b900835c0))1248    * **pi:** declare the compaction extension Pi-only at the package level ([534834c](https://github.com/cameronraysmith/vanixiets/commit/534834c0bce14f77ba88828c2c43e6de2e27c949))1249    * **pi:** fail closed on unclassified shell mutations ([e117efc](https://github.com/cameronraysmith/vanixiets/commit/e117efc3fc8fd25292dc92982596a3b0ef948575))1250    * **pi:** honor curl get negation order ([85278c9](https://github.com/cameronraysmith/vanixiets/commit/85278c9dcf876a3460489d671598f9be113641fd))1251    * **pi:** model jj development join correctly ([4fa2a0f](https://github.com/cameronraysmith/vanixiets/commit/4fa2a0f88ad26d2281c6daaed58362bc4b099352))1252    * **pi:** preserve recognized shell reads ([d12c8a1](https://github.com/cameronraysmith/vanixiets/commit/d12c8a155ad4c7bb1369db14bc101adc1ea9f962))1253    * **pi:** regenerate jj command inventory, model informational globals ([42944e1](https://github.com/cameronraysmith/vanixiets/commit/42944e145c49e8c4fbcc2fb445eff1a4818673cc))1254    * **pi:** treat a curl request body as mutating regardless of -X ([96f8b4b](https://github.com/cameronraysmith/vanixiets/commit/96f8b4be841c9dda2bc0cb453246f914989eadec))1255    * **pkgs/atomic:** keep the postgres symlink hydration idempotent ([2bf3cd6](https://github.com/cameronraysmith/vanixiets/commit/2bf3cd65888dd3a630184047887d8b6f247f0788))1256    * **pkgs/xsra:** harden update.sh for nix run .#update-xsra ([376c46b](https://github.com/cameronraysmith/vanixiets/commit/376c46bd6a23a825d070bc01ce392647fe4c215a)), closes [.#update-xsra](https://github.com/./issues/update-xsra)1257    * **pkgs:** build-verify uncomment-bin on every flake system it targets ([59e0124](https://github.com/cameronraysmith/vanixiets/commit/59e0124165015cd5f2e69dd29d3147d89cd7fe54))1258    * **pkgs:** disable git-repo-manager ([d6861c6](https://github.com/cameronraysmith/vanixiets/commit/d6861c68af77acaee89fb06e9481ba20923a65e5))1259    * **pkgs:** linear-cli — writable DENO_DIR so deno persists perf caches at runtime ([88dc7cd](https://github.com/cameronraysmith/vanixiets/commit/88dc7cd7547a67c0e03e25261068f339ee762490))1260    * **playwright-web-flake:** rebase on upstream ([acd019f](https://github.com/cameronraysmith/vanixiets/commit/acd019f6d750c0e8bc3a260366a7dd25433e994f))1261    * **pyrite:** bind keyboard illumination to the explicit DMS LED device ([eeb0bdf](https://github.com/cameronraysmith/vanixiets/commit/eeb0bdfae206bfde664df7645da08a96f3b53cfb))1262    * **pyrite:** bulk-disable PCIe d3cold before sleep (confirmed resume fix) ([a227253](https://github.com/cameronraysmith/vanixiets/commit/a22725304fd75f98c27d2ea0b48c571615a1245e))1263    * **pyrite:** correct the FIDO2 activation comment to the measured account ([937df26](https://github.com/cameronraysmith/vanixiets/commit/937df26a9524e481aac43a66a5d828ec711204e6))1264    * **pyrite:** correct the FIDO2 activation comments ([1e632ea](https://github.com/cameronraysmith/vanixiets/commit/1e632ea4d13675ff9a03afc83672727987719e32))1265    * **pyrite:** correct the FIDO2 activation comments to the observed unlock path ([a04fcf7](https://github.com/cameronraysmith/vanixiets/commit/a04fcf7c8746012ee41a78585e7e8f7afaedd665))1266    * **pyrite:** correct the recorded state-version var to 26.05 ([300a17d](https://github.com/cameronraysmith/vanixiets/commit/300a17d537b3fca42c067e85a39b1f6f51039ac1))1267    * **pyrite:** deduplicate the i915 kernel parameters ([3e14942](https://github.com/cameronraysmith/vanixiets/commit/3e1494271fc7e9fe6fb7eb723e072a936a089236))1268    * **pyrite:** disable initrd networking so brcmfmac stays out of stage 1 ([38e6973](https://github.com/cameronraysmith/vanixiets/commit/38e69739c1f0aac803c833a0669b3da0e0cba40e))1269    * **pyrite:** disable lid as S3 wake source (spurious auto-resume) ([ae60572](https://github.com/cameronraysmith/vanixiets/commit/ae60572fef4cc4772171d705899c1a3d26b3a3bc))1270    * **pyrite:** disable niri focus ring ([d579e26](https://github.com/cameronraysmith/vanixiets/commit/d579e260192322a4e0d26c2846e896505c14054f))1271    * **pyrite:** disable NVMe d3cold so suspend can resume, with panic-reboot fallback ([8f8a481](https://github.com/cameronraysmith/vanixiets/commit/8f8a481ab0668fa1c07096e14c6c8d4f23c15a17))1272    * **pyrite:** drop the defective --phases disko from task 7.3 ([b91d994](https://github.com/cameronraysmith/vanixiets/commit/b91d994b6da6e1d747eeaf4ec01664c48c8ec4fa))1273    * **pyrite:** integrate the Apple CS8409 initialization module ([460bce1](https://github.com/cameronraysmith/vanixiets/commit/460bce105704c8f3a3984d67f99c5da7d13ea9e1))1274    * **pyrite:** make firmware-closure decidability command runnable on pinned nixpkgs ([b1c6494](https://github.com/cameronraysmith/vanixiets/commit/b1c64941f637f54ec960835a9ee733c679265f3e))1275    * **pyrite:** override i915 psr/fbc/dc and disable nvme APST for resume ([1691a88](https://github.com/cameronraysmith/vanixiets/commit/1691a888fb9c386c2b4930e2eed60c4d4b2fc2bf))1276    * **pyrite:** persist the BCM UART wake omission at boot ([d028a65](https://github.com/cameronraysmith/vanixiets/commit/d028a6597cfd281507ef6b4157bc168a6e8f54df))1277    * **pyrite:** pin dms-src to the release tag of the packaged shell ([d0d917c](https://github.com/cameronraysmith/vanixiets/commit/d0d917c0655dcabe81703de5de9e99a6cd3bd136))1278    * **pyrite:** pin niri-flake by revision and derive its check ([952615c](https://github.com/cameronraysmith/vanixiets/commit/952615c075436a082745391d40c53b88f78087f2)), closes [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169)1279    * **pyrite:** point dms-greeter at its own package ([9e40eb3](https://github.com/cameronraysmith/vanixiets/commit/9e40eb30014e876ceaa87805d5325b9139477132))1280    * **pyrite:** regenerate the zfs passphrase var under the current generator ([6b51455](https://github.com/cameronraysmith/vanixiets/commit/6b51455729515d5ee8c511278d518750a5d1610d))1281    * **pyrite:** replace task 7.4's tautological zpool import check ([444fb38](https://github.com/cameronraysmith/vanixiets/commit/444fb388126892cc2ae6066de0eaae06db3ec973))1282    * **pyrite:** require the LTS ISO boot entry, the only one carrying zfs ([2cb7258](https://github.com/cameronraysmith/vanixiets/commit/2cb7258326fae33e9161e715dc0ae151e6bfd823))1283    * **pyrite:** set system timezone to America/New_York ([1aa80c6](https://github.com/cameronraysmith/vanixiets/commit/1aa80c6d31d7dc82160a3de44f8c5b0c84050652))1284    * **pyrite:** state the lid-handler comment as a decision, not a broken path ([602c621](https://github.com/cameronraysmith/vanixiets/commit/602c62138ae82e7970ed5e78d5e2c37b55cbdea0))1285    * **pyrite:** stop GNOME suspending on the power key ([31c2b60](https://github.com/cameronraysmith/vanixiets/commit/31c2b605ab702a5a56efb0eb5663b736a02240ce))1286    * **pyrite:** stop lid close from triggering broken suspend ([8df57f8](https://github.com/cameronraysmith/vanixiets/commit/8df57f8dccc4e132c43fa7bbf6ba99a6a8beb0d2))1287    * **python-lancedb:** package 0.36.0 to replace failing nixpkgs 0.32.0 ([b450633](https://github.com/cameronraysmith/vanixiets/commit/b4506337b3a82e74dde2117fb954c5c76aab5f72))1288    * **python-overrides:** remove pygame ([740edaa](https://github.com/cameronraysmith/vanixiets/commit/740edaa330c4d1bfcb16605dfb412608a0fe46bf))1289    * **quarto-bin:** declare openssl for Linux autoPatchelf (typst-gather) ([44ef515](https://github.com/cameronraysmith/vanixiets/commit/44ef5155d6e81f52d8fb6ab30c74f9899740c62f))1290    * **radicle:** correct cinnabar seed pairs and bump radicle-desktop ([bcfc663](https://github.com/cameronraysmith/vanixiets/commit/bcfc66325e7c83fb80cc39fbf9baec8dd856ee05))1291    * **renovate:** group astro with starlight, and regenerate the tree ([d1efe6c](https://github.com/cameronraysmith/vanixiets/commit/d1efe6c8e85b06b82cdfdebc8482d60acf795264)), closes [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913) [#2881](https://github.com/cameronraysmith/vanixiets/issues/2881) [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913)1292    * **renovate:** track every github flake input ref, not only playwright ([cdcd4c3](https://github.com/cameronraysmith/vanixiets/commit/cdcd4c336700adfa3b5f01b4fa002e656f342680))1293    * **secrets:** add codeberg ([15f3bf8](https://github.com/cameronraysmith/vanixiets/commit/15f3bf8f12fbe77804b2939dce242ffe6b583505))1294    * **secrets:** add nostr id ([2f2e686](https://github.com/cameronraysmith/vanixiets/commit/2f2e68651101629fcbbdd997458015db0df80071))1295    * **secrets:** cover .enc files in the update-all-keys recipe ([e986485](https://github.com/cameronraysmith/vanixiets/commit/e9864855081f6d54d22b9d2cc131f43740017028))1296    * **secrets:** enroll janettesmith signing key ([0aa505a](https://github.com/cameronraysmith/vanixiets/commit/0aa505afeb7348dfe2ce7980e101b01cb218a3f9))1297    * **shell-aliases:** add ca = "claude attach" ([e8a23e3](https://github.com/cameronraysmith/vanixiets/commit/e8a23e3dd7f5ba7aa2ffab44e3a9bde7ed371b75))1298    * **skills/agentic-planning:** runnable-command and external-tool-contract fixes ([dee3381](https://github.com/cameronraysmith/vanixiets/commit/dee33819f667de85cc3c4e01f742c9145385b5f5))1299    * **skills/jj-version-control:** correct route-and-extend recipe to canonical wip-on-top structure with --keep-emptied, remove single-commit-join misapplication ([34d1bbf](https://github.com/cameronraysmith/vanixiets/commit/34d1bbf474113eff929d2537523ffd839cb93eb4))1300    * **skills/jj:** correct squash flag guidance against jj 0.43.0 ([4a5d9f7](https://github.com/cameronraysmith/vanixiets/commit/4a5d9f72291f9305cf3eaa078607e135a07fdc61))1301    * **skills/jj:** correct the conflict() revset to conflicts() ([8b8f174](https://github.com/cameronraysmith/vanixiets/commit/8b8f1745cc8c553a9cb94bca04f3536106398cbc))1302    * **skills/jj:** make the rebase pair canonical for join add and remove ([fb11d5d](https://github.com/cameronraysmith/vanixiets/commit/fb11d5de2a5118586587ed4a0d4db089162615d9))1303    * **skills/jj:** replace the all: revset modifier removed in jj 0.38.0 ([b20100f](https://github.com/cameronraysmith/vanixiets/commit/b20100faad1fae5cf952b98a0cfe31c64fc6b727))1304    * **skills/meta-session-resume:** allow automatic invocation ([6bd801b](https://github.com/cameronraysmith/vanixiets/commit/6bd801b953356e2238502c71995895fc868f7099))1305    * **skills/openspec-linear-sync:** generalize operator-specific dependency note; record coupling in nix layer ([b3dc0b3](https://github.com/cameronraysmith/vanixiets/commit/b3dc0b3bc9fe5104044dabf30e023a78711d8fba))1306    * **skills:** align openspec-linear-sync consumer references to the monorepo registry + frontmatter ledger ([9f9ce11](https://github.com/cameronraysmith/vanixiets/commit/9f9ce11e3a612584473565316bc9e6a261e736d1))1307    * **skills:** code-comment minimization directive (skills + agents-md body) ([e662859](https://github.com/cameronraysmith/vanixiets/commit/e662859795e75707262a51ec7b01dbda4aea86af))1308    * **skills:** correct dependency-source-acquisition escalation guidance ([f0c1448](https://github.com/cameronraysmith/vanixiets/commit/f0c1448daa9e2b05bef08b737368a70654059625))1309    * **skills:** make checkpoint metadata valid YAML ([2d8d18a](https://github.com/cameronraysmith/vanixiets/commit/2d8d18a82c826cafe92eb287997ea83592ead5ff))1310    * **skills:** make dependency-source-acquisition frontmatter strict-YAML parseable ([4f57636](https://github.com/cameronraysmith/vanixiets/commit/4f57636ff439f2be42014de71b693f4d4dd11fc4))1311    * **skills:** preserve executable modes for Codex ([3e87528](https://github.com/cameronraysmith/vanixiets/commit/3e87528f72a713678bbb89705f8c203125948295))1312    * **skills:** quote portable argument hints ([df464a1](https://github.com/cameronraysmith/vanixiets/commit/df464a1eea0e0cfabdb02bc7ee31b0a3a6215c31))1313    * **skills:** replace the all: revset modifier outside the jj corpus ([46ff49d](https://github.com/cameronraysmith/vanixiets/commit/46ff49d861e05863fd4b1cfb048c3ec282e07735))1314    * **skills:** restore reconciliation duty content to verbatim canonical source ([9d879e8](https://github.com/cameronraysmith/vanixiets/commit/9d879e88811915b788463d4355dcc12a439c2390))1315    * **skills:** restore three companion rules to verbatim canonical source ([63cc1b4](https://github.com/cameronraysmith/vanixiets/commit/63cc1b4c473035946b442d8aacc45e40fc69b2d4))1316    * **skills:** restore turn-ordering mitigations 3-5 to verbatim canonical source ([6943aa7](https://github.com/cameronraysmith/vanixiets/commit/6943aa70fc89f5c95209fe6e268aafff5ad9bf69))1317    * **skills:** shorten Nucleus skill description ([2ce927a](https://github.com/cameronraysmith/vanixiets/commit/2ce927afe88cccb6d0a4cab9cdc96503514f192d))1318    * **skills:** stop routing third-party repos into the maintained tree ([72f3f1c](https://github.com/cameronraysmith/vanixiets/commit/72f3f1c1a72dda8056450e819c5b29201cd8ca0e))1319    * **stack-land:** accept non-blocking check states ([47ca9d8](https://github.com/cameronraysmith/vanixiets/commit/47ca9d8dec2cf10a985e8e6587e10a87c3df741b))1320    * **stibnite:** declare trusted users ([1ac1551](https://github.com/cameronraysmith/vanixiets/commit/1ac1551ed72403274e9e548198a4c599f6469228))1321    * **stibnite:** pin nix conf hash ([ca89c14](https://github.com/cameronraysmith/vanixiets/commit/ca89c14340d164664d1043fc9e07c50b2cef9bf3))1322    * **stibnite:** pin nixbld gid 350 ([37f3d07](https://github.com/cameronraysmith/vanixiets/commit/37f3d077b454904b4c466b5d997603df1aff1e14))1323    * **stibnite:** restore kvm on the rosetta builder, advertised for TCG ([a59cd31](https://github.com/cameronraysmith/vanixiets/commit/a59cd31c9f162bd02ba675f3fa472173c38dbbc0))1324    * **stibnite:** scope the rosetta builder kvm claim to aarch64-linux ([18597d6](https://github.com/cameronraysmith/vanixiets/commit/18597d6990db9ad02ada7bd225fe2d0e220b9a93))1325    * **terranix:** track google provider 8.x ([12a869d](https://github.com/cameronraysmith/vanixiets/commit/12a869dee328463c6ea557561c4c520d396d8f50))1326    * **texlive:** texlive.combine -> texliveSmall.withPackages ([c393eb3](https://github.com/cameronraysmith/vanixiets/commit/c393eb35645aee10b5e1d946a84a35707093af8b))1327    * **tmux:** enable focus-events for terminal focus tracking ([3a16ef3](https://github.com/cameronraysmith/vanixiets/commit/3a16ef34cbf540991e44f0b4347e90d35181b571))1328    * **updaters:** resolve package paths from repository root ([7f91baf](https://github.com/cameronraysmith/vanixiets/commit/7f91bafb3579ef00484d0961e7baa23507b1c337))1329    * **wezterm:** stop masking Shift+Enter for omp kitty protocol ([623ec73](https://github.com/cameronraysmith/vanixiets/commit/623ec732430b9ea37bf3dd361d3a86f0486456e8))1330    * **wezterm:** use bundled default font stack, size 12 ([302bebb](https://github.com/cameronraysmith/vanixiets/commit/302bebb163c4db7939803ce4ff3fc382d5942ed4))1331    * **workflows:** accept Atomic's real model-catalog shape in stand-up-gitea-mq preflight ([f7a2e73](https://github.com/cameronraysmith/vanixiets/commit/f7a2e73a96dd018bbbfc970e56d836c823b94e05))1332    * **workflows:** accept both DNS record name forms and contain plan state ([ff92e6f](https://github.com/cameronraysmith/vanixiets/commit/ff92e6fd4c42a2cbd16200a5a07acec1a56e7f3f))1333    * **workflows:** activate Linux hosts from the locally built closure ([a39f15a](https://github.com/cameronraysmith/vanixiets/commit/a39f15a2d8fae8a6582e531dacfe207ed8a44ca8))1334    * **workflows:** bridge native structured-output exhaustion and confine App tokens ([d59a90a](https://github.com/cameronraysmith/vanixiets/commit/d59a90ad5818f012730f7502b10f2d208dc2c42c))1335    * **workflows:** close stand-up-gitea-mq review findings before launch ([55f496f](https://github.com/cameronraysmith/vanixiets/commit/55f496f5120ee8a818069a01af8dac92309bcd1e))1336    * **workflows:** defer the forge ExecStartPre comparison until both sides are committed ([656c061](https://github.com/cameronraysmith/vanixiets/commit/656c0618d8c2db9da078e92d34ae02de7a42e3b1))1337    * **workflows:** harden stand-up-gitea-mq proposal, DNS routing, and report paths ([3a66612](https://github.com/cameronraysmith/vanixiets/commit/3a66612cfdfbbfa4172ecdcfc3d9448614912b73))1338    * **workflows:** isolate App token minting and bound ruleset draft repair ([b9d04fa](https://github.com/cameronraysmith/vanixiets/commit/b9d04fac2aa14a9d41bcec4b530c70adc2440e1f))1339    * **workflows:** keep terraform failures diagnosable while withholding plan state ([a0a4d5e](https://github.com/cameronraysmith/vanixiets/commit/a0a4d5eb86659df061f6bd1b542c1c77d3fdd25b))1340    * **workflows:** let stand-up-gitea-mq preflight tolerate foreign edits in the shared wip ([ecb6afa](https://github.com/cameronraysmith/vanixiets/commit/ecb6afaeaa317d361be136a6ef02b62b2daefc3f))1341    * **workflows:** make stand-up-gitea-mq runs viable and resumable ([3fdb937](https://github.com/cameronraysmith/vanixiets/commit/3fdb93773e0ee4ecf79d751955bac223598ba37e))1342    * **workflows:** never regenerate an existing credential, and scope the clan backstop ([d02919e](https://github.com/cameronraysmith/vanixiets/commit/d02919e70e289d3315d96226c85354cc3654487d))1343    * **workflows:** pair chain and integrated preservation baselines ([065484e](https://github.com/cameronraysmith/vanixiets/commit/065484e22a820e1218fec2b73699a384ee03ee84))1344    * **workflows:** permit derived github.user in Janette identity gate ([6f7dfb2](https://github.com/cameronraysmith/vanixiets/commit/6f7dfb2569763201499a1ccf2bc7ea10afbd395f))1345    * **workflows:** probe clan availability with a flag the installed CLI accepts ([b203bb3](https://github.com/cameronraysmith/vanixiets/commit/b203bb3a5747eabd70b9fd234d030155bde878e2))1346    * **workflows:** project Janette and Darwin worker homes in preservation gates ([de20266](https://github.com/cameronraysmith/vanixiets/commit/de20266153fa1445f877d1b0d13022e11f48f55c))1347    * **workflows:** project observations before they reach a checkpoint ([51090f2](https://github.com/cameronraysmith/vanixiets/commit/51090f29be1b624de8220b43e0a59e69cb64301c))1348    * **workflows:** prove the pre-S1 forge baseline and revalidate after change edits ([734b639](https://github.com/cameronraysmith/vanixiets/commit/734b639aae5463ff375bac2bfb06fcac419cb29c))1349    * **workflows:** read Atomic current model through its actual API ([6adfd41](https://github.com/cameronraysmith/vanixiets/commit/6adfd410a399337087227a7045b9e427124a312a))1350    * **workflows:** require only subscribable events in the app contract ([4e4047f](https://github.com/cameronraysmith/vanixiets/commit/4e4047f2a5a1305c248a8d8415c4999a1ace9c70))1351    * **workflows:** resolve the terraform source at use time and keep evidence outside the repo ([b281027](https://github.com/cameronraysmith/vanixiets/commit/b281027baa6d0fcf4f0baa022426e3056bfb57e1))1352    * **workflows:** respect disabled Home Manager file sources ([2cdc1e7](https://github.com/cameronraysmith/vanixiets/commit/2cdc1e74a7a03099235dbb4c1d7d70368eb8a303))1353    * **workflows:** scope credential-listing parsing to this workflow's own vars ([100967e](https://github.com/cameronraysmith/vanixiets/commit/100967ed545277f16e344a1c8c3dd76a745476ac))1354    * **workflows:** scope stand-up-gitea-mq drift guards to the workflow's own paths ([a9ce405](https://github.com/cameronraysmith/vanixiets/commit/a9ce405605a32f0941409ac2eb363955bb803bb6))1355    * **workflows:** tolerate foreign divergence in the shared working copy ([8df333c](https://github.com/cameronraysmith/vanixiets/commit/8df333c806a38b263f4634341981fd75821e8d1b))1356    * **workflows:** treat an already-applied dns record as success ([928e1f9](https://github.com/cameronraysmith/vanixiets/commit/928e1f9d994239c4b5f43f3699ddebb8680a5cc2))1357    * **workflows:** verify dns and service reachability against public resolvers ([422e6dc](https://github.com/cameronraysmith/vanixiets/commit/422e6dc044c169b10f13ceda0df679f9958a70fe))1358    * **workflows:** verify pinned worker model against the catalog ([61401b2](https://github.com/cameronraysmith/vanixiets/commit/61401b2b05b07e0d0045b27917a05ae27fd871d8))1359    * **zerotier:** migrate stibnite machine ID and IP ([ba2cbaa](https://github.com/cameronraysmith/vanixiets/commit/ba2cbaab7a4c6407022db51019b05374be080f09))13601361### Features13621363    * aeneas + charon + elan for stibnite host; drop home-manager lean4 ([d308362](https://github.com/cameronraysmith/vanixiets/commit/d3083620864d357488577990b65bbc726b2d43a6))1364    * **agent-skills:** proxy mergify stack skill ([1b0c76d](https://github.com/cameronraysmith/vanixiets/commit/1b0c76d064316cfee52d2dcdcc13bb12cfad3532))1365    * **agents-md:** adopt communication rules and long-running command capture ([7e68e32](https://github.com/cameronraysmith/vanixiets/commit/7e68e3262869e54568495903886e14c4e0f6a0d8))1366    * **agents-md:** slim claude.md orchestrator-mode stub ([54f2362](https://github.com/cameronraysmith/vanixiets/commit/54f2362eb586d99ac59c32b25c0ae901b7317d27))1367    * **agents:** add the vanixiets context tier ([fdeb11c](https://github.com/cameronraysmith/vanixiets/commit/fdeb11c924c1c279fce299f78932f683e83b6309))1368    * **agents:** compose the agent context on devShell entry ([716713a](https://github.com/cameronraysmith/vanixiets/commit/716713adf23366ba618576b5e317c083182ee816))1369    * **agents:** compose the repository context file from the fragments ([0cca178](https://github.com/cameronraysmith/vanixiets/commit/0cca17899534b4c83b1b7e7df5bff8c561c642cd))1370    * **agents:** extract fleet and repository-class context into apm packages ([70fa35c](https://github.com/cameronraysmith/vanixiets/commit/70fa35cedeb26aeaf02ef89c3ca6f86ca89372c0))1371    * **agents:** materialize marketplace skills into git-ignored .agents/ ([953b0ff](https://github.com/cameronraysmith/vanixiets/commit/953b0ff9c19236fc6ad8b1be4820768b7ca1d5ad))1372    * **agents:** refresh the openwiki wiki from a just recipe ([8935581](https://github.com/cameronraysmith/vanixiets/commit/8935581ed850a13ff33426b100fbf0d3a519daa9))1373    * **agents:** relock to deliver the mergify-stack skill ([fcf0253](https://github.com/cameronraysmith/vanixiets/commit/fcf0253f52365b6065e8ffb3c4258d81f201e695))1374    * **ai:** add tuicr code review TUI to the home-manager ai aggregate ([0f5980a](https://github.com/cameronraysmith/vanixiets/commit/0f5980a2c85e1647d2228313e47a6e491d65afd4))1375    * **ai:** allocate Opus 5.5 across claude-code and omp ([63b7b43](https://github.com/cameronraysmith/vanixiets/commit/63b7b43da364d995bc259f517f301be708e4f2ec))1376    * **ai:** compose Playwright skills through shared APM capabilities ([66a3036](https://github.com/cameronraysmith/vanixiets/commit/66a30360362d903ec3119b3fc733ace8b06b7522))1377    * **ai:** enable pi-vim modal editing for pi only ([848909e](https://github.com/cameronraysmith/vanixiets/commit/848909e5494e541a64f01da891ffbf2057cf8f17))1378    * **apm-skills-marketplace:** /opsx:* → openspec-* skill-form ripple (router + bridge docs); config.yaml default schema=superpowers-bridge ([58d246a](https://github.com/cameronraysmith/vanixiets/commit/58d246abb48814cfd1189a6562b708af6da1cb10))1379    * **apm-skills-marketplace:** experiment with MARKETPLACE_PLUGIN + .apm/skills + producer pack + dual-manifest ([17a30df](https://github.com/cameronraysmith/vanixiets/commit/17a30df4673bbc059134eaabe5343a633f6fa3d8))1380    * **apm-skills-marketplace:** generalize apm-skills-compose over 17 packages + superpowers; neutralize formal-spec [@alias](https://github.com/alias) devDep blocking apm install ([da6263e](https://github.com/cameronraysmith/vanixiets/commit/da6263eb68796f3b1d99f317df6adb095e99303d))1381    * **apm-skills-marketplace:** manifests — dep edges, producer marketplace, taxonomy ([0c8a430](https://github.com/cameronraysmith/vanixiets/commit/0c8a43047a03c374381b57f08bfa649d3f028770))1382    * **apm-skills-marketplace:** OpenSpec delivery=skills; drop /opsx:* commands + assets/commands; Migration-Plan coherence ([f1b64ad](https://github.com/cameronraysmith/vanixiets/commit/f1b64ad3b45b84f187ef55a32b5c1f46b9bd0b43))1383    * **apm-skills-marketplace:** parameterize apm-skills-compose via typed aiSkills options ([0efe448](https://github.com/cameronraysmith/vanixiets/commit/0efe4489f4c957a19028cd5a548582d755fb6595))1384    * **apm-skills-marketplace:** regenerate vendored OpenSpec skills at 1.5.0 (delivery=skills) ([94efe73](https://github.com/cameronraysmith/vanixiets/commit/94efe73fe1b6afa181accbfa35e19a9a71577fc8))1385    * **apm-skills-marketplace:** restructure 104 skills into 17 apm packages ([b13d561](https://github.com/cameronraysmith/vanixiets/commit/b13d5614a5baddd84eda5bd713a9cf4268414631))1386    * **apm-skills-marketplace:** spike hermetic apm+nix compose ([411d2df](https://github.com/cameronraysmith/vanixiets/commit/411d2dfd9c138493e880f1541155156edaa70b7d))1387    * **apm-skills-marketplace:** superpowers as a regular remote apm dep resolved offline via git-cache pre-warm; drop superpowers-src ([11b1f3c](https://github.com/cameronraysmith/vanixiets/commit/11b1f3c77df052e95f61bb94ca6a7d46e67041be))1388    * **apm-skills-marketplace:** vendor the 11 OpenSpec skills into planning-and-development; drop extraSkillDirs; retarget refresh app per-skill ([012b014](https://github.com/cameronraysmith/vanixiets/commit/012b014bd5c0b9e0aa83997b316dd77908a68136))1389    * **apps/update:** add update-beads parity entry ([6c58cd7](https://github.com/cameronraysmith/vanixiets/commit/6c58cd796a0ce0cb5fc84849260216b7973b444a))1390    * **apps/update:** add update-dolt parity entry ([c9782b7](https://github.com/cameronraysmith/vanixiets/commit/c9782b770e59cffed31ffd6988ec57c5685e2a24))1391    * **apps:** add cognee-agentskills cognee dataset refresh flake app ([f749714](https://github.com/cameronraysmith/vanixiets/commit/f749714661ca379e83bd652920ed8bea7ce554b0))1392    * **apps:** add openspec-refresh-vendored-artifacts flake app ([c473372](https://github.com/cameronraysmith/vanixiets/commit/c4733727e82da6f395b0ba575bbc0baec508c33e))1393    * **apps:** apm-marketplace consumer-path validation flake-app ([30d6571](https://github.com/cameronraysmith/vanixiets/commit/30d65718687c779f3a7769fbbecb5e0ad7637a21))1394    * **apps:** bootstrap a home profile from a remote flake ref ([4a3afb0](https://github.com/cameronraysmith/vanixiets/commit/4a3afb08f58634be6e1cfa0c3742ebe8691b877c))1395    * **apps:** expose the atomic update script as a flake app ([6c84d6d](https://github.com/cameronraysmith/vanixiets/commit/6c84d6dfeec800ffcafb1cd6058a4ac097247e75))1396    * **apps:** expose update-buzz-source ([04a2522](https://github.com/cameronraysmith/vanixiets/commit/04a25223f0814788a81b41c655031afe6751d970))1397    * **atomic:** declare pi-only extension scope for inherited extensions ([9bebce6](https://github.com/cameronraysmith/vanixiets/commit/9bebce6ca2946f508c9595426ac3e3bb5c14446c))1398    * **atomic:** manage settings.json with a merging activation ([eb13f0a](https://github.com/cameronraysmith/vanixiets/commit/eb13f0aa7ee0f3f0fac4ba9d5c162ea569b0e910))1399    * **atomic:** use Opus 5.5 instead of Opus 5 ([43906c2](https://github.com/cameronraysmith/vanixiets/commit/43906c25f9f609394331da181185dec388f2e14d))1400    * **bootstrap:** add uninstall-nix target ([d195bb6](https://github.com/cameronraysmith/vanixiets/commit/d195bb61f7e73d849de60965e5798c6678cd7702))1401    * **brand:** add modules/brand with flake.brand.logo asset for downstream NixOS modules ([3d6f727](https://github.com/cameronraysmith/vanixiets/commit/3d6f7272b44891dd78c67bc0507f35a2927aab33))1402    * **buildbot:** add Restart=always to buildbot-master and buildbot-worker ([3e25edd](https://github.com/cameronraysmith/vanixiets/commit/3e25edddce027548a7117ec76bb78252624fa8ec))1403    * **buildbot:** install buildbot-effects cli system-wide ([5b3e823](https://github.com/cameronraysmith/vanixiets/commit/5b3e823e8cf183422638bdb07509261d2ac144d3))1404    * **buildbot:** stop admitting sciexp/ironstar ([e8921a2](https://github.com/cameronraysmith/vanixiets/commit/e8921a24868caa70ac4810baccee9350bd819a07))1405    * **buildbot:** stop serving vanixiets, keep serving ironstar ([aeea35a](https://github.com/cameronraysmith/vanixiets/commit/aeea35abc90a4f9f04b554cf37ecbe199a07a766))1406    * **ccstatusline:** add layout variant toggle with simplified 1-line experiment ([7d5ba1d](https://github.com/cameronraysmith/vanixiets/commit/7d5ba1d70047cf0301a54669c125c9e752a9b2ec))1407    * **ccstatusline:** drop model segment from simplified variant ([8bbf7c3](https://github.com/cameronraysmith/vanixiets/commit/8bbf7c38068738c41f1ebd169d40a26a3120a9a2))1408    * **ccstatusline:** replace git-worktree+git-branch with short HEAD sha in simplified variant ([5c10d3e](https://github.com/cameronraysmith/vanixiets/commit/5c10d3ee5e06150adf63fb5216e3ee4415a443cf))1409    * **ccstatusline:** switch cwd to fishStyle in both layout variants ([c4608b2](https://github.com/cameronraysmith/vanixiets/commit/c4608b2afeaeb7145e91c7efb33c9a653a697501))1410    * **checks/machines:** include scheelite in nixos-* check coverage ([8ddff0b](https://github.com/cameronraysmith/vanixiets/commit/8ddff0b88683d60831ff93f2063d18ed6fb9fd91))1411    * **checks/machines:** programmatic per-system derivation, add darwin builds ([47d6cab](https://github.com/cameronraysmith/vanixiets/commit/47d6cab5d739c247e10c71e9d15475d120b5ccca))1412    * **checks:** add per-package and per-package-test re-exports ([f055844](https://github.com/cameronraysmith/vanixiets/commit/f0558448bd7916f4641ff282097e00a95d2735c6))1413    * **checks:** evaluate and build every flake app per system ([943482b](https://github.com/cameronraysmith/vanixiets/commit/943482bcbc7246af3feaf3d892e9bfe19bc49b46))1414    * **checks:** pin home.packages names per user ([26205b6](https://github.com/cameronraysmith/vanixiets/commit/26205b609497d4cd196b65213388ab7709279285))1415    * **checks:** regulate cilium, gateway-api, and k3s version coupling ([8217010](https://github.com/cameronraysmith/vanixiets/commit/821701072c56f0b95ca3595abf42b53b88be74e4))1416    * **checks:** validate the renovate config and expose renovate in the devshell ([0687da5](https://github.com/cameronraysmith/vanixiets/commit/0687da50613191567e683709e951aa1c36767dbf)), closes [hi#fidelity](https://github.com/hi/issues/fidelity)1417    * **chrome-devtools-axi:** package 0.1.29 as a by-name derivation ([4aff2f5](https://github.com/cameronraysmith/vanixiets/commit/4aff2f5885f8dfc257f3d892c20644618dc7efce)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi)1418    * **cinnabar/caddy:** add hermes.zt reverse-proxy to dashboard ([e99e918](https://github.com/cameronraysmith/vanixiets/commit/e99e91813d806b29200cf79c5cd2434dd95f2a15))1419    * **cinnabar/hermes-agent:** default to z-ai/glm-5.1 via OpenRouter + mono dashboard theme ([e750589](https://github.com/cameronraysmith/vanixiets/commit/e7505898aaf130b061a6b4e292e52e8795a66371))1420    * **cinnabar/hermes-agent:** wire matrixHomeserverUrl to colocated tuwunel ([44d6679](https://github.com/cameronraysmith/vanixiets/commit/44d66790a0fbcc6d3cff58ee5719229ddbbdbf6b))1421    * **cinnabar/inventory:** instantiate hermes-agent clan-service ([59c4b09](https://github.com/cameronraysmith/vanixiets/commit/59c4b0970ccebcd06f56e12b19cb204cdcd2c46b))1422    * **cinnabar/matrix:** register hermes matrix user ([f408aa1](https://github.com/cameronraysmith/vanixiets/commit/f408aa1aaa46c0769a0ad6efdb20668b42131bf2))1423    * **cinnabar/zt-dns:** add hermes.zt DNS records (IPv6 + IPv4) ([7ce6a0b](https://github.com/cameronraysmith/vanixiets/commit/7ce6a0b202ecf8d1638991af0f506b26ee8191bb))1424    * **clan-service:** scaffold hermes-agent wrapper module ([667e667](https://github.com/cameronraysmith/vanixiets/commit/667e6673b588fb902740ff31f75c17845bdac814))1425    * **clan/hermes-agent:** add 'matrix' to extraDependencyGroups for mautrix-python ([5ad73a3](https://github.com/cameronraysmith/vanixiets/commit/5ad73a3eaa8c180e2d354869e2b109d355036419))1426    * **clan/hermes-agent:** configure OpenRouter→openai/gpt-5.5 fallback ([bd4ca2e](https://github.com/cameronraysmith/vanixiets/commit/bd4ca2e9b8b4ec2329168bbfbc0c65ecf7263c56))1427    * **clan/hermes-agent:** enable holographic local memory provider ([a976d56](https://github.com/cameronraysmith/vanixiets/commit/a976d56e78b65a99c5b7daa57d32685fe79c4f62))1428    * **clan/hermes-agent:** expose CLI via addToSystemPackages ([a6e2f8a](https://github.com/cameronraysmith/vanixiets/commit/a6e2f8a7075ff061a968aab46d6ea897f8a219b5))1429    * **clan/hermes-agent:** expose homeRoom option and set "cron" room as matrix home channel ([bd80fdc](https://github.com/cameronraysmith/vanixiets/commit/bd80fdc90dd88c4d60474d20b2aaa59b90567a6f))1430    * **clan/hermes-agent:** expose matrixHomeserverUrl setting with loopback default ([a8c8f66](https://github.com/cameronraysmith/vanixiets/commit/a8c8f661315f68de9fa9b9705335fdef465f1f71))1431    * **clan/hermes-agent:** flip operationally-critical defaults for headless gateway ([8a227bb](https://github.com/cameronraysmith/vanixiets/commit/8a227bb8eb745904b0078af7b18a20b8ebdda3e1))1432    * **clan/hermes-agent:** wire channelsAllowlist into matrix settings deep-merge ([e0bc00f](https://github.com/cameronraysmith/vanixiets/commit/e0bc00f04956123289850ccc1f77d5263a03ccef))1433    * **clan/hermes-agent:** wire skills.external_dirs to ~/.hermes/external-skills ([3b30884](https://github.com/cameronraysmith/vanixiets/commit/3b30884567fdf0f65fbbdb3426c62790c0bb5ce0))1434    * **clan:** replace per-machine builder modules with a nix-builders service ([1f817ce](https://github.com/cameronraysmith/vanixiets/commit/1f817ce55e449026c169c51d0db567d1c335fb93))1435    * **claude-code/hooks:** register worktree-gate and diamond-verify hooks ([9a52a75](https://github.com/cameronraysmith/vanixiets/commit/9a52a75b3ed425ea9c74bee0e73a5298a0ab9bde))1436    * **claude-code:** default to auto permission mode, skip confirmation prompt ([06ddd81](https://github.com/cameronraysmith/vanixiets/commit/06ddd81b6525337d32ab143fcab997c0b5665213))1437    * **claude-code:** default to Opus 5.5 instead of Fable ([77ce242](https://github.com/cameronraysmith/vanixiets/commit/77ce2424d98d0134cba87f84f13d5b0badfcb9c9))1438    * **claude-code:** disable linear MCP plugin in favor of linear-cli ([009fad5](https://github.com/cameronraysmith/vanixiets/commit/009fad5e7815ebd5a8e2937e363a7d218afbe1dc))1439    * **claude-code:** make ccds an explicit --permission-mode auto alias ([290281c](https://github.com/cameronraysmith/vanixiets/commit/290281c8f0ec983a43383f3063f448c6ae059707))1440    * **claude-code:** pin and enable cognee-memory marketplace plugin ([4ea02eb](https://github.com/cameronraysmith/vanixiets/commit/4ea02eb495719e6a4ad48ad03e9dc8f89c36a324))1441    * **cli:** share portable capabilities with Omnigent workers ([87a35ff](https://github.com/cameronraysmith/vanixiets/commit/87a35ff98476aeedb5b2d8a99f97380f70dce547))1442    * **codex/mutable-settings:** mirror claude-code's mutable-config pattern ([610ffb2](https://github.com/cameronraysmith/vanixiets/commit/610ffb20deb94c6537a6a49ebfd486db9de4c017))1443    * **cognee/cli:** deliver quiet cognee SaaS wrapper + raw cognee-cli escape hatch ([e2e2b38](https://github.com/cameronraysmith/vanixiets/commit/e2e2b380404fc9368693ffaf97a012e87f0eeef9))1444    * **cognee/client:** drop MCP client, deliver plugin env + per-host X-Api-Key ([cf28aa7](https://github.com/cameronraysmith/vanixiets/commit/cf28aa7c476bcb054d8044cfc0e8c8415c29f7a5))1445    * **cognee:** add cognee-nix flake input and overlay ([87ba823](https://github.com/cameronraysmith/vanixiets/commit/87ba8231088a98a3c3ff504c63269072ef2b10ec))1446    * **cognee:** add global cognee-cli wrapper baking mesh api-url + per-host key ([6d10d30](https://github.com/cameronraysmith/vanixiets/commit/6d10d30418ae6806b494d48ef402d6fa7cc7f4e8))1447    * **cognee:** attach to magnetite and add ZFS dataset ([a287e25](https://github.com/cameronraysmith/vanixiets/commit/a287e254b3657758bea18985b3943d06bac59f52))1448    * **cognee:** bespoke ports 9270/9271, loopback API, enable server-side http MCP ([34db6cd](https://github.com/cameronraysmith/vanixiets/commit/34db6cd558a9fa7f9939ebee4218bb7282c78033))1449    * **cognee:** bind REST to ZeroTier, require auth, drop MCP, gate binds ([d6486a4](https://github.com/cameronraysmith/vanixiets/commit/d6486a41071ae5f07de2516c20b435a9a7eb8f3c))1450    * **cognee:** deliver stibnite per-host X-Api-Key via sops home-manager secret ([b8ba588](https://github.com/cameronraysmith/vanixiets/commit/b8ba5881e6336a840587e20585bcbf555c63ae4b))1451    * **cognee:** enable frontend on loopback + runtime backend env behind sso-gateway ([c107a8c](https://github.com/cameronraysmith/vanixiets/commit/c107a8cd15a3a446138e7804fa87176d8fa720c8))1452    * **cognee:** local http MCP client config (~/.mcp/cognee.json) ([44a0d17](https://github.com/cameronraysmith/vanixiets/commit/44a0d174cb6fd7ce596e4f7a47e43c3833522b57))1453    * **cognee:** magnetite service module with clan-vars secrets and resource caps ([d7d7de5](https://github.com/cameronraysmith/vanixiets/commit/d7d7de5cbb1b97dcc03a2a592e1dea00ba452388))1454    * **cognee:** seed flake.lib.hosts registry + derived flake.lib.cognee source of truth ([30b8b7b](https://github.com/cameronraysmith/vanixiets/commit/30b8b7b9e3dd2b75b7e0c29e2cba47f2b051e49a))1455    * **commands/dev:** add claude-sessions-live for live session enumeration ([12a605e](https://github.com/cameronraysmith/vanixiets/commit/12a605e8e78e570f9f528f943e1974ca545090be))1456    * **commands:** add ts-restore ([c16b2b3](https://github.com/cameronraysmith/vanixiets/commit/c16b2b33a64299ca6a2695d32976e37d47a851fa))1457    * **context:** add operating-principles section, factor task-scoped prose out of agents-md body ([e388625](https://github.com/cameronraysmith/vanixiets/commit/e3886254175131a63500b513f53669b98d251e0f))1458    * **context:** integrate the discharge obligation into agent context ([424efcc](https://github.com/cameronraysmith/vanixiets/commit/424efcce45dc3f20b8e2f3c9a204132fd01ee7d0))1459    * **darwin:** declare per-host sshd posture as an operator claim ([323adbb](https://github.com/cameronraysmith/vanixiets/commit/323adbba6c010be579d56e963155e1dcfb7aec3c))1460    * **darwin:** declare sshd server enablement for stibnite ([25d10e7](https://github.com/cameronraysmith/vanixiets/commit/25d10e7cc6efcf78b8f89ce9557778345df6c5ad))1461    * **darwin:** enable encrypted DNS on argentum and rosegold ([a0bdafd](https://github.com/cameronraysmith/vanixiets/commit/a0bdafda3e383af90fb9727f08b7e5864577a69e))1462    * **development-packages:** add apm ([6a1e807](https://github.com/cameronraysmith/vanixiets/commit/6a1e807b5c5edb9c6dbbe8f85cff42dbd2dd772d))1463    * **development-packages:** add ghq ([891c9a8](https://github.com/cameronraysmith/vanixiets/commit/891c9a8de8e321f20e7310b5c65df5cb2acd0c69))1464    * **development-packages:** add linear-cli to dev packages ([0c0fe8d](https://github.com/cameronraysmith/vanixiets/commit/0c0fe8d797cb2674c157a592d67a3bdd34623b25))1465    * **development-packages:** add openspec to dev packages ([962beb2](https://github.com/cameronraysmith/vanixiets/commit/962beb2e4a32141cccd17121db6da405ee77557f))1466    * **development-packages:** add ttyd ([0c4f193](https://github.com/cameronraysmith/vanixiets/commit/0c4f1937fad0c4fa7a9e0912bd35fb023f18d0ed))1467    * **development-packages:** install git-repo-manager (grm) ([2403cb5](https://github.com/cameronraysmith/vanixiets/commit/2403cb5c273b1e1bfb03808cedfd179e830cf9fa))1468    * **devin:** add git-backed devin environment blueprint ([cc73ba0](https://github.com/cameronraysmith/vanixiets/commit/cc73ba01a02e65cb2b8e194beb97f0a64aff5b6d))1469    * **devin:** enable Outposts workers on stibnite and magnetite ([059c731](https://github.com/cameronraysmith/vanixiets/commit/059c731d3a443b22f3c002393c3c4d0ce498fbbb))1470    * **devin:** install the interactive CLI for the crs58 home ([92c0a56](https://github.com/cameronraysmith/vanixiets/commit/92c0a56b93d7d9b6ea36f3672fa4291247efe9b5))1471    * **devshells:** add the kanidm 1.11 client for identity administration ([0f88ff8](https://github.com/cameronraysmith/vanixiets/commit/0f88ff8277f3874262c968681ed429d15f87a530))1472    * **devshell:** supply the CLIs the skill corpus shells out to ([ed836e5](https://github.com/cameronraysmith/vanixiets/commit/ed836e5817816151c7e16e94e6b7f6bdd7722a50))1473    * **docs:** index the module tree and state its local contracts ([b55ce4d](https://github.com/cameronraysmith/vanixiets/commit/b55ce4d17f9d28b12173a5a782f29a6205645a07))1474    * **docs:** preserve browser evidence behind a required verdict gate ([ab6b06b](https://github.com/cameronraysmith/vanixiets/commit/ab6b06b7a4fa718783d67cd882f1ab522f398df6))1475    * **docs:** publish validated browser evidence from finished builds ([c7884ce](https://github.com/cameronraysmith/vanixiets/commit/c7884cebd38a386d5fbfba3e60b81c531c39a547))1476    * **docs:** run firefox and webkit in the hermetic e2e check ([bb59487](https://github.com/cameronraysmith/vanixiets/commit/bb59487cfea5046c43c75da2dea4e378af90d854))1477    * **duckdb:** 1.5.2 -> 1.5.3 ([03aaa58](https://github.com/cameronraysmith/vanixiets/commit/03aaa58a9f33219bfceef1a77c21c053849d8f01))1478    * **effects:** add ironstar-effects-secrets clan-vars generator ([b88985c](https://github.com/cameronraysmith/vanixiets/commit/b88985c1eb76b1565529e972a3d3833ebda9d004))1479    * **effects:** declare secretsMap on the vanixiets effects ([5c9feee](https://github.com/cameronraysmith/vanixiets/commit/5c9feeeeffdf38ad31cc7fe6e7f628b4624a80e5))1480    * **effects:** provision R2 evidence credentials for the effects runner ([6c669b3](https://github.com/cameronraysmith/vanixiets/commit/6c669b33b8517488902ccc1ad2028d729870cef0))1481    * **effects:** publish browser evidence on build_finished and main pushes ([aaf54c1](https://github.com/cameronraysmith/vanixiets/commit/aaf54c1bd1c8f24454bad278d51ce8e8100711c0))1482    * **effects:** register ironstar-effects-secrets perRepoSecretFiles for github:sciexp/ironstar ([b562f4a](https://github.com/cameronraysmith/vanixiets/commit/b562f4a1bad0e59a8c10c0b2452bcdf8b0b06721))1483    * **effects:** resolve pull requests at runtime for both build services ([c252727](https://github.com/cameronraysmith/vanixiets/commit/c252727f40754670bbb9598df898e2528f57237c))1484    * **effects:** support build-finished event registration ([2c18d83](https://github.com/cameronraysmith/vanixiets/commit/2c18d83ceb925d2281655743cb954593f52d742c))1485    * **evidence-worker:** serve browser evidence read-only from R2 ([372fcd3](https://github.com/cameronraysmith/vanixiets/commit/372fcd352d2bdc4fa1d5f0ebdc1e3e65778f6f72))1486    * **firstmate:** install chrome-devtools-axi for the agent user ([e545e51](https://github.com/cameronraysmith/vanixiets/commit/e545e516aa0fc75e4a41f9fc180ddcfea2111f14))1487    * **flake:** add epireyn/niri-flake for typed niri configuration ([cc29b2b](https://github.com/cameronraysmith/vanixiets/commit/cc29b2b35d5e3e1136e90c452557d7ea278d0d2d))1488    * **flake:** add hermes-agent input with nixpkgs follows ([63c4e02](https://github.com/cameronraysmith/vanixiets/commit/63c4e02a7e0109726ce27c09510c661b637d034c))1489    * **gh-dash:** bind queue enqueue over the built-in merge ([c8f62e0](https://github.com/cameronraysmith/vanixiets/commit/c8f62e0bd3da1c40b8ddd4f0135f96e775b181a8)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash)1490    * **gh-dash:** review the selected PR in tuicr in a new herdr tab ([031b40d](https://github.com/cameronraysmith/vanixiets/commit/031b40d34fff079d5362db34abc5b82d7582ca6e)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [owner/repo#N](https://github.com/owner/repo/issues/N)1491    * **gh:** install stacked PR extension declaratively ([8641e50](https://github.com/cameronraysmith/vanixiets/commit/8641e504d4a740ede2154dcc78f95846179253fa))1492    * **ghq-sync:** register fetched/updated repos with zoxide and add --seed-zoxide ([b005177](https://github.com/cameronraysmith/vanixiets/commit/b00517792a7f72b08364bc30fec20a821933884c))1493    * **gitea-mq:** add magnetite credentials for the sciexp-gitea-mq app ([ca8f662](https://github.com/cameronraysmith/vanixiets/commit/ca8f6624707972235e8638f9643704fa90ce6505))1494    * **gitea-mq:** post-g1 ([1fdcdcf](https://github.com/cameronraysmith/vanixiets/commit/1fdcdcf14ddbe6ffdb26915f354bd2efd3c40724))1495    * **gitea-mq:** raise the batch cap to twenty for flake-update waves ([8e6a334](https://github.com/cameronraysmith/vanixiets/commit/8e6a334ec23fb432e450c59d8b0cdfd41826b21d))1496    * **gitea-mq:** retarget the stand-up change at queue-only batching ([aedc7dd](https://github.com/cameronraysmith/vanixiets/commit/aedc7dd3aa2e2fe9a04b0af79b369153eec8d5e9))1497    * **gitea-mq:** s1 ([9d33e2f](https://github.com/cameronraysmith/vanixiets/commit/9d33e2f6bbfa69d5f5d8cd4ae349a97470b6ee52))1498    * **gitea-mq:** s2 ([b677011](https://github.com/cameronraysmith/vanixiets/commit/b677011b131b59bdbde9de49c8ef0504549a9dd6))1499    * **gitea:** tune start-limit to survive postgres recovery window ([d4d1076](https://github.com/cameronraysmith/vanixiets/commit/d4d10764d6a7cab30d49795c82a2c9c9662d30c5))1500    * **hermes-agent:** add clan-vars generators for OPENROUTER_API_KEY and MATRIX_PASSWORD ([575b659](https://github.com/cameronraysmith/vanixiets/commit/575b659a97175a0450a97ea01253206b3a15cee4))1501    * **hermes-agent:** add defensive kernel-hardening directives; document upstream-default rationale ([5e82244](https://github.com/cameronraysmith/vanixiets/commit/5e8224469d2502f045db9d2c0103141c2fe42828))1502    * **hermes-agent:** add sibling hermes-agent-dashboard systemd unit ([7541a0f](https://github.com/cameronraysmith/vanixiets/commit/7541a0f1178d0a861af1c5ec6863d3b12b0ed3a6))1503    * **hermes-agent:** upgrade to upstream v2026.6.5, drop 27716 locale fork ([473f884](https://github.com/cameronraysmith/vanixiets/commit/473f8840f871a6e8877a8efa6c9f04055010eed1)), closes [#38383](https://github.com/cameronraysmith/vanixiets/issues/38383) [#27716](https://github.com/cameronraysmith/vanixiets/issues/27716)1504    * **hermes-agent:** wire clan-vars-to-environmentFiles adapter ([1d04a82](https://github.com/cameronraysmith/vanixiets/commit/1d04a826859f1bf2fcda20b57ffef4e5ab6f9b04))1505    * **hermes:** enable voice extra (local STT) + ffmpeg/portaudio native deps ([0696936](https://github.com/cameronraysmith/vanixiets/commit/069693651c75d5472a78b94ad1851a747bd7a1cc))1506    * **hermes:** provision firecrawl + fal gateway client deps in the sealed venv ([238085f](https://github.com/cameronraysmith/vanixiets/commit/238085f612f4cf5ae9f70ce506a8e916bd459db4))1507    * **home,devshell:** expose uncomment via home packages and default devShell ([97cf62a](https://github.com/cameronraysmith/vanixiets/commit/97cf62a80c97cc3c71bd1db2e2ec87d117831d50))1508    * **home/agents-md:** materialize ~/.hermes/SOUL.md for hermes persona injection ([b58bd9d](https://github.com/cameronraysmith/vanixiets/commit/b58bd9d3e8ff546732739bd19e362629c9f5a137))1509    * **home/ai/claude-code:** disable git instructions ([5e2cebe](https://github.com/cameronraysmith/vanixiets/commit/5e2cebebc5d5cf1e41af4c5139a117b6e7644b3e))1510    * **home/ai/claude-code:** enable Linear official plugin ([c5e39d8](https://github.com/cameronraysmith/vanixiets/commit/c5e39d87b95bcb21b1c4cdabff0dd245da48104c))1511    * **home/ai/claude-code:** pin dagster-skills marketplace and enable dagster-expert ([93c2300](https://github.com/cameronraysmith/vanixiets/commit/93c2300b72702529b7d6f1e89594f86ada6afb20))1512    * **home/ai/claude-code:** wire WorktreeCreate/WorktreeRemove hooks + git-worktree Bash deny + worktree.baseRef ([3ca4b26](https://github.com/cameronraysmith/vanixiets/commit/3ca4b26888140c5892cc99f7f1b545af9e0e09dc)), closes [anthropics/claude-code#32355](https://github.com/anthropics/claude-code/issues/32355)1513    * **home/ai/codex:** route Linear via direct MCP and curated plugin skill, disable apps connector channel ([86a7064](https://github.com/cameronraysmith/vanixiets/commit/86a7064379deb44d36dda3ddde4cff842282eb19))1514    * **home/ai/openspec:** add opt-in programs.openspec module ([a46fc92](https://github.com/cameronraysmith/vanixiets/commit/a46fc9255df3529a2e4fc020cca7155629d413e3))1515    * **home/ai/openspec:** regenerate vendored assets with all 11 openspec workflows ([0293fa5](https://github.com/cameronraysmith/vanixiets/commit/0293fa543452a0897efacccc4ecc1baeb4c7163e))1516    * **home/ai/openspec:** vendor openspec 1.3.1 claude skills + opsx commands + regen script ([7b38157](https://github.com/cameronraysmith/vanixiets/commit/7b381573d34046bb3da9e00c236b1e92b65090c8))1517    * **home/ai/openspec:** vendor superpowers-bridge schema for user-global openspec delivery ([4054a66](https://github.com/cameronraysmith/vanixiets/commit/4054a669fac039db2f2c3f193f5586419c536181))1518    * **home/ai/skills:** add knowledge-graph skill for cognee reference-corpus grounding ([910bd79](https://github.com/cameronraysmith/vanixiets/commit/910bd7996a9eef2cefa3d625c0dc3d4f4654c12b))1519    * **home/ai/skills:** add refinement-driven-development skill ([571474d](https://github.com/cameronraysmith/vanixiets/commit/571474d3100cbe5c7e282baa909e33e8f1cbd68e))1520    * **home/ai/skills:** exclude pocock tdd skill from delivery ([1a7ed6d](https://github.com/cameronraysmith/vanixiets/commit/1a7ed6da0d53ebb93570a01855ae3e0666e6874a))1521    * **home/ai/skills:** inject coreSkills into ~/.hermes/external-skills/ ([9f49c08](https://github.com/cameronraysmith/vanixiets/commit/9f49c081f66123af911761b33ff61b7cd109d0b2))1522    * **home/ai:** add herdr agent multiplexer via prebuilt herdr-bin ([996b3f2](https://github.com/cameronraysmith/vanixiets/commit/996b3f2ffd1fee0422c75129fd14d4f0d2250d49))1523    * **home/ai:** add hunk diff-review tool with vendored review skill ([6a432c3](https://github.com/cameronraysmith/vanixiets/commit/6a432c365e4b82a5571cd1732eca7fb0c254fadc))1524    * **home/ai:** add the moshi-hook service module ([42074c9](https://github.com/cameronraysmith/vanixiets/commit/42074c9555fed26de05f49e700e8a5f3e3fb66f7))1525    * **home/ai:** add worktrunk via upstream HM module over worktrunk-bin ([e210071](https://github.com/cameronraysmith/vanixiets/commit/e210071ab285ddb91f790b294809165a80377840))1526    * **home/ai:** assign omp model roles by consumer ([4bdc2db](https://github.com/cameronraysmith/vanixiets/commit/4bdc2db531810beed58ef9df3cba6575e719d81a))1527    * **home/ai:** bind prefix+! to break pane into a new tab ([bbcc33c](https://github.com/cameronraysmith/vanixiets/commit/bbcc33c56d3eca1fcb8cd0666af61dfb60f48726))1528    * **home/ai:** declare atomic model roles in settings.json ([d99a789](https://github.com/cameronraysmith/vanixiets/commit/d99a78919e6a7d2f1bdf988169cdc17958437686))1529    * **home/ai:** enable ouroboros claude code plugin with version-coupled mcp registration ([f59822f](https://github.com/cameronraysmith/vanixiets/commit/f59822f5619cd517a563648b12d62c69810a1d04))1530    * **home/ai:** install the atomic coding agent ([2d41664](https://github.com/cameronraysmith/vanixiets/commit/2d4166406b406b34c2a070e948f93d048791dadd))1531    * **home/ai:** migrate claude code plugin marketplaces to store-pinned directory sources ([4ca2f1c](https://github.com/cameronraysmith/vanixiets/commit/4ca2f1c8a7d31727a9d9a889551afc3548294137))1532    * **home/ai:** move omp memory from hindsight to the local mnemopi store ([e8ce188](https://github.com/cameronraysmith/vanixiets/commit/e8ce18857a37efa9b2e40f4ba304d19ecd0d1f1a)), closes [.#mnemopi-memory-validate](https://github.com/./issues/mnemopi-memory-validate)1533    * **home/ai:** split claude-code across an orchestrator and worker model ([c496ca3](https://github.com/cameronraysmith/vanixiets/commit/c496ca3cc30393519ab68d4af375c1c1a6c1cabc))1534    * **home/ai:** vendor herdr control skill from ogulcancelik/herdr@v0.7.1 ([c10cc42](https://github.com/cameronraysmith/vanixiets/commit/c10cc42a670afb70f6f94ef448dc741e00f4156f))1535    * **home/claude-code:** disable bg-isolation worktree guard fleet-wide ([13a770a](https://github.com/cameronraysmith/vanixiets/commit/13a770a1a21adec8e74cae9ed03676ad120430c4))1536    * **home/core:** colorize man pages via bat MANPAGER cross-shell ([d282f47](https://github.com/cameronraysmith/vanixiets/commit/d282f473c40b83f9a7dc871d82a5f79c992382d3))1537    * **home/crs58:** adopt schpet linear-cli credentials.toml config ([aeeb2f5](https://github.com/cameronraysmith/vanixiets/commit/aeeb2f5a325454e221ffa6ccd63bf6c2e60c2061))1538    * **home/crs58:** declarative linear-cli config via sops template ([f9c1cb0](https://github.com/cameronraysmith/vanixiets/commit/f9c1cb00b9cc30f93ed736e1b0c7acbf5b94a529))1539    * **home/crs58:** declaratively pin openspec global config (custom profile, 11 workflows) ([b10d58d](https://github.com/cameronraysmith/vanixiets/commit/b10d58d766d9c0a52b2c928aa7721afe7adf441e))1540    * **home/crs58:** declare buzz-nsec sops secret ([342f7e6](https://github.com/cameronraysmith/vanixiets/commit/342f7e6cd1835f47f07a0694c7212a811c4d34d4))1541    * **home/crs58:** inject linear-cli bundled skills via aiSkills.extraSkillDirs ([e8a3279](https://github.com/cameronraysmith/vanixiets/commit/e8a3279cf57509c365a462ea08b05d8d7150912c))1542    * **home/crs58:** inject openspec skills + opsx commands at user level ([3eb3040](https://github.com/cameronraysmith/vanixiets/commit/3eb3040c0b2f0e2038ed40e3b5a65786595e3b3b))1543    * **home/crs58:** route buzz credentials through the nix-built helper ([f33a945](https://github.com/cameronraysmith/vanixiets/commit/f33a9456d22f0bbf424c24ac969087532a220218))1544    * **home/crs58:** route buzz git credentials through git-credential-nostr ([d07fd77](https://github.com/cameronraysmith/vanixiets/commit/d07fd7758b50845673e99a35575226116331d777))1545    * **home/packages:** add datafusion-cli alongside the duckdb CLI ([9ec9364](https://github.com/cameronraysmith/vanixiets/commit/9ec93640b07229b34d7baa5ae8edda92d0e8ec7c))1546    * **home/packages:** add forgejo-cli (fj) to development tools ([2ce5425](https://github.com/cameronraysmith/vanixiets/commit/2ce54255b531bad540ba071f9cc075f630ab91cb))1547    * **home/packages:** install cursor-agent from llm-agents ([807b892](https://github.com/cameronraysmith/vanixiets/commit/807b892411f2133cd39116ba268997ea5d635181))1548    * **home/shell/fish:** plugin-git parity, superiority plugins, native editor-edit ([12ba639](https://github.com/cameronraysmith/vanixiets/commit/12ba639aa8a2a6386ca2c595209a027df8f3be62))1549    * **home/terminal:** add carapace cross-shell completer for nix and gap completions ([ff447f8](https://github.com/cameronraysmith/vanixiets/commit/ff447f87ab3ae5932dcee9f39bd77d56b8268be8))1550    * **home/terminal:** browser-terminal wrapper around ttyd and herdr ([c7d1607](https://github.com/cameronraysmith/vanixiets/commit/c7d160735aa44972ae0bad2a192d0ac08e06679e))1551    * **home/tools/agents-md:** invert dispatch instruction to mode-conditional three-tier model — diamond default in jj mode, worktrees only on explicit request ([506ef12](https://github.com/cameronraysmith/vanixiets/commit/506ef12971685c7b3cf059b1ceea87bad0aaf0d9))1552    * **home/tools/agents-md:** reconcile skill routing with beads/session-* deprecation ([02b504c](https://github.com/cameronraysmith/vanixiets/commit/02b504c2b1631e0b5fe5d43dd25cd3041e07bc54))1553    * **home/tools/agents-md:** surface compositional continuous verification and nix-flake-pr-cycle in development guidelines ([05f0399](https://github.com/cameronraysmith/vanixiets/commit/05f039927769adf39854952231cde455cf2b95f7))1554    * **home/tools/commands:** add hermes-backup tool for archival tar.zst snapshots ([76b9b8b](https://github.com/cameronraysmith/vanixiets/commit/76b9b8ba049bb0ae6baa8562f0aae30c689ec773))1555    * **home/tools/commands:** add hermes-restore for converting tar.zst back to hermes-import zip ([88042b2](https://github.com/cameronraysmith/vanixiets/commit/88042b247ce8ff29db663e7ba4f0e977742eec15))1556    * **home/tools/git:** add commit-checks script for github+gitea ([2e87043](https://github.com/cameronraysmith/vanixiets/commit/2e870432b50c417959877f67de3b46815312fedc))1557    * **home/tools/git:** wrap commit-checks as home-manager package ([689d85e](https://github.com/cameronraysmith/vanixiets/commit/689d85e4b74d694c79ee971517174753be9a2858))1558    * **home/tools/hooks/verify-diamond-before-edit:** accept in-chain and splice-stack @ positions; refine SKILL.md doctrine ([01dbf7a](https://github.com/cameronraysmith/vanixiets/commit/01dbf7acfccfd7459e31e7d91916298547a9eab4))1559    * **home/tools/hooks/verify-diamond-before-edit:** unify case D to mutable diamond interior for jj edit at any internal commit ([c2cd88c](https://github.com/cameronraysmith/vanixiets/commit/c2cd88ca1b44e29f137d12aaf48424cdf8acdc1a))1560    * **home/tools/hooks:** jj worktree-create/remove + git-worktree gate hooks ([47e0325](https://github.com/cameronraysmith/vanixiets/commit/47e0325ece27e35ecf5e7e1cef2c2e4fc8f4a4be))1561    * **home/tools:** add buzz CLI wrapper injecting the sops nostr key ([e510ab5](https://github.com/cameronraysmith/vanixiets/commit/e510ab5779da293c51365380f44e7b3cec3965ec))1562    * **home/tools:** add rclone-saturate cross-cloud copy command ([d503c4f](https://github.com/cameronraysmith/vanixiets/commit/d503c4f85a594d8a9ec4c5b631db11958d2a2b2c))1563    * **home/ubuntu:** import core and herdr; disable the systemd ssh-agent ([f640e26](https://github.com/cameronraysmith/vanixiets/commit/f640e26a97b0d403afea18442b47b9d35e577e58))1564    * **home:** add managedConfigs for files applications also write ([3c35e10](https://github.com/cameronraysmith/vanixiets/commit/3c35e10d68bb9b1c3c9e095ea7154791ec79718e))1565    * **home:** add ubuntu profile for the Devin sandbox ([b575fb0](https://github.com/cameronraysmith/vanixiets/commit/b575fb00dbdb87a2c3472cb2ea3a9839f9f98e55))1566    * **homebrew:** add buzz ([5f767ff](https://github.com/cameronraysmith/vanixiets/commit/5f767ff3429b5e52129627f2758f6492d274bf67))1567    * **homebrew:** add chatgpt, factory, and rescuetime ([b39942c](https://github.com/cameronraysmith/vanixiets/commit/b39942ce1a1f5103bbe26a3707bdabbfa0183faf))1568    * **homebrew:** add flighty ([06c4a84](https://github.com/cameronraysmith/vanixiets/commit/06c4a844871a7d06fb7df21715f52cc83bd5635b))1569    * **homebrew:** add handy ([1af7be9](https://github.com/cameronraysmith/vanixiets/commit/1af7be9aaaa174bc7f9b52711f7c379575bbeb0c))1570    * **homebrew:** add pomatez ([f495734](https://github.com/cameronraysmith/vanixiets/commit/f495734711fb95c412f35f475dc5835a033f3f36))1571    * **homebrew:** add spotify ([211adca](https://github.com/cameronraysmith/vanixiets/commit/211adca02050b9df87e6c471e568526aded34e55))1572    * **home:** declare Devin CLI configuration and Outposts workers ([e1b7936](https://github.com/cameronraysmith/vanixiets/commit/e1b79368f983a735aabd62b2429ada46e493a1fd))1573    * **home:** declare herdr onboarding, updates, and session recovery ([bbdeeb2](https://github.com/cameronraysmith/vanixiets/commit/bbdeeb2f40534bc8fd6d0d38bf504049349454ba))1574    * **home:** gate homeConfigurations emission on a per-user systems list ([0570a42](https://github.com/cameronraysmith/vanixiets/commit/0570a42bfc69e411db38e9bdf1ede9fee9508b4c))1575    * **home:** install sops secrets without a systemd user manager ([6ffc7bb](https://github.com/cameronraysmith/vanixiets/commit/6ffc7bb7283e3e4a7836606980db7ecdf45386e4)), closes [#2938](https://github.com/cameronraysmith/vanixiets/issues/2938)1576    * **home:** install ubuntu sops secrets at session start from a per-shell hook ([6e70397](https://github.com/cameronraysmith/vanixiets/commit/6e703977f57c0724cc67a77d2bd4e2a37c5111f3))1577    * **home:** ultracode by default + claude-name-background launcher ([3d1e9ce](https://github.com/cameronraysmith/vanixiets/commit/3d1e9ce3b0ff7fb3ec93d2f7fc2e6c2ac6ac508b))1578    * **hooks/gate-dangerous-commands:** permit canonical gh pr create -d, NOTICE via ntfy ([d602b2c](https://github.com/cameronraysmith/vanixiets/commit/d602b2cace14217d5680413894df85814ade4dea))1579    * **hooks/gate-dangerous-commands:** permit non-default push, NOTICE via ntfy ([2a2e598](https://github.com/cameronraysmith/vanixiets/commit/2a2e59827a80d1875d975311040b6523ada8d866))1580    * **hooks/gate-dangerous-commands:** permit ssh/scp/rsync to .zt hosts, NOTICE via ntfy ([d8e2532](https://github.com/cameronraysmith/vanixiets/commit/d8e253286359d67e66522c6e962928130da8a35b))1581    * **hooks:** add gate-worktree-surfaces enforcement script ([c476173](https://github.com/cameronraysmith/vanixiets/commit/c47617326abd8fc4ddb2f574f7346ad89e88cf85))1582    * **hooks:** add verify-diamond-before-edit tier-aware integrity check ([b70fd2d](https://github.com/cameronraysmith/vanixiets/commit/b70fd2dda66aec26577d8bd541ce2f8881170329))1583    * **hooks:** lift the nix run/shell and git push confirmation gates ([5aadf36](https://github.com/cameronraysmith/vanixiets/commit/5aadf3695ded35807cdb9caf4410a0bdf5a5170f))1584    * **hooks:** resolve the target repository and downgrade the worktree gates to ask ([3882b97](https://github.com/cameronraysmith/vanixiets/commit/3882b97cdff2791bfbc68f6c496b62df0fc522e5))1585    * **jj-join-chains:** list development-join chain bookmarks by tip timestamp ([78ae064](https://github.com/cameronraysmith/vanixiets/commit/78ae064c6232c8e61bab7ec83bdbf35c3d30ae37))1586    * **jj-linearize-join:** add --keep-remaining flag for subset Phase 4 ([9cfeb56](https://github.com/cameronraysmith/vanixiets/commit/9cfeb56cf7680774ce31af152c086b3dfa19125a))1587    * **jj-linearize-join:** reconstruct development join when --keep-remaining is set ([7216fa6](https://github.com/cameronraysmith/vanixiets/commit/7216fa66c777a00c9e1158ce842fb71f2b233cc1))1588    * **jj:** add diamond revset ([cb0c340](https://github.com/cameronraysmith/vanixiets/commit/cb0c340a3afb76cb852e9df0ff72d71a6f3b3578))1589    * **jj:** mark queued pull requests and add a dequeue key ([ab8caaf](https://github.com/cameronraysmith/vanixiets/commit/ab8caafaf0ab506b2b4ac5c900b14495633233d5))1590    * **jj:** mint gerrit change-id trailers from the jj change id ([4734755](https://github.com/cameronraysmith/vanixiets/commit/4734755c882488fef1b4a4e1b62a6f3d3f8001a4))1591    * **jj:** show pull request numbers next to bookmarks ([f44fcc1](https://github.com/cameronraysmith/vanixiets/commit/f44fcc151456c20988c5ceb068276ebeffaa8ce9))1592    * **just:** choose the remote host for check-fast ([3544c4c](https://github.com/cameronraysmith/vanixiets/commit/3544c4c46454265c62ff09b7a91d3591b9b15224))1593    * **justfile:** summarise renovate dry runs and guard bun updates against renovate holds ([0df9de3](https://github.com/cameronraysmith/vanixiets/commit/0df9de332e2b3896483c5eabaf1a592b4da81f18))1594    * **just:** let nix-flake-io target a chosen system ([321d6c8](https://github.com/cameronraysmith/vanixiets/commit/321d6c84e314e45802ec69c25ea2850d07c80b14))1595    * **just:** route check-fast by target system ([4fc789a](https://github.com/cameronraysmith/vanixiets/commit/4fc789aa46382bc2f26860edbb156a08e00b4cbc))1596    * **k3d:** run cilium with kube-proxy replacement on k3s v1.33.13 ([5066198](https://github.com/cameronraysmith/vanixiets/commit/5066198295ad8c3c843ffe3592bdca4dbf597b8a))1597    * **kanidm:** bump server to 1.11 and restore the default backup schedule ([fa0ca9c](https://github.com/cameronraysmith/vanixiets/commit/fa0ca9ca7c148fd953dc9685c98cc2029fe4ff33))1598    * **linear:** register the requirements-engineering project ([84bb7cb](https://github.com/cameronraysmith/vanixiets/commit/84bb7cb9eece6b2059d113562140a8d838a0f746))1599    * **machines/darwin/stibnite:** inject nix daemon prerequisites for nspawn nixos tests into rosetta-builder guest ([3788a57](https://github.com/cameronraysmith/vanixiets/commit/3788a573ca137adf02f383e28d411600172ab096))1600    * **machines/darwin/stibnite:** mkForce-replace nix.buildMachines entry to advertise uid-range for rosetta-builder dispatch ([dd16686](https://github.com/cameronraysmith/vanixiets/commit/dd16686c8988aa7e21223e92a7bb2c03b3cfa013))1601    * **machines/nixos/magnetite:** enable nix daemon prerequisites for nspawn nixos tests ([c0a82ff](https://github.com/cameronraysmith/vanixiets/commit/c0a82ff70b209970e617af7410966718ff06c92c))1602    * **magnetite-builder:** add shared remote-builder module and enable on stibnite ([fccff9f](https://github.com/cameronraysmith/vanixiets/commit/fccff9f1439c074e8cba4dce45f8e79b3c9620f8))1603    * **magnetite,pyrite:** enable the evaluation lock and memory guards ([36996d2](https://github.com/cameronraysmith/vanixiets/commit/36996d28f1b4f6dafe8e21752f06e4c4a54804ad))1604    * **magnetite/kanidm:** declarative site-branding via systemd oneshot (display=" ", logo=flake.brand.logo) ([26d308b](https://github.com/cameronraysmith/vanixiets/commit/26d308b2a2754c8cfcad38f97550d41a81644bc1))1605    * **magnetite/kanidm:** grant cameron synapse OIDC access via matrix_users membership ([93fc360](https://github.com/cameronraysmith/vanixiets/commit/93fc360b33ab88cb53d06e580fa5a854be3535a2))1606    * **magnetite/kanidm:** harden admin passwords to 7 words + restartUnits for rotation propagation ([b39a87d](https://github.com/cameronraysmith/vanixiets/commit/b39a87d12228fe26ad91ee8ca2a3ea1993029cb4))1607    * **magnetite/kanidm:** improve synapse RS /ui/apps tile (Element direct-login + logo) ([c815fa0](https://github.com/cameronraysmith/vanixiets/commit/c815fa004bef89c90e62a21b84c2001d6753c612))1608    * **magnetite/kanidm:** point /ui/apps tile to Cinny with hs pre-populated + client-agnostic matrix logo ([ab01db6](https://github.com/cameronraysmith/vanixiets/commit/ab01db616994dda0697d99f2975f7cbd358b7c31))1609    * **magnetite/matrix:** add matrix.scientistexperience.net CNAME to terranix ([e9bd237](https://github.com/cameronraysmith/vanixiets/commit/e9bd2371bdb3d3d78735613464c686cd51cfe3e2))1610    * **magnetite/matrix:** close synapse password rail (password_config.enabled=false) and remove matrix-password-cameron + register-users wiring ([1c6c7ff](https://github.com/cameronraysmith/vanixiets/commit/1c6c7ffb34b5d1f8795efd3e437787b64bd05001))1611    * **magnetite/matrix:** pre-deploy hardening + extended CI probes (nix-dk1) ([de0f381](https://github.com/cameronraysmith/vanixiets/commit/de0f3818851af060aeb8d6d2bea9c7041e646812)), closes [hi#entropy](https://github.com/hi/issues/entropy)1612    * **magnetite/matrix:** public Synapse + Element Call/LiveKit/coturn stack (mag-2..mag-13) ([4b0699f](https://github.com/cameronraysmith/vanixiets/commit/4b0699fa3bad97fe8c4f93eb06a4c5bbd0ecf696))1613    * **magnetite/matrix:** wire synapse OIDC client with kanidm IdP (LoadCredential + allow_existing_users) ([4e2abde](https://github.com/cameronraysmith/vanixiets/commit/4e2abde5bd968a48c6c97c4934506f70e3dd12d8))1614    * **magnetite:** add kanidm IdP module scaffold with nginx-fronted TLS ([867ef8b](https://github.com/cameronraysmith/vanixiets/commit/867ef8bbacd163759ec8fb50c2bed72725c07958))1615    * **magnetite:** apply omnigraph policy bundles ([836ebb6](https://github.com/cameronraysmith/vanixiets/commit/836ebb6298d83b1fc33f7e45efff19142133de56))1616    * **magnetite:** authorize stibnite nix-remote-build key on builder user ([8c8328d](https://github.com/cameronraysmith/vanixiets/commit/8c8328dbce558ff573ece3c7b4640e15c53230fd))1617    * **magnetite:** clan-vars generators for kanidm admin and synapse oauth2 secrets ([5b0dc95](https://github.com/cameronraysmith/vanixiets/commit/5b0dc95c37a27988b747b8a1f6cf85b807ec6f70)), closes [#7](https://github.com/cameronraysmith/vanixiets/issues/7)1618    * **magnetite:** deploy omnigraph server ([a2f7b86](https://github.com/cameronraysmith/vanixiets/commit/a2f7b8676769fd6d5e5c6963a2ed53280f6b0ce5))1619    * **magnetite:** disable self-hosted cognee server + SSO gateway (reversible; config retained) ([3783645](https://github.com/cameronraysmith/vanixiets/commit/378364579043559cea184ac937d31e553ad6cd21))1620    * **magnetite:** disable ZFS auto-snapshot on root/nix dataset ([d5b7bf1](https://github.com/cameronraysmith/vanixiets/commit/d5b7bf117967c151cf5609524f974325cb293206))1621    * **magnetite:** extend zfs auto-snapshot opt-out to docker and podman ([7051ee9](https://github.com/cameronraysmith/vanixiets/commit/7051ee95a06c6c375b2383698144f3055eab1738))1622    * **magnetite:** import effects-ironstar-secrets flake module ([0741380](https://github.com/cameronraysmith/vanixiets/commit/07413806b5b9fffb857dfbf0fd84c4ca98315b2d))1623    * **magnetite:** import kanidm IdP module on magnetite ([7983c22](https://github.com/cameronraysmith/vanixiets/commit/7983c22080fb080fa467c24ece78857f31abff10))1624    * **magnetite:** import matrix module into flakeModules (mag-14) ([e2c9dde](https://github.com/cameronraysmith/vanixiets/commit/e2c9dde71b573e651e42c04230c103197e12e7bc))1625    * **magnetite:** import sso-gateway, enable gateway + register cognee consumer ([f07466b](https://github.com/cameronraysmith/vanixiets/commit/f07466bcf0bca64aec66f15518e4f535f28ac674))1626    * **magnetite:** raise nix min-free/max-free thresholds for build host ([a0d5f64](https://github.com/cameronraysmith/vanixiets/commit/a0d5f64509bc5bc57d841b4e6f3cea8fedaf85d3))1627    * **magnetite:** size zram to 150% of RAM and raise swappiness to 100 ([ea70970](https://github.com/cameronraysmith/vanixiets/commit/ea70970e0bbf06c19c3e0d5b42ca29404cb81b29))1628    * **magnetite:** tune ZFS autoSnapshot retention for cloud VPS ([b19f746](https://github.com/cameronraysmith/vanixiets/commit/b19f746a239327a2ed8e54cc08b3a114bcf8a7eb))1629    * **mergify:** require nixbot's checks instead of buildbot's ([9745589](https://github.com/cameronraysmith/vanixiets/commit/97455891bae09df103cbc7299db8ba8a678e64b0))1630    * **meta-search-sessions:** search claude, codex, and pi sessions ([0cbb7ff](https://github.com/cameronraysmith/vanixiets/commit/0cbb7ff72bf636164ef377e9a6a64e133e960bb3))1631    * **modules/system:** add beads-client module gating BEADS_DOLT_SERVER_MODE wrap ([fc0945c](https://github.com/cameronraysmith/vanixiets/commit/fc0945c9023d9b38c3cde3d8fe023cc3d8a46607))1632    * **moshi:** disable usage collection declaratively ([0d703f6](https://github.com/cameronraysmith/vanixiets/commit/0d703f6d52b5ac34179a9c766e54740034a9ea8a))1633    * **nix.gc:** switch from weekly to daily cadence ([b1b779f](https://github.com/cameronraysmith/vanixiets/commit/b1b779fe8fe6933083775b3208d7b14c73cba924))1634    * **nixbot:** add nixbot aspect and compose it onto magnetite ([9919def](https://github.com/cameronraysmith/vanixiets/commit/9919defcd74bd1ce15ea819589f8f8573b6824e8))1635    * **nixbot:** add nixbot flake input ([bc9fe4c](https://github.com/cameronraysmith/vanixiets/commit/bc9fe4ca782d6a589776ea7a8b0a6a3fca2638c2))1636    * **nixbot:** admit sciexp/ironstar without effects secrets ([1a8951f](https://github.com/cameronraysmith/vanixiets/commit/1a8951f366098172eecce06799caa6771949620f))1637    * **nixbot:** admit vanixiets and push its builds to the binary cache ([de3b201](https://github.com/cameronraysmith/vanixiets/commit/de3b201913899ce83827a5fe64ebffe0c24f5557))1638    * **nixbot:** declare nixbot DNS record ([5afc3cd](https://github.com/cameronraysmith/vanixiets/commit/5afc3cd11a5e60db255f4a7bf765e1cb9bf39b90))1639    * **nixbot:** dispatch effects on pull requests as buildbot-nix does ([1c260eb](https://github.com/cameronraysmith/vanixiets/commit/1c260eb860d579e37348fb6c7d5d57a220e725c8))1640    * **nixbot:** enable the GitHub integration on the dedicated application ([6117bde](https://github.com/cameronraysmith/vanixiets/commit/6117bdeb188855c6f6540960f80cec211a6959cb))1641    * **nixbot:** read ironstar effects secrets from the existing generator ([59e438d](https://github.com/cameronraysmith/vanixiets/commit/59e438d85100ba6e1386f69af45d253206d2782a))1642    * **nixbot:** read vanixiets effects secrets from the existing generator ([e36b8ba](https://github.com/cameronraysmith/vanixiets/commit/e36b8ba5e2c326e33c534795c9df19c05721e525))1643    * **nixbot:** scope effect dispatch to default-branch pushes ([cb1fcb2](https://github.com/cameronraysmith/vanixiets/commit/cb1fcb2c918c8bc80f3b6f0f168c5627cd3ba36c))1644    * **nixos:** add memory-pressure guards and an omnigent slice cap ([6bac132](https://github.com/cameronraysmith/vanixiets/commit/6bac13233ce848d21e9d0ac6c764f1e8b5d11608))1645    * **nixos:** add reusable sso-gateway module — bespoke oauth2-proxy-kanidm unit + per-service registration + auto-derived kanidm client ([54217b1](https://github.com/cameronraysmith/vanixiets/commit/54217b1f23844f20e8be5e00454390b44cab117e))1646    * **nixos:** add the dnscrypt-proxy module for NixOS hosts ([7e8d9a5](https://github.com/cameronraysmith/vanixiets/commit/7e8d9a565c7e05904c17ff9116e955a3b13bf501))1647    * **nixpkgs:** patch nixos-facter for the MacBookPro14,1 SPI touchpad ([6fe80a6](https://github.com/cameronraysmith/vanixiets/commit/6fe80a67415ebf3b1dc80dd9ef928f9dc6049a64)), closes [#672](https://github.com/cameronraysmith/vanixiets/issues/672) [#339](https://github.com/cameronraysmith/vanixiets/issues/339)1648    * **nix:** register pyrite as the fleet's kvm remote builder ([fabd01a](https://github.com/cameronraysmith/vanixiets/commit/fabd01ae87076826e07536b30d5f7691f8c53611))1649    * **nix:** serialize nix-eval-jobs behind a host-wide evaluation lock ([b5e2b75](https://github.com/cameronraysmith/vanixiets/commit/b5e2b75d9ee0ed37f4e953685f6fb913deb04cd7))1650    * **omnigent:** acp-runtime-environment ([f8e6555](https://github.com/cameronraysmith/vanixiets/commit/f8e655544f417d688e4af56a687934dfa4f845c1))1651    * **omnigent:** add dedicated Darwin worker adapter ([6ef13c7](https://github.com/cameronraysmith/vanixiets/commit/6ef13c72e50cb6422efc4a5c98a06388d1c16810))1652    * **omnigent:** add dedicated-worker login helper ([5437b73](https://github.com/cameronraysmith/vanixiets/commit/5437b73356ebafd2f2a19f34523f8c7a48f276f7))1653    * **omnigent:** assign Janette the experimental Linux workers ([7592628](https://github.com/cameronraysmith/vanixiets/commit/7592628601edad9404e3131f2846c396fc97214e))1654    * **omnigent:** darwin-host ([b635aee](https://github.com/cameronraysmith/vanixiets/commit/b635aee887869661eee032a0f2a0b1a4c0157841))1655    * **omnigent:** declarative-config ([c121743](https://github.com/cameronraysmith/vanixiets/commit/c12174317d15240c568b4b274a480a4f2b9986bd))1656    * **omnigent:** declare worker credential sources and expected identities ([e97c897](https://github.com/cameronraysmith/vanixiets/commit/e97c897f5cec92d43342d382d90d93a115d88479))1657    * **omnigent:** deliver worker credentials through Clan vars ([c487904](https://github.com/cameronraysmith/vanixiets/commit/c48790428bfa294bb260d1c8d7bb6cf68e79b4b4))1658    * **omnigent:** enable dedicated laptop workers ([024b633](https://github.com/cameronraysmith/vanixiets/commit/024b633927890055fdd8c7759194fb4b02d1570d))1659    * **omnigent:** host-clan ([dd8cd63](https://github.com/cameronraysmith/vanixiets/commit/dd8cd63655ab1929aafaab84e3c7a14594959439))1660    * **omnigent:** manage private Darwin worker Keychain ([d8aacca](https://github.com/cameronraysmith/vanixiets/commit/d8aaccae17c32370b880dfa8d46f9231cb33b397))1661    * **omnigent:** mask worker Linear workspaces behind labels ([1c8006d](https://github.com/cameronraysmith/vanixiets/commit/1c8006d1bb178d4942f8d214bab30f7c500ad774))1662    * **omnigent:** migrate magnetite to personal workers ([a284643](https://github.com/cameronraysmith/vanixiets/commit/a2846434497623a10454170adc708a8c174ba08d))1663    * **omnigent:** omp-acp-and-tile ([d4157a9](https://github.com/cameronraysmith/vanixiets/commit/d4157a97b75d5121806a87b9ae98d3cd5f729ca7))1664    * **omnigent:** package ([9663d2c](https://github.com/cameronraysmith/vanixiets/commit/9663d2cb28399b48c07620eb6b1efe44b2ba079e))1665    * **omnigent:** prepare dedicated worker accounts ([d20ae85](https://github.com/cameronraysmith/vanixiets/commit/d20ae85993bdf24b1685b8df3569879b12f81ff5))1666    * **omnigent:** pyrite-host ([4114eea](https://github.com/cameronraysmith/vanixiets/commit/4114eea1328634fed48d466852fc7eb62ddce3ea))1667    * **omnigent:** runtime-environment ([7f64880](https://github.com/cameronraysmith/vanixiets/commit/7f6488001d65e67e2d2c0e1ec43baf01f5a4770d)), closes [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989) [#21654](https://github.com/cameronraysmith/vanixiets/issues/21654) [#22667](https://github.com/cameronraysmith/vanixiets/issues/22667) [#25990](https://github.com/cameronraysmith/vanixiets/issues/25990) [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989)1668    * **omnigent:** runtime-tooling ([7170924](https://github.com/cameronraysmith/vanixiets/commit/7170924d1c9c7d6b519d910d26444ae606bbf1f2))1669    * **omnigent:** select worker engineering capabilities ([72cd472](https://github.com/cameronraysmith/vanixiets/commit/72cd4728e861418f91613e64972655e4c104fe93))1670    * **omnigent:** select worker GitHub tokens by resource owner ([61e3b19](https://github.com/cameronraysmith/vanixiets/commit/61e3b198c3b80cba14a5ec29b6f0c10677834308))1671    * **omnigent:** server ([093f46a](https://github.com/cameronraysmith/vanixiets/commit/093f46a8b7a6a0662db173ba62fa607b77713263))1672    * **omnigent:** share worker credentials per person across hosts ([f292242](https://github.com/cameronraysmith/vanixiets/commit/f292242f60233d554e5324eb32ec22c7802f3956))1673    * **omnigent:** supervise dedicated Linux workers ([a12b3c6](https://github.com/cameronraysmith/vanixiets/commit/a12b3c6c503eb215b85a3bfa1685ad5d03a62e8c))1674    * **omnigent:** upgrade-0-13-0 ([a7c0bd9](https://github.com/cameronraysmith/vanixiets/commit/a7c0bd99d50a31602987af3d39d5b21d8bc8c83f))1675    * **omnigraph:** add cli to crs58 home packages ([b54c839](https://github.com/cameronraysmith/vanixiets/commit/b54c839b2a12b384608b51fd16f9df98719848af))1676    * **omnigraph:** add dev graph policy bundle ([8dce2e1](https://github.com/cameronraysmith/vanixiets/commit/8dce2e11dbfef76a8c50bc580d1b1a12a0af2842))1677    * **omnigraph:** add home-manager client module ([25b7492](https://github.com/cameronraysmith/vanixiets/commit/25b749279c95d7fabe76cbaf4c89ad23c426b39f))1678    * **omnigraph:** add nixos module ([c8d465b](https://github.com/cameronraysmith/vanixiets/commit/c8d465b30fb6fc02fd1625c35b3082f0d7474d65))1679    * **omnigraph:** add server policy bundle ([8d986ae](https://github.com/cameronraysmith/vanixiets/commit/8d986aed0072b03ac2bbd4003fdd8db28da6e058))1680    * **omnigraph:** add update script ([984595d](https://github.com/cameronraysmith/vanixiets/commit/984595d27e968e43949af1b936c1a253348bf82e))1681    * **omnigraph:** adopt cookbook aliases for crs58 ([c4532f6](https://github.com/cameronraysmith/vanixiets/commit/c4532f6669f2556ee82ec96c54144bfa890813f2))1682    * **omnigraph:** deliver the upstream omnigraph skill with the client ([d21bddd](https://github.com/cameronraysmith/vanixiets/commit/d21bddd0f7472fe9616b60bd090656d3024fe2a2))1683    * **omnigraph:** package server and cli from pinned main ([1b87b63](https://github.com/cameronraysmith/vanixiets/commit/1b87b635c96b73e0bd78a34c485fdfdd6ed461cd))1684    * **omnigraph:** wire update-omnigraph app ([fe9494e](https://github.com/cameronraysmith/vanixiets/commit/fe9494e74104f1be1bcc64b2477caec2d72ee926))1685    * **omp:** declare the user-level config and advisor roster ([841123e](https://github.com/cameronraysmith/vanixiets/commit/841123e2f9efbb1b7d205db253127b6b8cc74c56))1686    * **omp:** install the oh-my-pi coding agent ([df7f6f2](https://github.com/cameronraysmith/vanixiets/commit/df7f6f23d69bfcd88eb6f041bb927b03f73da5ff))1687    * **omp:** plan with Opus 5.5 instead of Fable ([38c8d76](https://github.com/cameronraysmith/vanixiets/commit/38c8d76c3fc281a1e967343a8412c1a410b4f028))1688    * **omp:** route memory to the hosted Hindsight service ([72d4c90](https://github.com/cameronraysmith/vanixiets/commit/72d4c906f55bdc16a6fd1198c5988a7c0e8d3b06))1689    * **omp:** set direnv preflight budget for agent bash commands ([106f539](https://github.com/cameronraysmith/vanixiets/commit/106f539447ba48f4855c224198adccf719ac14fc))1690    * **openclaw:** add enable toggle and self-contain vhost/DNS/registration in the clan-service ([38558b6](https://github.com/cameronraysmith/vanixiets/commit/38558b61b8c0b16eb7b0fb51e8bee9ab132ce13f))1691    * **openspec/superpowers-bridge:** align governance bundle + version prose to 1.4.1 ([ca6b68e](https://github.com/cameronraysmith/vanixiets/commit/ca6b68e7eddf5080009debf04a10118ffac59ee1))1692    * **openspec:** add sso-gateway change — reusable shared kanidm OIDC SSO gateway spec ([97910fe](https://github.com/cameronraysmith/vanixiets/commit/97910fecbd7776d15d7dd68382543a9d9c5d4780))1693    * **openspec:** apm-skills-marketplace change artifacts ([a97da9f](https://github.com/cameronraysmith/vanixiets/commit/a97da9fd5fb5ad0fda9c8a4ce0fad42586872b33))1694    * **openspec:** archive both changes and sync four capabilities ([170664a](https://github.com/cameronraysmith/vanixiets/commit/170664ab80cf337a60ed06cc3223c0a412c8a55c))1695    * **openspec:** deliver both schema bundles so pinned changes resolve ([e870f95](https://github.com/cameronraysmith/vanixiets/commit/e870f952fc7ab67a27a55791bc5de51c2e47394f))1696    * **openspec:** fork superpowers-bridge as a first-party wrspm schema ([1cb1084](https://github.com/cameronraysmith/vanixiets/commit/1cb1084151f0f87b009fc1774d10cb07c76e5d65))1697    * **openspec:** populate project context, rules, and archive guidance ([caea330](https://github.com/cameronraysmith/vanixiets/commit/caea3304a7f8d727e964eaa956eec8b7b7209362))1698    * **openspec:** state corpus self-containment in the schema and the requirements skill ([e77b87c](https://github.com/cameronraysmith/vanixiets/commit/e77b87c84da48fb573a90eaa3f18b75bae274086))1699    * **packages:** add git-repo-manager (grm) rust package ([b254ce2](https://github.com/cameronraysmith/vanixiets/commit/b254ce222baef4078f1ab4058359462274c7b5d2))1700    * **packages:** add pinned Playwright CLI with matching browsers ([894d1ff](https://github.com/cameronraysmith/vanixiets/commit/894d1ffa68f5a93753eb064093eda7738a76e872))1701    * **pi:** add pi coding agent home-manager module ([28098f2](https://github.com/cameronraysmith/vanixiets/commit/28098f2d2ebd19afcba80e4d34793d1eec578af9))1702    * **pi:** compose exact resources and theme ([5550aa4](https://github.com/cameronraysmith/vanixiets/commit/5550aa4b1379162c6bda2cdbbf4885168b5a52ad))1703    * **pi:** decide edit and write by recoverability rather than severity ([a54760f](https://github.com/cameronraysmith/vanixiets/commit/a54760f271b97453005d5fccf26086cc9d342ac9))1704    * **pi:** enforce agent safety policy ([bf9e6fe](https://github.com/cameronraysmith/vanixiets/commit/bf9e6fea684dadd051bb71050de80611b3629257))1705    * **pi:** fold thinking blocks by default in pi and atomic ([bd8d593](https://github.com/cameronraysmith/vanixiets/commit/bd8d593e11760d44822ad8fe2b08665565a1c869))1706    * **pi:** package selected extensions ([d67c7dd](https://github.com/cameronraysmith/vanixiets/commit/d67c7dd450880819f402db083f92cc9e6cddc5b9))1707    * **pi:** package the openai server-side compaction extension ([c5cd3fd](https://github.com/cameronraysmith/vanixiets/commit/c5cd3fdebceb72f1a9b5d53ff270b124dbd989e7))1708    * **pi:** register the server-side compaction extension ([ab9451b](https://github.com/cameronraysmith/vanixiets/commit/ab9451bc91129355f092f621879c3a7e12322085))1709    * **pkgs/atomic:** switch to the npm distribution from-source build ([4f9848d](https://github.com/cameronraysmith/vanixiets/commit/4f9848d6c72d0911a7a35ed359b70d244d0e3f1c)), closes [.#atomic](https://github.com/./issues/atomic)1710    * **pkgs/beads:** restore at 1.0.4 with darwin cgo and dolt PATH from llm-agents shape ([cd4c68a](https://github.com/cameronraysmith/vanixiets/commit/cd4c68a7685a9700099f4e8012b57a42433f5427))1711    * **pkgs/buzz:** add buzz-source update script tracking desktop-v tags ([e572e0a](https://github.com/cameronraysmith/vanixiets/commit/e572e0a7ca05d5936498560d359687f43da1be3c))1712    * **pkgs/buzz:** add pinned buzz-source carrying the shared cargo vendor ([579f2d8](https://github.com/cameronraysmith/vanixiets/commit/579f2d84d6040daf8501c32570260df95b20b4ab))1713    * **pkgs/buzz:** package buzz-cli ([be3a7f7](https://github.com/cameronraysmith/vanixiets/commit/be3a7f76feacbbe21f0ff7a82d5a109f25a392a1))1714    * **pkgs/buzz:** package git-credential-nostr with git wrapped onto PATH ([70d3f01](https://github.com/cameronraysmith/vanixiets/commit/70d3f01cc5d65d152c82e8c527aa11bf9bb4f0da))1715    * **pkgs/buzz:** package git-sign-nostr ([c7a20f4](https://github.com/cameronraysmith/vanixiets/commit/c7a20f4cedbbaa91b33d41daa6ffa586d5e6e2c4))1716    * **pkgs/dolt:** bump 1.85.0 -> 1.88.1 for beads 1.0.4 driver pin compatibility ([a17ceda](https://github.com/cameronraysmith/vanixiets/commit/a17ceda541d62b6d2fec2e692a91ae056486f936))1717    * **pkgs/golem-binary:** add flake-aware multi-platform update script ([de966bf](https://github.com/cameronraysmith/vanixiets/commit/de966bfddebd1d318d8279196c6d81e6386cddea))1718    * **pkgs/golem-binary:** add prebuilt full Golem CLI derivation ([9d373eb](https://github.com/cameronraysmith/vanixiets/commit/9d373eb45555e85095a6da370e6fbcc1c6ce07fc))1719    * **pkgs:** add dependency-sources by-name package + home install ([7232204](https://github.com/cameronraysmith/vanixiets/commit/7232204793a17fee1884ce011d0c755807ea2cbb))1720    * **pkgs:** add ghq-sync by-name package + home install ([9ccc956](https://github.com/cameronraysmith/vanixiets/commit/9ccc9568a4b51a0597ac0bdcf073e830e179446e))1721    * **pkgs:** add ouroboros uvx wrapper package ([0555773](https://github.com/cameronraysmith/vanixiets/commit/0555773e74b4ddff1d76b9821a033bf72c544bd4))1722    * **pkgs:** add repo-sync by-name package + home install ([41ef988](https://github.com/cameronraysmith/vanixiets/commit/41ef9881936de8255bac3273ee59e98fc73c8dbd))1723    * **pkgs:** add store-pinned agent plugin marketplace sources ([1eddda5](https://github.com/cameronraysmith/vanixiets/commit/1eddda581699fe6d0ce33b81e508388c659204a1))1724    * **pkgs:** add the hindsight CLI ([3d482ca](https://github.com/cameronraysmith/vanixiets/commit/3d482caf8b3ecfe0d513eb3cf20304f92f042fdf))1725    * **pkgs:** add the moshi-hook daemon ([8c17d01](https://github.com/cameronraysmith/vanixiets/commit/8c17d01e5b381e5d99e3dcce7a6a6d8102c6bde8))1726    * **pkgs:** add uncomment-bin prebuilt release derivation ([49f2eb8](https://github.com/cameronraysmith/vanixiets/commit/49f2eb82fd2da2bca51ab86976e1bbb26494ace0))1727    * **pkgs:** add worktrunk-bin prebuilt wrapper with update app ([3d6dffe](https://github.com/cameronraysmith/vanixiets/commit/3d6dffe69a1980655ab25d8c23fd5a87b5d10053))1728    * **pkgs:** package linear-cli — prebuilt on Darwin, deno-run from source on Linux + update app ([e17d844](https://github.com/cameronraysmith/vanixiets/commit/e17d844781c170c998d3b2fe5fb09830c89021ea))1729    * **pkgs:** package linear-cli (Linear.app CLI) and add to dev packages ([4edfa59](https://github.com/cameronraysmith/vanixiets/commit/4edfa59e034674c8b781538919cb187071fb481e))1730    * **pkgs:** package mergify CLI as mergify-cli-bin and wire it home ([6b2d411](https://github.com/cameronraysmith/vanixiets/commit/6b2d411311f3e03016457d300322fe86db41f41d)), closes [.#mergify-cli-bin](https://github.com/./issues/mergify-cli-bin)1731    * **pkgs:** package the atomic coding agent from its release tarball ([98adbdf](https://github.com/cameronraysmith/vanixiets/commit/98adbdffd116569a641a83614dcd3f9fb197ff13)), closes [.#atomic](https://github.com/./issues/atomic)1732    * **pkgs:** package the firstmate toolchain and put it on the agent user's PATH ([1c1cd6c](https://github.com/cameronraysmith/vanixiets/commit/1c1cd6c1d13b2c9adeb523186656e8b9fdcac0c1)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi)1733    * **pkgs:** re-enable local duckdb and python-duckdb with machine-shadowing toggle ([7d85560](https://github.com/cameronraysmith/vanixiets/commit/7d855604f51e23479aeee3b52ccd8f6ec7953222))1734    * **pkgs:** vendor devin-cli 3000.6.2 with a repo-root updater ([43c5d9f](https://github.com/cameronraysmith/vanixiets/commit/43c5d9fd0ab4412ebb7a052f5585145d39e94cdb))1735    * **planning-and-development:** add pocock skills as locked apm dependency ([0d25b15](https://github.com/cameronraysmith/vanixiets/commit/0d25b15a08c05f8033e39b7a61096e5036c663fa))1736    * **playwright:** pin playwright-web-flake to a fork tag at 1.63.0 ([5491998](https://github.com/cameronraysmith/vanixiets/commit/54919980e6152f35faec6a788e3a73c148925ee1)), closes [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097) [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097)1737    * **plugins:** distribute the gh-stack skill as a transitive apm dep ([fd46b90](https://github.com/cameronraysmith/vanixiets/commit/fd46b90feadd308c19c7c6409cb38c3f728698b3)), closes [#stack](https://github.com/cameronraysmith/vanixiets/issues/stack) [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack)1738    * **plugins:** distribute unslop skill as transitive apm dep ([1271dda](https://github.com/cameronraysmith/vanixiets/commit/1271dda993c8089ecc5dfad530378d2b8ec4c1ff))1739    * **plugins:** distribute worktrunk skills as transitive apm dep ([3c22a6f](https://github.com/cameronraysmith/vanixiets/commit/3c22a6ffeafac0500b53a845c6fbaf9f8094cc0e))1740    * **plugins:** source hickey and lowy from srid/agency ([c0ceba1](https://github.com/cameronraysmith/vanixiets/commit/c0ceba12579f29072b69dce8c4ac3d1aa59d70f2))1741    * **publish-evidence:** publish each distinct report once and comment only on pull requests that change it ([6d2300f](https://github.com/cameronraysmith/vanixiets/commit/6d2300f40a3dbfc3df98a95c4310d05803c676fb))1742    * **pyrite:** add DankMaterialShell to niri ([c71e816](https://github.com/cameronraysmith/vanixiets/commit/c71e8161d00358c5e3dbc658b9c6501187ffaaab))1743    * **pyrite:** add nixos-hardware flake input (nixpkgs.follows) ([0d661b8](https://github.com/cameronraysmith/vanixiets/commit/0d661b86272b72ab71d2c41d232b7187dd16950d))1744    * **pyrite:** add the encrypted-ZFS disko layout ([28edecd](https://github.com/cameronraysmith/vanixiets/commit/28edecdcce5419f37d04e175746d3459aa4ebf74))1745    * **pyrite:** add the pyrite age anchor and bridge recipient to .sops.yaml ([c117107](https://github.com/cameronraysmith/vanixiets/commit/c11710706f2a2dda619251c1584f420942a26666))1746    * **pyrite:** add the pyrite host module (Apple MacBookPro14,1) ([7649907](https://github.com/cameronraysmith/vanixiets/commit/7649907b01470166602e89ebccbd2c5a20e0175c))1747    * **pyrite:** associate with the fleet SSID via the clan wifi service ([1335125](https://github.com/cameronraysmith/vanixiets/commit/133512502e898065d8b5c9c3e5c0ccdd4fc7663a))1748    * **pyrite:** defer FIDO2 enrollment to first boot ([dba79c6](https://github.com/cameronraysmith/vanixiets/commit/dba79c6bb7f70c586bb62808f685a9ba20ff0aeb))1749    * **pyrite:** enable declarative DankBar auto-hide ([69540f0](https://github.com/cameronraysmith/vanixiets/commit/69540f05b3c400dd2bf550ecc8726693b9d903e2))1750    * **pyrite:** enable the GNOME desktop under GDM ([f204463](https://github.com/cameronraysmith/vanixiets/commit/f2044639e81c18990f20c96976e7e43594ee9c76))1751    * **pyrite:** install pinned Zen Browser for cameron ([91c0aba](https://github.com/cameronraysmith/vanixiets/commit/91c0aba6f02770ca9b9f466435c81d01fd81d95f))1752    * **pyrite:** LUKS2-on-mapper disko restructure (Piece 2, eval-only; deploy ONLY via 7.12 reinstall) ([0c14a02](https://github.com/cameronraysmith/vanixiets/commit/0c14a02dce58b51e6c651a94ec8e2d375dbb5b99))1753    * **pyrite:** never auto-suspend on idle ([208ed13](https://github.com/cameronraysmith/vanixiets/commit/208ed134465768e37eb390fa4e90b635072ceeee))1754    * **pyrite:** offer niri as a second selectable session ([2a17a7d](https://github.com/cameronraysmith/vanixiets/commit/2a17a7dc1b5b62ee53356192cd8602385f66caea))1755    * **pyrite:** provision clan vars — sops machine key, openssh/initrd/emergency/tor host keys + cert, zerotier identity+ip, zfs passphrase, wifi fleet creds, cameron user-password recipient ([33b86d0](https://github.com/cameronraysmith/vanixiets/commit/33b86d0c89fa3f9c4fecb05de30912986f819280))1756    * **pyrite:** put encrypted-root admin tools in the system closure ([21f0999](https://github.com/cameronraysmith/vanixiets/commit/21f09992ecf40559e978199afd8f19e063408213))1757    * **pyrite:** register the machine across clan inventory, users, and structure checks ([da284a6](https://github.com/cameronraysmith/vanixiets/commit/da284a6fc4e4763aac19bf57027cf7f3ff122119))1758    * **pyrite:** register the pyrite.zt address record on cinnabar ([88a3d35](https://github.com/cameronraysmith/vanixiets/commit/88a3d35de987914dab3a5786b601fa7b31754745))1759    * **pyrite:** replace GDM with native DankGreeter ([03c9f5f](https://github.com/cameronraysmith/vanixiets/commit/03c9f5fc24ae346b747bb3aa40171f86f2e79e0d))1760    * **pyrite:** resolve .zt names through cinnabar's zone server ([48e1705](https://github.com/cameronraysmith/vanixiets/commit/48e17051bcde02708b54ba3d88c2df4cf8bdef10))1761    * **pyrite:** resolve all DNS through the local dnscrypt-proxy ([e3375ab](https://github.com/cameronraysmith/vanixiets/commit/e3375abbd13b73c96acf01694127810f62f31a8d))1762    * **pyrite:** set MaxAuthTries to 20, matching the rest of the fleet ([02f2bc4](https://github.com/cameronraysmith/vanixiets/commit/02f2bc4b98580a1ec666e7502aeb67e6bd1eba53))1763    * **pyrite:** set stateVersion to 26.05 matching the installer ISO release ([84e2241](https://github.com/cameronraysmith/vanixiets/commit/84e2241d71f900b4be765bb9dd67552c6992d03a))1764    * **pyrite:** set the GNOME idle lock and suspend timeouts ([215cba0](https://github.com/cameronraysmith/vanixiets/commit/215cba0c77d8d3cf394f71a54eefc5b378aaa9ba))1765    * **quarto-bin:** vendor upstream quarto-cli 1.9.37 binary + nix run .#update-quarto updater ([79c8f16](https://github.com/cameronraysmith/vanixiets/commit/79c8f16c23e0ff69bbbcf846a1ec15b94e65dad3)), closes [.#update-quarto](https://github.com/./issues/update-quarto)1766    * **radicle:** run radicle-node as a user service on darwin and linux ([6ff3fa2](https://github.com/cameronraysmith/vanixiets/commit/6ff3fa2f128ae7e32d4ae021884667c74ab6464a))1767    * **release:** forecast each pull request's release as a check run ([976a4d0](https://github.com/cameronraysmith/vanixiets/commit/976a4d0438fbba67cc5afbdebe4810c0de4d6816))1768    * **secrets:** add hindsight creds ([98b5dd9](https://github.com/cameronraysmith/vanixiets/commit/98b5dd9035fe899c757f7250a602dd1310ae7dc2))1769    * **secrets:** add linear ([29c9719](https://github.com/cameronraysmith/vanixiets/commit/29c9719448b52aad363503298b74e6b2da27307c))1770    * **secrets:** wire the moshi-hook pairing token for crs58 ([cfa04a0](https://github.com/cameronraysmith/vanixiets/commit/cfa04a030afd955345af2bad94437e2e5994904e))1771    * **skill/meta-session-resume:** collapse multi-step procedure into one self-contained command ([83a4532](https://github.com/cameronraysmith/vanixiets/commit/83a4532ca9c7db366d65bf4f2b4167f3c32f0918))1772    * **skills/agentic-planning-development-workflow:** state-machine router skill ([e70d88f](https://github.com/cameronraysmith/vanixiets/commit/e70d88f8d901a1a7b67a0cf06a19c826c9ef8fb0))1773    * **skills/agentic-planning:** bind roborev gate to inline codex review (advisory, triage-surface, calibrated effort) ([13bc402](https://github.com/cameronraysmith/vanixiets/commit/13bc4027df1fd96ecfd3ac638a673c335b5a89b8))1774    * **skills/agentic-planning:** scope board execution-mode mechanisms to HIL ([8080b18](https://github.com/cameronraysmith/vanixiets/commit/8080b18fcc1cabbef7640864c0a411a5a059f80b))1775    * **skills/jj-{workflow,summary}:** avoid interactive editors with multi-boundary split, JJ_EDITOR escape hatch, SIGTERM recovery ([572841c](https://github.com/cameronraysmith/vanixiets/commit/572841c8f42183a55d0358526835911d41f7567a))1776    * **skills/jj-summary:** restructure decision tree with three-tier escalation, demote workspace to explicit-request escape hatch ([e7c3037](https://github.com/cameronraysmith/vanixiets/commit/e7c30378a8a925f7a5f9ab8095e872aa8828f1c4))1777    * **skills/jj-version-control/diamond-workflow:** formalize as canonical operational reference with bidirectional cross-references ([be5be41](https://github.com/cameronraysmith/vanixiets/commit/be5be41c29e4d1126cbba4dc89b00d5516ed59bb))1778    * **skills/jj-version-control:** consolidate development-join entity definition into canonical subsection with route-step recovery recipe ([f864e34](https://github.com/cameronraysmith/vanixiets/commit/f864e340dd9cf5a3215c1075f7ffe1d2a02652b7))1779    * **skills/jj-version-control:** establish tiered ceremony model for jj-mode work ([002a126](https://github.com/cameronraysmith/vanixiets/commit/002a126b42882353821cc45bcb57ebaaf5cba42a))1780    * **skills/jj-workflow:** reframe workspace section as explicit-user-request-only, demote isolation enumeration to informative context ([4b8ec78](https://github.com/cameronraysmith/vanixiets/commit/4b8ec7814afc9ca559ea62b8a0f428ba69c06edc))1781    * **skills/nix-flake-pr-cycle:** add validate-to-merge workflow skill with traceability-audit framing ([245b81c](https://github.com/cameronraysmith/vanixiets/commit/245b81c373c19190d6a015e4c8028aa664490a99))1782    * **skills/openspec-linear-sync:** generalize openspec/linear.yaml into a monorepo registry; move D10 ledger to per-change frontmatter ([b9fe0aa](https://github.com/cameronraysmith/vanixiets/commit/b9fe0aa6984c841c6f34613feb908736af5c6ff3))1783    * **skills/openspec-linear-sync:** linear-cli Linear/OpenSpec sync overlay skill ([5565be6](https://github.com/cameronraysmith/vanixiets/commit/5565be6776c2f7abf1cc6f5835cdd4f906998726))1784    * **skills/openspec-linear-sync:** make linear_project optional; gate archive spec-mirror on project presence (skip+log when absent) ([5b74365](https://github.com/cameronraysmith/vanixiets/commit/5b74365fb12ab1094878aee098bc8416d7f4b03a))1785    * **skills/openspec-linear-sync:** make setup/selection registry-aware and resolve document UPSERT per project ([815b449](https://github.com/cameronraysmith/vanixiets/commit/815b449de9ea6fa18b8ea1216faac448c3d78ece))1786    * **skills/openspec-linear-sync:** relocate D10 sync ledger to per-change proposal frontmatter with team-scoped state resolution ([f87a839](https://github.com/cameronraysmith/vanixiets/commit/f87a839376524d364325195ab23e634f14a835be))1787    * **skills/openspec-linear-sync:** resolve archive-mirror canonical spec path via 1.4.1 status --json (jq, repo-mode guarded) ([d16774b](https://github.com/cameronraysmith/vanixiets/commit/d16774b572ab6ae3a6c863e0b9cd9bce5ae18fc5))1788    * **skills/openspec-linear-sync:** seed and re-sync the Linear issue description from proposal.md business content ([a98d74a](https://github.com/cameronraysmith/vanixiets/commit/a98d74a48f2b886b6231846b3f0dd9d8672dbced))1789    * **skills/preferences-compositional-continuous-verification:** add theoretical anchor for compositional continuous verification ([e6696cb](https://github.com/cameronraysmith/vanixiets/commit/e6696cba848ae89ea495e1124ae1112f43ff386b))1790    * **skills/preferences-nix-checks-architecture:** add CCV meta-checks section and per-artifact observability expectation ([f21a34f](https://github.com/cameronraysmith/vanixiets/commit/f21a34fc28a0b18bc52ecc4c55112c11cf45ca71))1791    * **skills/preferences-nix-ci-cd-integration:** disambiguate compositional continuous verification from existing continuous-validation references ([1308096](https://github.com/cameronraysmith/vanixiets/commit/130809692efb5f05087f3a5cf1d08c2edb24858a))1792    * **skills/preferences-observability-engineering:** frame observability checks as first-class CCV regulators ([bdff03e](https://github.com/cameronraysmith/vanixiets/commit/bdff03ec6d07844cdfc45fb9d8855d81724a6b04))1793    * **skills/preferences-production-readiness:** disambiguate narrow continuous validation from compositional continuous verification ([674ac81](https://github.com/cameronraysmith/vanixiets/commit/674ac8123f497ea16ae17ad6a1b0d3a6d8e42d84))1794    * **skills/preferences-validation-assurance:** cross-ref CCV as systems operationalization of severity, refinement, and confidence promotion ([d2a9432](https://github.com/cameronraysmith/vanixiets/commit/d2a94329c666d2cf6064bb1d6031314ff4bb91f1))1795    * **skills/project-management:** human-facing PM hub skill ([7986cc4](https://github.com/cameronraysmith/vanixiets/commit/7986cc470659af8889c8ce3052aed32e10d5b21f))1796    * **skills/theoretical-foundations:** add type-checked Lean and Python worked example ([7faabbc](https://github.com/cameronraysmith/vanixiets/commit/7faabbc4ee65fc7266c21137278ab02d09c34544))1797    * **skills:** add aiSkills.extraSkillDirs store-path hook to skills injector ([7ac8bb4](https://github.com/cameronraysmith/vanixiets/commit/7ac8bb4f0564c241c7c6d43b48a944482f18fc4c))1798    * **skills:** add atdd-outer-loop skill ([b7081e9](https://github.com/cameronraysmith/vanixiets/commit/b7081e9f26070a6f4c29c807a99da249669e1182))1799    * **skills:** add bdd-gherkin-formulation skill ([078deaf](https://github.com/cameronraysmith/vanixiets/commit/078deaf1396ab8c3be3ed783676bf0d02c9118c5))1800    * **skills:** add bdd-step-definitions skill ([6aa8488](https://github.com/cameronraysmith/vanixiets/commit/6aa8488af5f50924b8f1241c604eaf76a00983fa))1801    * **skills:** add dependency-source-acquisition skill for ghq-based source review ([58e716e](https://github.com/cameronraysmith/vanixiets/commit/58e716ead2334409dcd08762b00a618cbca3bf23))1802    * **skills:** add meta-orchestrator-checkpoint handoff-payload-schema sub-file ([f38245e](https://github.com/cameronraysmith/vanixiets/commit/f38245e42b3f5cdfa0b6742efdb14debb2f7119b))1803    * **skills:** add meta-orchestrator-checkpoint routing-layer SKILL.md ([d52ca5d](https://github.com/cameronraysmith/vanixiets/commit/d52ca5d8c0484bd480392637c108363deb3746bd))1804    * **skills:** add meta-orchestrator-initiate discipline-and-cycle-patterns sub-file ([1b69e0c](https://github.com/cameronraysmith/vanixiets/commit/1b69e0cce523fbf1ff851d8fa6d0ab4b6a9ed37d))1805    * **skills:** add meta-orchestrator-initiate exemplar-session sub-file ([71a6bc8](https://github.com/cameronraysmith/vanixiets/commit/71a6bc87a1b2aab82fea609c1ed087d5e9558d9b))1806    * **skills:** add meta-orchestrator-initiate operational-patterns sub-file ([e9ddd81](https://github.com/cameronraysmith/vanixiets/commit/e9ddd817cf88c29872af513d3226086cdfd9219e))1807    * **skills:** add meta-orchestrator-initiate routing-layer SKILL.md ([8837eda](https://github.com/cameronraysmith/vanixiets/commit/8837edafee791b57737495b40022e4964db83e1e))1808    * **skills:** add meta-orchestrator-initiate spawn-prompt-template sub-file ([4c2a763](https://github.com/cameronraysmith/vanixiets/commit/4c2a763ecdb0559089d26b4dfa9549e8b8755fa3))1809    * **skills:** add meta-orchestrator-initiate tier-and-gate sub-file ([be10082](https://github.com/cameronraysmith/vanixiets/commit/be10082f20e2eae4dd9257c704ec1a6b18b97576))1810    * **skills:** add nucleus-platform thin-router skill ([37a9699](https://github.com/cameronraysmith/vanixiets/commit/37a9699ab6228d2fbaf129ac55f49e17fafa7146))1811    * **skills:** add preferences-comment-cleanup uncomment workflow skill ([2b0dd02](https://github.com/cameronraysmith/vanixiets/commit/2b0dd02bf5298d922e2a2df7a6b02ce8b1be6df3))1812    * **skills:** add preferences-workflow-orchestration-algebra core skill ([c19349c](https://github.com/cameronraysmith/vanixiets/commit/c19349c642f42d2220117099addc380b1566dd14))1813    * **skills:** add prose-clarity, essential-complexity, ci-log-verification skills and jj hazards reference ([ced2c4d](https://github.com/cameronraysmith/vanixiets/commit/ced2c4d3d52ca23f5156decbeccea02bb9007187))1814    * **skills:** add the README hierarchy as a documentation tier ([3665eb0](https://github.com/cameronraysmith/vanixiets/commit/3665eb0b56679848b50282a921684d44a0dbf805))1815    * **skills:** add the satisfaction argument audit ([bcd5655](https://github.com/cameronraysmith/vanixiets/commit/bcd565546b687bc0a83308f91b4f5998cf20fffc))1816    * **skills:** add the stratum dimension to the acceptance layer ([8fe17e7](https://github.com/cameronraysmith/vanixiets/commit/8fe17e7aaa841a207b057823d4fcc7cca1c281f2))1817    * **skills:** add the WRSPM requirements engineering hub ([fabb6c3](https://github.com/cameronraysmith/vanixiets/commit/fabb6c335fda15effaac5f6cb596d4c9bcc66f33))1818    * **skills:** additively integrate executable-specification-testing into the HIL TDD apply path ([e6b4394](https://github.com/cameronraysmith/vanixiets/commit/e6b439478f8a00d8f9bfa382a650e431e20044b6))1819    * **skills:** allow jj-workflow auto-invocation by removing disable-model-invocation flag ([278e19e](https://github.com/cameronraysmith/vanixiets/commit/278e19ed9d458e06e6fd9f4e9f71d6421d602f91))1820    * **skills:** bump superpowers to v6.3.0 and mattpocock to v1.2.3 ([2cec15a](https://github.com/cameronraysmith/vanixiets/commit/2cec15aa4a630f20acc7c7639764fbbf0c14c7e1))1821    * **skills:** bump worktrunk to v0.76.0 ([8ed34f4](https://github.com/cameronraysmith/vanixiets/commit/8ed34f4aff7ab101f6a83952bf01d3cf8146b02b))1822    * **skills:** cohere data-modeling siblings with the LinkML lowering-path bifurcation ([30e7759](https://github.com/cameronraysmith/vanixiets/commit/30e77598eaa07e4fb8c41be695f1e262c8f81d4c))1823    * **skills:** compress diamond-workflow paraphrases across jj-workflow, jj-summary, 03-jj-mode to pointer summaries with canonical link ([e29017b](https://github.com/cameronraysmith/vanixiets/commit/e29017b84802d5a28b09269b6ff225e141a6a3ba))1824    * **skills:** cross-ref CCV from scientific-inquiry-methodology, session-orient, session-review ([9016bd4](https://github.com/cameronraysmith/vanixiets/commit/9016bd45791d798af992c8ce3864e67eae7cc656))1825    * **skills:** deliver ~/.agents/skills as real files for codex (codex skips symlinked SKILL.md leaves) ([b0cb66f](https://github.com/cameronraysmith/vanixiets/commit/b0cb66fcf8ec14fb9fe7001bff59fe48e9d23871))1826    * **skills:** ground discovery and glossary in designation discipline ([aaf5064](https://github.com/cameronraysmith/vanixiets/commit/aaf50643b2fe24be0cea68a22f02f73277228dfd))1827    * **skills:** harden @-stays-[wip] diamond invariant across version-control skills ([85c7fb0](https://github.com/cameronraysmith/vanixiets/commit/85c7fb0a8dff4a472299bbcfdbc69f00229e8116))1828    * **skills:** own contract and institution theory in foundations ([b479a18](https://github.com/cameronraysmith/vanixiets/commit/b479a18e8265483cb43daff8c31f458735d80ac3))1829    * **skills:** propagate the linear-cli skill through planning-and-development ([62ad543](https://github.com/cameronraysmith/vanixiets/commit/62ad543627ab0b4d9b2725ab7352e21695e3d4c2))1830    * **skills:** record Linear assignee and label conventions at creation ([3463998](https://github.com/cameronraysmith/vanixiets/commit/34639980d660fa96aa52da966994b3124fc818a1))1831    * **skills:** record the WRSPM shear and the openspec corpus relationship ([f035f0b](https://github.com/cameronraysmith/vanixiets/commit/f035f0ba9eb104f42f718e9f35dc839f335414e4))1832    * **skills:** refine workflow-orchestration-algebra from dogfooding ([9a10484](https://github.com/cameronraysmith/vanixiets/commit/9a104842d0c03fb958a40a4bf2bfce37051949b0))1833    * **skills:** route the satisfaction argument through the verification triad ([6a0eb0e](https://github.com/cameronraysmith/vanixiets/commit/6a0eb0ec35f39162f1f67018501d14fa9f49dd12))1834    * **skills:** scaffold testing-and-quality apm group ([c59fd78](https://github.com/cameronraysmith/vanixiets/commit/c59fd781cf391fa7f6140944fe94059fe0e09ebe))1835    * **stack-land:** add hermetic landing mechanism ([33f94e2](https://github.com/cameronraysmith/vanixiets/commit/33f94e2ce211948a8ccabbd6e712ef812aa48765))1836    * **stack-land:** demote the landing tool to assertion-only diagnostics ([138f311](https://github.com/cameronraysmith/vanixiets/commit/138f311dae305a9a2b516514dd40e9d2f803a6a5))1837    * **system:** add the stibnite build-access module and wire both machines ([4d39c00](https://github.com/cameronraysmith/vanixiets/commit/4d39c00b1878bfa0c71ce2d6516da52c80eefb35))1838    * **system:** declare mosh across nixos and darwin machines ([a1639fd](https://github.com/cameronraysmith/vanixiets/commit/a1639fdf2b5a4e3b6260831b5c4a3b9d5b8477b9))1839    * **terranix:** add kb + auth Cloudflare DNS records (CNAME -> magnetite) ([7fbcb42](https://github.com/cameronraysmith/vanixiets/commit/7fbcb42d60bc2a43a5deb044aa36478dc5122d22))1840    * **terranix:** adopt the sciexp R2 bucket and own its lifecycle rules ([53b1e96](https://github.com/cameronraysmith/vanixiets/commit/53b1e96702b0d2afe521fded4839c5982053c620))1841    * **terranix:** pre-emptively add accounts.scientistexperience.net CNAME for kanidm ([1845430](https://github.com/cameronraysmith/vanixiets/commit/1845430a0a69d1bc93b6d683e9707a59a48f83d6))1842    * **test-and-quality:** add bdd skills ([75ec0af](https://github.com/cameronraysmith/vanixiets/commit/75ec0af959df163180fc1e245d34ed35f98a2fb5))1843    * **testing-and-quality:** add executable-specification-testing skill and wire atdd/algebraic-laws routing ([b63d136](https://github.com/cameronraysmith/vanixiets/commit/b63d136be7819e2e4d04f6c163aa8f4b48422fcd))1844    * **tm-restore:** register restored directory destinations with zoxide ([3420734](https://github.com/cameronraysmith/vanixiets/commit/3420734b76cf95f56491a6750976c2b7fd2d632e))1845    * **tmux:** scrub HM session-vars guards on activation ([acb2282](https://github.com/cameronraysmith/vanixiets/commit/acb228243e8c5b14e52b0e77c0bd81b83370da52))1846    * **tools/git:** add jj-linearize-join script and nix wrapper ([c46bd4e](https://github.com/cameronraysmith/vanixiets/commit/c46bd4ec9c0c1e4dcc73be8bd38da5f4544f16e9))1847    * **tools/git:** add jj-stack-submit script and nix wrapper ([327b198](https://github.com/cameronraysmith/vanixiets/commit/327b198df7cf6003d1a7baaf27e1ac844c4b3c1f))1848    * **tools:** add nixbot-logs CLI for nixbot build log retrieval ([d07a0f8](https://github.com/cameronraysmith/vanixiets/commit/d07a0f8bde7d5bcf57d692bdbf92aad313dcfc04))1849    * **tools:** replace gh-approve-open-prs with gh-queue-open-prs ([653ae31](https://github.com/cameronraysmith/vanixiets/commit/653ae31be4627626d079e506e167ffde1a167001)), closes [#approve-open-prs](https://github.com/cameronraysmith/vanixiets/issues/approve-open-prs) [#queue-open-prs](https://github.com/cameronraysmith/vanixiets/issues/queue-open-prs)1850    * **tuicr:** deliver the upstream skill bundle with the pinned package ([004dfea](https://github.com/cameronraysmith/vanixiets/commit/004dfea93725b4b01496e895d459a80e6b8ca214))1851    * **uncomment:** init config ([f3482c6](https://github.com/cameronraysmith/vanixiets/commit/f3482c69fea57b301a7aea1468eb5a6d7ab47b0d))1852    * **wezterm:** add Shift+Enter soft-newline keybind ([f79c5c9](https://github.com/cameronraysmith/vanixiets/commit/f79c5c93500d1db62637e2e969f051f4bcd94c78))1853    * **workflows:** add dedicated Omnigent worker lifecycle ([cce8918](https://github.com/cameronraysmith/vanixiets/commit/cce89188d18afe0ae0634a8b824f1ecf969e8992))1854    * **workflows:** add Janette identity and credential phases ([c59d94f](https://github.com/cameronraysmith/vanixiets/commit/c59d94fd263beaee9850390ce5db10ed7a57bb6f))1855    * **workflows:** add stand-up-gitea-mq durable execution workflow ([3f0f6d3](https://github.com/cameronraysmith/vanixiets/commit/3f0f6d3b041f44df62af2142587ae01d7ef9d92a))1856    * **workflows:** add the atomic derivation bump workflow ([31f8656](https://github.com/cameronraysmith/vanixiets/commit/31f86568dab026e45c847b4473ebb4a427e7c4b9)), closes [.#atomic](https://github.com/./issues/atomic)1857    * **workflows:** apply terraform from an integrated source and adopt routed slices ([edda078](https://github.com/cameronraysmith/vanixiets/commit/edda0780388e50ace4fea73c694d25185799b38f))1858    * **workflows:** defer app installation and adopt an already-routed S1 ([15f2280](https://github.com/cameronraysmith/vanixiets/commit/15f22804edf5b9fa45d7b657a5712889a55b790a))1859    * **workflows:** generalize derivation bump workflow ([00fbc80](https://github.com/cameronraysmith/vanixiets/commit/00fbc8095fed2ca18b1018f262680cc2031f42c5))1860    * **workflows:** let stand-up-gitea-mq adopt an S1 implementation already in the working copy ([79193d4](https://github.com/cameronraysmith/vanixiets/commit/79193d4233531bed649cc805e2498e1948e661c7))18611862### Performance Improvements18631864    * **checks:** assert omnigent capability rejections with one composite home ([6b723a1](https://github.com/cameronraysmith/vanixiets/commit/6b723a17427265662b802f7f591f41a8c5f7ffff))1865    * **checks:** assert omnigent fleet obligations on the machine checks ([501ec37](https://github.com/cameronraysmith/vanixiets/commit/501ec37517a80ce7d06a2b8577aadf312c74620f))1866    * **cognee:** switch chat model to gpt-5-nano to cut LLM completion cost ([fe80d31](https://github.com/cameronraysmith/vanixiets/commit/fe80d315b714649c8fc2fb457ffcef2b8f1da320))1867    * **devshells:** only compose agent context when AGENTS.md is absent ([a728ccc](https://github.com/cameronraysmith/vanixiets/commit/a728ccc43b0c2b9f80640fec5ab7d2260d369256))1868    * **docs:** consume vanixiets-docs-deps and narrow its workspace cache entry ([01c1b57](https://github.com/cameronraysmith/vanixiets/commit/01c1b57c56eda1a8cfc5fe6a34eea193dd677a05))1869    * **magnetite:** raise nix daemon cache-fetch concurrency ([023c5a5](https://github.com/cameronraysmith/vanixiets/commit/023c5a5253d05388d6c504037a7af780ccaf6112))1870    * **nixbot:** raise eval workers to 6 to shorten the serial eval chain ([45b05a5](https://github.com/cameronraysmith/vanixiets/commit/45b05a549393765caa68ac86a14809dcd41e0958))1871    * **nixbot:** run 8 eval workers at 4096 MiB under a 12 GiB MemoryHigh ([e2b51e9](https://github.com/cameronraysmith/vanixiets/commit/e2b51e9d121524d30580e599d0ef168d6620f4b2))1872    * **pyrite:** declare nix job concurrency against its actual hardware ([e047814](https://github.com/cameronraysmith/vanixiets/commit/e04781434e81fd9c10030d202320c0fd71940b4b))18731874### Reverts18751876    * Revert "chore(caches): disable cachix" ([94a1489](https://github.com/cameronraysmith/vanixiets/commit/94a14892446ee366694c6ef42a13caf92eb33829))18771878### BREAKING CHANGES18791880    * pkgs.dbt-fusion no longer provides dbt-lsp; use1881      `dbtf lsp`. Nothing in this repository referenced dbt-lsp.18821883Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a696418841885RELEASE-PLAN: evidence-worker 0.6.3 -> 1.0.0