nixbot

1RELEASE-PLAN-CLONE-START: https://github.com/cameronraysmith/vanixiets.git #3304 bab7fb26239c2dbd926b8ce6564bd56874f23f9f2RELEASE-PACKAGES-ACTION: plan (#3304 at bab7fb26239c2dbd926b8ce6564bd56874f23f9f onto main at f41e741270e9a382a9b1de33bbe278568f17e00f)3packages discovered: [{"name":"docs","path":"packages/docs"},{"name":"evidence-worker","path":"packages/evidence-worker"}]4RELEASE-PACKAGE-ITERATION: packages/docs5running semantic-release in packages/docs...6[6:12:43 AM] [[secure]] › ℹ  Running [secure] version 25.0.97[6:12:44 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/changelog"8[6:12:44 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/github"9[6:12:44 AM] [[secure]] › ✔  Loaded plugin "prepare" from "@[secure]/changelog"10[6:12:44 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/github"11[6:12:44 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/github"12[6:12:44 AM] [[secure]] › ✔  Loaded plugin "success" from "@[secure]/github"13[6:12:44 AM] [[secure]] › ✔  Loaded plugin "success" from "[secure]-major-tag"14[6:12:44 AM] [[secure]] › ⚠  Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode15[6:12:44 AM] [[secure]] › ✔  Allowed to push to the Git repository16[6:12:44 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/changelog"17[6:12:44 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/changelog"18[6:12:44 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/github"19[6:12:44 AM] [[secure]] [@[secure]/github] › ℹ  Verify GitHub authentication20[6:12:45 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/github"21[6:12:45 AM] [[secure]] › ℹ  Found git tag @vanixiets/docs-v0.13.0 associated with version 0.13.0 on branch main22[6:12:45 AM] [[secure]] › ℹ  Found 11 commits since last release23[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"24[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"25[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Found 4 commits for package @vanixiets/docs since last release26[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: Revert "test(docs): remove the browser evidence page to exercise the superseded comment"2728Change-Id: I95b94e7a02fb13cd36e205c33ebfe8fe6a6a696429[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release30[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: test(docs): remove the browser evidence page to exercise the superseded comment3132Change-Id: I3401de646db409b97f5c82489f3cd0226a6a696433[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release34[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: docs(concepts): explain browser evidence comments, storage and receipts3536Change-Id: Ia7ec55a1cab44d83f4e66553426fa0d96a6a696437[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release38[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions3940Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a696441[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  The commit should not trigger a release42[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Analysis of 4 commits complete: no release43[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"44[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"45[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"46[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/release-notes-generator" does not provide step "analyzeCommits"47[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"48[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"49[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/changelog" does not provide step "analyzeCommits"50[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"51[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"52[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "@[secure]/github" does not provide step "analyzeCommits"53[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"54[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"55[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  Plugin "[secure]-major-tag" does not provide step "analyzeCommits"56[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"57[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"58[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins59[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"60[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"61[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins62[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"63[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"64[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins65[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"66[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"67[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins68[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"69[6:12:45 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"70[6:12:45 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ  No more plugins71[6:12:45 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"72[6:12:45 AM] [[secure]] › ℹ  There are no relevant changes, so no new version is released.73RELEASE-PLAN: docs 0.13.0 -> no release74RELEASE-PACKAGE-ITERATION: packages/evidence-worker75running semantic-release in packages/evidence-worker...76[6:12:46 AM] [[secure]] › ℹ  Running [secure] version 25.0.977[6:12:46 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/npm"78[6:12:46 AM] [[secure]] › ✔  Loaded plugin "verifyConditions" from "@[secure]/github"79[6:12:46 AM] [[secure]] › ✔  Loaded plugin "analyzeCommits" from "@[secure]/commit-analyzer"80[6:12:46 AM] [[secure]] › ✔  Loaded plugin "generateNotes" from "@[secure]/release-notes-generator"81[6:12:46 AM] [[secure]] › ✔  Loaded plugin "prepare" from "@[secure]/npm"82[6:12:46 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/npm"83[6:12:46 AM] [[secure]] › ✔  Loaded plugin "publish" from "@[secure]/github"84[6:12:46 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/npm"85[6:12:46 AM] [[secure]] › ✔  Loaded plugin "addChannel" from "@[secure]/github"86[6:12:46 AM] [[secure]] › ✔  Loaded plugin "success" from "@[secure]/github"87[6:12:46 AM] [[secure]] › ✔  Loaded plugin "fail" from "@[secure]/github"88[6:12:46 AM] [[secure]] › ⚠  Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode89[6:12:46 AM] [[secure]] › ✔  Allowed to push to the Git repository90[6:12:46 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/npm"91[6:12:46 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/npm"92[6:12:46 AM] [[secure]] › ℹ  Start step "verifyConditions" of plugin "@[secure]/github"93[6:12:46 AM] [[secure]] [@[secure]/github] › ℹ  Verify GitHub authentication94[6:12:47 AM] [[secure]] › ✔  Completed step "verifyConditions" of plugin "@[secure]/github"95[6:12:47 AM] [[secure]] › ℹ  Found git tag v0.6.3 associated with version 0.6.3 on branch main96[6:12:47 AM] [[secure]] › ℹ  Found 2278 commits since last release97[6:12:47 AM] [[secure]] › ℹ  Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"98[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Simulated merge of pull request #3304 into main for the release plan99[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release100[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Revert "test(docs): remove the browser evidence page to exercise the superseded comment"101102Change-Id: I95b94e7a02fb13cd36e205c33ebfe8fe6a6a6964103[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release104[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: test(docs): remove the browser evidence page to exercise the superseded comment105106Change-Id: I3401de646db409b97f5c82489f3cd0226a6a6964107[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release108[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(nixbot): record that evidence comments need Pull requests write109110Change-Id: Ib3eda5a15c5cd95f1043bea6cd0c4d286a6a6964111[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release112[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(concepts): explain browser evidence comments, storage and receipts113114Change-Id: Ia7ec55a1cab44d83f4e66553426fa0d96a6a6964115[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release116[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions117118Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a6964119[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release120[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): publish browser evidence on build_finished and main pushes121122Change-Id: Iefc0a86c16780cfc0e3510a99d9844416a6a6964123[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor124[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(publish-evidence): publish each distinct report once and comment only on pull requests that change it125126Change-Id: I10c6813e147769c60a45d62b4153d7de6a6a6964127[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor128[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(evidence-worker): serve browser evidence read-only from R2129130Change-Id: I74a6a4974b4dd6c81fb45a27267e87786a6a6964131[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor132[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(terranix): adopt the sciexp R2 bucket and own its lifecycle rules133134Change-Id: I72ccef728d044fca6ac751d3412629636a6a6964135[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor136[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): provision R2 evidence credentials for the effects runner137138Change-Id: If5d2b9f244dece12246fe7962d4224086a6a6964139[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor140[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 1f817ce55e449026c169c51d0db567d1c335fb93 into gitea-mq/batch/57141[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release142[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(clan): replace per-machine builder modules with a nix-builders service143144Change-Id: I190a8bbe177d27389703a5f887d3e86e6a6a6964145[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor146[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(jj): mark queued pull requests and add a dequeue key147148PR tags now show whether a PR is queued to land: an open PR with auto-merge149enabled, or carrying the merge-queue label (a stack's top), renders #N⇡150next to its bookmark. Merged (✓) and closed (✗) still take precedence, and151the reused-branch rule is unchanged. jj-pr-sync fetches the two extra fields152in the same request.153154`jj-pr dequeue`, bound to G d in jjui, withdraws the GitHub signal that155authorized landing: auto-merge is disabled, or the merge-queue label is156removed. gitea-mq treats both as a dequeue, including from an in-flight157batch. An unqueued PR is a no-op; a merged PR reports when it merged, since158a landed batch cannot be undone. Each change refreshes the tags at once.159160jj-pr-tags-rehearsal gains rows for the queued marker on a single PR and a161labelled stack top, and for every dequeue outcome, judged by the gh162mutations made.163164Change-Id: Ic011d2e749a8b10228253cf10ff018376a6a6964165[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor166[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix167168Change-Id: Ie1ca1c075cb5cc70fe50173fcc480d096a6a6964169[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release170[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep runner-control deadlines above browser setup under load171172Playwright's test deadline also covers context and page setup. Under builder173load setup exceeded the 5 s deadline, so controls failed as test-level174deadlines (infrastructure) before their own failure ran (nixbot builds 1000,1751001). Each control's failure stays bounded by its own mechanism.176177Change-Id: Ic05f5683ec74a702033b0c40688995e56a6a6964178[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch179[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge bec748fc0a820563329385f1a04e0096b94da7be into gitea-mq/batch/55180[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release181[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(jj): show pull request numbers next to bookmarks182183jj has no forge integration, so which bookmark is which PR was invisible in184`jj log` and jjui, and enqueueing meant leaving the graph for gh-dash.185186- `jj-pr-sync`, run once in a repository, registers it and caches187  `gh pr list` as a jj config file in conf.d scoped to that repository188  (`--when.repositories`). A branch name reused across PRs maps to its open189  PR, else its newest; merged and closed PRs are marked ✓ and ✗.190- A user service (launchd agent on darwin, systemd timer on Linux) runs191  `jj-pr-sync --all` every five minutes at background priority. A refresh192  that cannot reach GitHub keeps the previous mapping; a repository that no193  longer exists is unregistered; a lock prevents overlapping runs.194- An override of `format_commit_labels(commit)` keeps jj's builtin labels and195  appends each bookmark's PR number, in `jj log` and jjui alike.196- jjui, on a revision's bookmark: `G o` opens its PR; `G m` enqueues a single197  PR (auto-merge, rebase) and `G M` labels the topmost PR of a stack198  merge-queue, mirroring gh-dash's m/M. `jj-pr` applies the landing199  protocol: it refuses drafts, auto-merge on stack members, and labels on200  anything but a stack's top, and is a no-op when already enqueued. Each201  action refreshes the tags immediately.202203jj-pr-tags-rehearsal runs against a stubbed gh in scratch jj repositories:204registration and rendering (reused, merged, slash-named and PR-less205bookmarks; no leakage into another repository), --all refresh, offline206retention and unregistration, every enqueue decision judged by the gh207mutations made, no G-prefix collision with the packaged jjui's default208bindings, and drift of jj's builtin format_commit_labels.209210Change-Id: I7468279a834fb1fea2876295a64c921a6a6a6964211[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor212[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(secrets): rotate the Cloudflare effects token213214The docs preview and production effects, and the local docs recipes, used215a user API token that expires on 2026-10-24. They now use an account API216token (vanixiets-effects, expiring 2027-10-02) limited to Workers: Editor217on the account and Workers Routes: Write on the cameronraysmith.net zone,218which serves the docs custom domain. Updated in secrets/shared.yaml and in219magnetite's vanixiets-effects-secrets var; the account ID and GitHub token220are unchanged, only re-encrypted.221222Change-Id: I24963c05cb0bfc454231e0280b6709476a6a6964223[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release224[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: claude-code: 2.1.286 -> 2.1.288225226Change-Id: Iacd4ed321e4898358b12d43f02590c366a6a6964227[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release228[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix229230Change-Id: I09dee06e0e5db47e519e3bc3354891416a6a6964231[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release232[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix233[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release234[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update dependency @types/node to ^26.6.4235[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release236[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep WebKit failure screenshots in Darwin build reports237238On aarch64-darwin, Nix build users have no LaunchServices database, so WebKit's image encoder returns an empty data URL and Playwright writes a 0-byte failure screenshot without raising an error. The report validator rightly rejects empty attachments, so a WebKit product failure on Darwin kept no report. A shared test fixture now replaces a 0-byte WebKit screenshot with the latest screencast frame, or fails the attempt as infrastructure if none exists. e2e-webkit-negative-control proves that a WebKit failure keeps a real PNG.239240Change-Id: I01c2ad58cb950529278fb87dda109414ead21c09241[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch242[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): give each browser report build its own preview ports243244Darwin Nix builds are unsandboxed and share the host network, so report derivations built at once all served on localhost:4321 and raced for the workerd inspector port from 9229; one build's server broke another's tests. The report build now picks a free loopback port and passes it to Playwright as DOCS_PREVIEW_PORT, and sets DOCS_DISABLE_WORKER_INSPECTOR so astro preview opens no inspector. Local runs keep 4321 and the inspector.245246Change-Id: Ia0c3192bbfed2940fbd062e68105432e6a6a6964247[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch248[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep the homepage hero within narrow viewports249250The homepage hero uses raw <img width="400"> markup inside Starlight's .hero-html wrapper, which Starlight sizes but does not constrain. On phones the image overflowed and widened the layout viewport past the device, cutting off the logo and header search. The mobile scenario now requires no horizontal overflow and a hero image inside the viewport; it failed on all three engines before the CSS fix and passes after it.251252Change-Id: Id64a1dfa32e0a68946327dba89fc8362f7f62473253[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch254[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(docs): publish validated browser evidence from finished builds255256publish-evidence is the trusted build_finished sidecar. It finds the docs report check through nixbot's build API, validates it with its own copy of validate-report.mjs, and copies run.json, completion.json and the referenced PNG screenshots beside a deterministic receipt. Unsafe paths, symlinks, non-PNG data and identity mismatches are rejected; missing outputs are reported, never rebuilt. No effect runs it yet: storage, access and retention are undecided, so publication ends at a local --out directory. publish-evidence-rehearsal covers each case against a loopback API and a chroot store.257258Change-Id: I9adcceeed84b3fe7e7c86c572fdc8f5b5a0d7b02259[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor260[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(agents): relock root apm lock for the playwright-cli skill261262The planning-and-development plugin gained the microsoft/playwright-cli skill dependency in #3265. The root lock follows published plugin refs on main, so it could only record that dependency after the merge.263264Change-Id: I9d4bfe9b21276c10c2ef01b88c6d689389875957265[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release266[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge cb6fceccfd628dca78c94bf290a8012922987d56 into gitea-mq/batch/51267[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release268[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 81224d254ba7ee571a4299b021c7eec338b0bc48 into gitea-mq/batch/50269[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release270[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(docs): type the browser evidence tooling271272Change-Id: I356b84749e0208e8cb45b4cfa884595b6a6a6964273[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release274[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): keep browser evidence valid under CI build contention275276nixbot build 951 failed correct docs changes with navigation timeouts while three PRs built on magnetite. The builders run cores = 0, so each concurrent report build got NIX_BUILD_CORES=16 and started 16 workers against its own astro preview, and the validator rejected the run even where retries recovered, because it required every failed attempt to be a product failure.277278Report builds now run at most four workers. Navigations no longer have their own 10 s deadline, since a failed navigation is never product evidence. An infrastructure-class attempt, including a test deadline, is accepted only when a later attempt of the same test completed, and is counted as infrastructureRetries; a terminal one still invalidates the report. The negative controls inherit the suite's retries and require every attempt to fail with a product-class terminal attempt.279280Change-Id: I50a0cab69083ddca584cdea07880a5d7a03f0963281[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch282[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge d23c077f79b6e0df7e6f89cc5a15629882201f39 into gitea-mq/batch/49283[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release284[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(flake): track playwright-cli's flake upstream instead of a rev pin285286The input was pinned to a commit of halfwhey/nix-playwright-nightly, but287the CLI release is already fixed in pkgs/by-name/playwright-cli288(version 0.1.21, read from the flake's pins/cli/0.1.21.json), and289apm-skills-compose guards that version against the skill's apm.yml ref.290Upstream keeps every release pin (0.1.5 through 0.1.22, none ever291deleted), so tracking its default branch cannot change what we build;292the commit pin only routed this input through Renovate digest PRs293instead of the flake-updater bot like the other inputs.294295Relocking advances to 59e4df6 (the commit #3268 proposed); the CLI stays2960.1.21.297298Change-Id: If28f81c80c8c25ae75eb31597cc4413e6a6a6964299[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch300[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 3fa357c817941e5ec5128060962347991454ddc9 into gitea-mq/batch/48301[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release302[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 42d26efa13b47b99956ee33f3a973412c99b9bb1 into gitea-mq/batch/48303[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release304[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: openspec: update artifacts for 1.11.0 -> 1.14.0305306Regenerated with `just openspec-regen`. The vendored workflow skills were307last generated by 1.11.0 while the packaged CLI is 1.14.0. Every removed308line traces to OpenSpec v1.11.0's own templates, so no local text is309lost; the skill set is unchanged.310311Change-Id: I30a25ccf3763955308b686890f9e10786a6a6964312[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release313[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix314315Change-Id: Idfa8f8dee160ce27f5c3a900de4c4e616a6a6964316[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release317[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(darwin): stop the DNS resolver check aborting activation318319The post-activation check read the active resolver with320`scutil --dns | awk '... { print; exit }'`. awk exited after the first321match while scutil was still writing; scutil then died of SIGPIPE, and322under the activation's pipefail the `$(...)` assignment failed with 141323and set -e aborted activation (seen on stibnite once its resolver list324grew). awk now keeps reading to the end and prints only the first match.325326Change-Id: I677b7ec56ea4b1350aceeb8f3d4304156a6a6964327[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch328[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: ci: evaluate without import-from-derivation329330nixbot now evaluates with allow-import-from-derivation = false, through331NIX_CONFIG on its unit, which nixbot forwards into its evaluator sandbox;332buildbot-nix and interactive use are unaffected. `just check-ifd` runs the333same evaluation locally for all three systems without building anything.334The flake deliberately leaves the setting out of nixConfig: with335accept-flake-config it would override both the command line and nixbot's336NIX_CONFIG.337338preferences-nix-development records the rule: why IFD is avoided, the339IFD-free patterns, the enforcement, and the bar for an exception.340341Change-Id: I98fc5ca74a8db78ac2dd8bc96f97a0e66a6a6964342[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release343[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(cryolite): require import-from-derivation-free rendering344345The cryolite tree and the capi-cryolite render must evaluate on every346system with import-from-derivation disallowed: charts, CRDs and upstream347YAML enter evaluation only as committed JSON goldens or flake-input348files, and a sandboxed regulator re-renders and diffs them. Adds R17,349SP24 and AC24 to the charter, requirements and tasks to both OpenSpec350changes, tightens the platform VM regulator's chart sourcing, and351corrects the statements that still listed the retired nixidy checks.352353Change-Id: I25b495d6d47706cc95b1432f4173d9b76a6a6964354[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release355[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(checks): retire the local k8s and nixidy checks356357The k8s-manifests-local*, nixidy-*-local-k3d and k8s-cilium-compat checks358and the k8s-deploy-* apps in apps-build rendered Helm charts and YAML at359evaluation time, about 29 evaluation-time builds per system for output360identical on every system. The local cluster is a frozen prototype; the361code stays and remains buildable on demand. The cryolite programme362reintroduces cluster checks with IFD-free rendering.363364Change-Id: Ie302e3d90e4f0b754b2014694eff54866a6a6964365[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release366[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(omnigent): test the credential policy without a synthetic clan machine367368omnigent-worker-credentials evaluated a synthetic clan machine over a369committed tree of fake sops secrets, only so clan's sops backend would370resolve vars paths, and mostly asserted that options forwarded those371paths. It also needed import-from-derivation.372373- flake.lib.omnigentCredentialPolicy is the one pure boundary from clan374  vars to the worker credential policy; the Home Manager module consumes375  only the policy record, including the rendered Linear credentials.376- Value-level cases cover what the boundary decides: disabled sources are377  omitted, Linear requires the rendered template, no Linear means no378  template.379- Delivery ordering (secrets installed before workers start, readiness in380  the host unit, rendered template required instead of the raw key) is381  asserted on the real worker hosts: magnetite, pyrite and stibnite.382- Runtime behaviour (credentials.py readiness, the TS loader, gh and383  Linear mocks, disclosure audit) stays a hermetic build fed synthetic384  paths.385386The fixture tree and the forwarding assertions are deleted.387388Change-Id: Iafadccceba9fa05233c7ede63ceb61c36a6a6964389[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release390[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(catppuccin): read bottom and starship themes from flake inputs391392catppuccin's bottom and starship ports importTOML their theme from393whiskers build outputs, the only import-from-derivation in the394configurations of christophersmith, janettesmith, raquel, tara and395ubuntu. Both ports stay enabled and read the committed themes/ of the396same upstream revisions, pinned as flake = false inputs.397398Change-Id: Ia61f24b77f899c75edae5055a7f9f22b6a6a6964399[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch400[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(skills): enumerate skills from a committed index401402Skill delivery read the built apm-skills-compose output with readDir at403evaluation and wrapped every skill in builtins.path, realising that404unsubstitutable output once per skill per sink (514 realisations per AI405user, 1028 for stibnite). Every NixOS, darwin and home configuration of406the AI users therefore needed a builder for its own platform just to407evaluate.408409- pkgs/by-name/apm-skills-compose/skills.json lists the composed skill410  names; the compose build fails, printing the corrected index, when the411  two drift, and `just agents-skills-index` regenerates it.412- Skills are `"${composed}/.claude/skills/<name>"` strings with context:413  no read, no builtins.path. Home Manager passes such sources through.414- aiSkills.extraSkillDirs (directories read with readDir) is replaced by415  aiSkills.extraSkills (name to directory) for linear-cli, tuicr and416  omnigraph.417418The delivered skill set is byte-identical: 696 home.file entries per AI419user before and after.420421Change-Id: If1ae8e9f5a648670680e900fdf37ceac6a6a6964422[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release423[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(nixpkgs): expose flake packages only for supported systems424425nixpkgs re-applies the default overlay to nested package sets such as426pkgsi686Linux. withSystem on i686-linux then evaluated a whole perSystem427whose packages read per-system flake outputs that do not exist there428(playwright-cli), so nixosConfigurations.scheelite failed to evaluate429with `attribute 'i686-linux' missing`. The overlay now adds the flake's430packages only for systems in config.systems.431432Change-Id: Iab8193713bde096ba3b9543ffa3e48fa6a6a6964433[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch434[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(incidents): record the magnetite concurrent-evaluation OOMs435436Accounting for the 2026-09-27 and 2026-10-01 OOM kills: nixbot's437evaluation overlapping a remote check-fast evaluation, the swap-blind438nix-eval-jobs governor, the uncharged zram pool, and victim selection by439nix-daemon's OOMScoreAdjust; the mitigations shipped and the measurements440left for phase two.441442Change-Id: Ifa6aeee15ba01cd5f7711787f65f55626a6a6964443[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release444[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(just): choose the remote host for check-fast445446check-fast takes a fourth parameter, remote (magnetite by default, or447pyrite), and sizes evaluation for it: magnetite keeps 4 eval workers,448pyrite runs 2 with a 2 GiB per-worker cap. Remote evaluations now queue449behind nixbot's on the host lock. The skill, agent-context fragment and450docs describe the parameter and the waiting message.451452Change-Id: I367b756e6a4ec00cf61bd42ebd398b136a6a6964453[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor454[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(magnetite,pyrite): enable the evaluation lock and memory guards455456Both hosts enable the evaluation lock and MGLRU protection. pyrite also457caps zram's resident pool at 55% of RAM, the recorded livelock mode;458gives nix-daemon OOMScoreAdjust 250 and user@ -100, so builds and459evaluators are killed before niri and DankMaterialShell; and caps its two460omnigent workers at 8G combined, which previously could reach 16G on a46115.5 GiB machine. Stale headroom comments on magnetite and in buildbot.nix462are corrected. nixbot's worker count, memory limits and magnetite's zram463are unchanged. nix-eval-lock-wiring asserts nixbot and buildbot resolve464nix-eval-jobs to the wrapper on both hosts.465466Change-Id: Iba3b9e2f3975daae2e61dee23989ff416a6a6964467[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor468[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(nixos): add memory-pressure guards and an omnigent slice cap469470services.memoryPressureGuards enables MGLRU thrashing protection471(min_ttl_ms = 1000), which makes sustained thrashing end in a prompt472kill instead of a livelock. services.omnigent-host.workerSliceMemoryMax473places all omnigent workers in one omnigent.slice with a combined474MemoryMax; unset keeps the existing per-unit limits.475476Change-Id: Ib183fb9a53c9cd7c920166b1f486d1096a6a6964477[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor478[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(nix): serialize nix-eval-jobs behind a host-wide evaluation lock479480Two concurrent nix-eval-jobs evaluations on magnetite (nixbot's 8 workers481plus a remote `just check-fast`) exhausted RAM and zram twice. A wrapper482now takes an exclusive flock on /etc/nix/eval.lock before evaluating, so483evaluations on a host queue instead of overlapping; a waiter prints every48430 s which process holds the lock and since when (or that the holder is485not visible from its sandbox). The evaluator then raises its own486oom_score_adj to 900: nix-eval-jobs requeues a worker the kernel kills,487so it is the cheapest victim.488489services.nixEvalLock provides the wrapper; nixbot, buildbot-nix and the490home-manager nix-eval-jobs on PATH use it when enabled, which also covers491remote nix-fast-build sessions. nix-eval-lock-rehearsal drives the492wrapper: uncontended exec, waiting with and without a visible holder,493release on holder death, exit status propagation.494495Change-Id: I9e6643ac44790eb0ffe00294d082b5956a6a6964496[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor497[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix498[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release499[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update cloudflare-workers-tooling500[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release501[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs: describe both verdict wiring negative fixtures502503Change-Id: Ied7532ff7d45fdf5c6e2c2feb7412d246a6a6964504[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release505[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): run report verdict CLI through symlinked paths506507Change-Id: I2084d4f6f61b99a554bb7330b8ae09136a6a6964508[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch509[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(docs): retain browser regression evidence and version observations510511Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964512[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch513[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: test(nix): verify report dependencies and aggregate capabilities514515Change-Id: If6d1644ec30318b99cf7addf56e59b2a6a6a6964516[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release517[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(effects): require permission guards for credentialed build-finished events518519Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964520[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch521[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs: specify the closed-loop web verification reference design522523Change-Id: If14f8d7b146627ee546faa5eacbd97cc6a6a6964524[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release525[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(docs): preserve browser evidence behind a required verdict gate526527Change-Id: Iaf02384766e531cc30c510abd62877cf6a6a6964528[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor529[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(effects): support build-finished event registration530531Change-Id: I0489702282e4a89827bcd0b02a3caa906a6a6964532[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor533[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(ai): compose Playwright skills through shared APM capabilities534535Change-Id: Ifef0eea7fb531d088f68e89f482799a16a6a6964536[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor537[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(packages): add pinned Playwright CLI with matching browsers538539Change-Id: I1c568c44d8960ffd22c1bdb04965b3826a6a6964540[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor541[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate bun.nix542[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release543[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): regenerate flake.lock544[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release545[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(deps): update dependency @astrojs/starlight to v0.42.5546[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch547[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(deps): update dependency argoproj/argo-helm to argo-cd-10.9.6548[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release549[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(omp): plan with Opus 5.5 instead of Fable550551Opus 5.5 now runs planning as well as the session and delegated work,552so the plan comes from the model that executes it, at 40% of Fable's553price. Fable stays available when picked deliberately, and the Anthropic554server-side fallback stays on for those sessions.555556Change-Id: Ic790baf18c08c434908f94e7fb52c7446a6a6964557[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor558[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(atomic): use Opus 5.5 instead of Opus 5559560atomic stayed on claude-opus-5 because its bundled model registry561(@bastani/pi-ai) did not know claude-opus-5-5. Since atomic 0.9.24 it562does (providers/data/anthropic.json; `atomic --list-models` lists it),563so the Opus fallback, the codebase-* research agents and the Opus564thinking level move to claude-opus-5-5, matching omp and Claude Code.565The omp comment recording the exception is removed.566567Change-Id: I4722e4acb437418ce1dc6d024b61f9526a6a6964568[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor569[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(claude-code): default to Opus 5.5 instead of Fable570571The session model was Fable 5.1 with Opus 5.5 only for subagents. Opus5725.5 is now the default for both: `model = "opus"`, which resolves to573claude-opus-5-5 through ANTHROPIC_DEFAULT_OPUS_MODEL. Fable stays one574alias away (ccfable) and keeps its medium effort setting.575576fallbackModel moves from Opus, which is pointless as its own fallback,577to Sonnet 5.578579Change-Id: Ic5cd168d981e22c119a154e8d41fa1796a6a6964580[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor581[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(moshi): reconcile hooks after managedConfigs582583moshi-hook install writes into every supported agent's config, devin's584included, which turned devin's store symlink into a regular file and585made every second activation block on a .before-home-manager backup586collision. The reconcile step was ordered after a hand-kept list of four587per-agent steps that did not include devin.588589It now runs after the single managedConfigs step, which rewrites every590file moshi touches, and managed-config-wiring asserts both halves: every591config moshi writes for an enabled agent is a managed config and none is592also a home.file target, and moshi orders after managedConfigs.593594Change-Id: I086a785cc40a31183d04eb0d4778ed426a6a6964595[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch596[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: refactor(ai): manage agent config files with managedConfigs597598Eleven agent configuration files moved from five mechanisms (install599copies behind mutableSettings toggles, a shallow jq merge, two deep yq600merges, and plain store symlinks) to managedConfigs:601602- replace (no app-owned keys): claude-code and its glm and cerebras603  wrappers, codex, pi, devin, openspec, omp WATCHDOG.yml;604- with app-owned keys: atomic (onboarding and changelog versions), omp605  config.yml (setupVersion, dev.autoqaConsent), omnigent (host identity606  and server, 0600).607608The mutableSettings options, six activation steps, the three merge609scripts and flake.lib.omnigentMergeConfig are removed. devin and610openspec no longer render store symlinks; openspec declares611completionTipSeen and atomic declares enableAnalytics = false so the612first activation keeps both. crs58 declares the omp UI preferences613(tui.vimMode, tui.vimModeDisplay, composer.shape) instead of relying on614runtime state. The atomic, omnigent-worker and pi-agent-environment615checks exercise the new program and wiring.616617Change-Id: Ie3e1e56e8b65f66e1df9bf289b3522046a6a6964618[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release619[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(home): add managedConfigs for files applications also write620621A configuration file that its application rewrites at runtime cannot be622a home-manager store symlink: the first runtime write replaces the link623with a regular file, the next activation backs it up, and the one after624collides with that backup and blocks.625626managedConfigs.<name> writes such a file as a real file on every627activation: the declared settings, plus the `appOwned` key paths copied628from the existing file. Every other key is dropped and reported by name,629never by value, so state that leaked in at runtime is either declared,630listed as app-owned, or removed, and keys Nix stops declaring are631retracted. `externalPaths` keeps subtrees that a later activation step632rewrites out of the report. Writes are atomic, honour `fileMode`, and a633target that cannot be read is left untouched when app-owned keys would634have to be preserved from it.635636The module lives in modules/home/modules beside agents-md because it is637not specific to any aggregate. managed-config-rehearsal drives the638program over json, yaml and toml targets, including preservation,639retraction, the name-only report, unreadable targets, file modes and640multi-spec failure.641642Change-Id: I989f1589b7c10542e045a9c4c88308c36a6a6964643[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor644[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Update flake inputs: llm-agents.nix645646Change-Id: Id494be9893dc2095a1fe045d6b3d6e8a6a6a6964647[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release648[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(apm): relock apm.lock.yaml for the linear-cli dependency649650Records schpet/linear-cli at 196315343d2b (v2.6.0), added to651planning-and-development by #3262, with the ownership ledger for the 22652files its skill deploys, and moves the self-dependency entries to d5d75ca5.653apm 0.32.0; 173 skills deployed.654655Change-Id: I45b6531bef4542b526eb8373ffc445cd6a6a6964656[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release657[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 3fb87c3881da98fe3f2b18b60ffeeccd9953f25a into gitea-mq/batch/43658[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release659[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: Merge 19610a72e7d680cd426bdb52d58795935f22ac15 into gitea-mq/batch/43660[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release661[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(flake): track niri-flake and zen-browser upstream instead of rev pins662663The pyrite desktop check once asserted niri-flake's revision as a literal,664so every flake-updater lock bump failed by construction (#3101, #3102,665#3169). #3232 answered that by pinning the URL by revision and having the666check assert `pinnedToDeclaredRev`, which passes only when flake.nix names667a revision: the check enforced the pin it was meant to justify, and668niri-flake and zen-browser moved to Renovate digest PRs while every other669unpinned input goes through the flake-updater bot.670671Both inputs now track their upstream default branch like the rest, and672the two pinnedToDeclaredRev clauses and their helpers are gone. The673behavioural assertions stay: niri's options come from nixpkgs' module,674and the installed Zen package is the one zen-browser provides, built675against our nixpkgs. dms-src keeps its release-tag pin, which encodes a676real coupling to nixpkgs' dms-shell version.677678Relocking advances niri-flake to dd2f795 (the commit #3261 proposed);679zen-browser's upstream head is the commit it was pinned to.680nixos-pyrite and every pyrite-* check build on x86_64-linux.681682Change-Id: I16223a5ba0d1e1889c94f935d868a9aa6a6a6964683[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch684[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: docs(skills): list companion skills for marketplace consumers685686Add a Companion skills section to the consuming-marketplace-plugins guide687with upstream `apm install` lines for omnigraph, tuicr, duckdb-skills,688dagster-expert, hf-cli and huggingface-datasets. They complement689plugins here but are deliberately not bundled: bundling would add their690descriptions to every consumer's sessions and hold them at our pins.691Each command was run with apm 0.32.0 and installs exactly the named692skills; tagged upstreams use release tags per the pinning policy, the693tagless ones carry commit SHAs with the policy's caveat.694695Transitive dependencies now names the linear-cli skill that696planning-and-development brings.697698Change-Id: I99457cfd1e89b6128737470e9d3a8ded6a6a6964699[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release700[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(omnigraph): deliver the upstream omnigraph skill with the client701702Wire `${programs.omnigraph.package.src}/skills` into aiSkills.extraSkillDirs,703as tuicr does, so the skill comes from the same pinned source the client704and server are built from and always describes the deployed version705(currently v0.11.0).706707The definition lives on the ai aggregate in the same file, guarded on the708omnigraph option existing and being enabled: tools reaches users without709ai (christophersmith, janettesmith, raquel, tara), where an aiSkills710definition would fail to evaluate.711712Change-Id: I4ae90fe76122ef1c0423bb07a4b917e66a6a6964713[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor714[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: feat(skills): propagate the linear-cli skill through planning-and-development715716openspec-linear-sync, which planning-and-development ships to marketplace717consumers, drives the linear CLI, but the upstream linear-cli skill718reached only Nix users (flake.lib.linearSkillDirs). A consumer who719installed the plugin with apm got a skill whose dependency was missing.720721- apm.yml declares `git: schpet/linear-cli`, ref 196315343d2b (the v2.6.0722  tag commit), `skills: [linear-cli]`; a scratch-project723  `apm install schpet/linear-cli/skills/linear-cli#<sha>` with apm 0.32.0724  installs exactly that skill.725- pkgs.linear-cli.src pins that commit instead of the tag name, so one726  pin serves the package, apm's offline cache in apm-skills-compose, and727  the drift guard. update.sh resolves the tag commit and rewrites both728  package.nix and the apm.yml ref, and its platform map now lists only729  the two Darwin binaries package.nix pins (Linux builds from source; the730  Linux prefetches were downloads with no hash line to update).731- apm-skills-compose pre-seeds the cache from pkgs.linear-cli.src and732  guards the apm.yml ref against it; the composed tree goes from 172 to733  173 skills.734- Nix delivery is unchanged: linear-cli joins excludedUpstreamSkills, and735  Nix users keep receiving it from linearSkillDirs only where they opt in,736  from the same pin.737738Change-Id: I048122dca5256fb58cc503d4c19fd4b06a6a6964739[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is minor740[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(omnigraph): fail startup fast and bootstrap new storage roots once741742Deploying #3257 stalled magnetite's switch-to-configuration for the full743start timeout. omnigraph-server v0.11.0 loads the cluster ledger and opens744every graph before binding, and any boot failure (here745[cluster_state_missing] on the new, never-applied dev-graph-v9 root)746exits the process within seconds. The ExecStartPost readiness probe kept747polling /healthz until readinessTimeout because it never noticed the main748process had died.749750Readiness probe (flake.lib.omnigraphReadinessProbe):751- polls /readyz and exits 1 at once when $MAINPID is gone, naming the752  journal and the apply remedy;753- treats quarantined graphs and, under requireAllGraphs, fewer served754  graphs than declared as permanent: the server has no runtime graph755  registration, and an imported-but-never-applied root boots empty yet756  passes /healthz;757- keeps 503 and ready=false transient until the timeout.758759Create-once bootstrap (flake.lib.omnigraphBootstrap, unit760omnigraph-cluster-bootstrap, option cluster.bootstrap.enable, default on761with the cluster): `cluster status` decides whether the root has state,762and a marker at <parent>/_omnigraph-markers/<root>.initialized (outside763the root's key prefix, so deleting the root never deletes it) records764that it ever had state:765- state and marker: nothing;766- state, no marker: adopt the existing root by writing the marker;767- no state, no marker: first initialization, runs the existing768  converge program, then writes the marker;769- no state, marker: a lost root; refuse without applying.770That initializes a new storageUri on deploy while keeping the protection771that holds apply.auto off: a lost root is never recreated empty. S3772markers use curl SigV4 path-style requests with credentials passed on773stdin; local roots must sit under /var/lib/omnigraph, the only directory774the hardened units can write. The server Wants (not Requires) the775bootstrap, so a refusal stays visible and the server then fails fast.776777Checks: omnigraph-readiness-rehearsal and omnigraph-bootstrap-rehearsal778drive the real scripts against loopback HTTP/S3 stubs and a stub CLI779(every probe outcome; the truth table for both marker backends, apply780and status failures, S3 errors, missing endpoint, rejected roots,781SigV4 path-style signing). omnigraph-wiring asserts magnetite's unit782ordering and that the server's ExecStartPost is the new probe.783784Change-Id: I931bf6ff300ba859422474546798e1d96a6a6964785[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch786[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(apm): relock apm.lock.yaml against main and apm 0.32.0787788Follows #3257. The vanixiets self-dependency moves to 8aa5fb47; the789transitive worktrunk and mergify-cli entries move to the v0.80.0 and7902026.9.16.1 commits that version-control-and-forge/apm.yml now pins; the791comment-cleanup ledger records uncomment.toml instead of792uncommentrc.toml; content hashes follow the updated skills.793794Change-Id: I5a8c3678bf1382d0eaf1a42edb5a5b556a6a6964795[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release796[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(apm-skills-install): relock from an empty apm_modules cache797798apm 0.32.0 `install --update` re-fetches an already-materialized799dependency only when its ref is a semver range800(should_force_ref_recheck, src/apm_cli/drift.py:174-193). A literal801commit pin that changed in a dependency's own manifest reuses the cached802checkout and writes the old resolved_commit back into apm.lock.yaml.803Plain `apm install` does detect that drift; --update does not.804805Observed after #3257 moved the worktrunk and mergify-cli refs in806version-control-and-forge/apm.yml: the relock kept de0052d8 and807727ce50b. Relock now removes the git-ignored apm_modules/ cache first,808so every dependency is resolved from its declaring manifest. Ownership809of deployed files lives in the lockfile ledger, so the only cost is a810re-fetch.811812Reproduced and verified: with main's lock and the old worktrunk checkout813materialized, the patched relock resolves b49ca7ee/e7c1ebbc and matches814a cache-free relock byte for byte apart from generated_at.815816Change-Id: I802a23af0d15cbaa526857556f6eede06a6a6964817[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch818[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(omnigent): 0.15.0 -> 0.16.0819820Upstream: https://github.com/omnigent-ai/omnigent/compare/v0.15.0...v0.16.0821822omnigent, omnigent-client and omnigent-ui-sdk move together (wheel823hashes from the PyPI JSON digests). Only the version-locked pins change824in pyproject; the existing relaxations and overrides still hold.825826acp-readiness.patch is still needed (0.16.0 still reports acp readiness827only for the bare `acp` harness) and is rebased: the ACP branch moved828into _harness_availability_core behind a new Windows guard. The readiness829test passes in the build.830831Upstream breaking notes #8137/#8143 (65,535-byte caps on saved832preferences and inference snapshots) affect server-side data only. The833host CLI surface, config keys and environment variables our modules use834are unchanged.835836Change-Id: I242bf10d54e879d31acbef5573af65ed6a6a6964837[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release838[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(mergify-cli): 2026.8.31.1 -> 2026.9.16.1839840Upstream: https://github.com/Mergifyio/mergify-cli/compare/2026.8.31.1...2026.9.16.1841842Bumps mergify-cli-bin and, in lockstep, agent-plugins/mergify-cli843(version, releaseTag, tag commit) and the version-control-and-forge844apm.yml ref.845846#1833 removes `mergify stack push --github-native`: native stack847registration is now the default (opt out with --no-github-native or848mergify-cli.stack-github-native=false). The git-stacked-pr-integration849skill and the adopt-queue-landing-protocol specs now publish with850`mergify stack push --trunk origin/main -R` and require the default to851stay on; the ADR note and its review keep their history with a dated852note.853854#1803/#1806/#1807 add `mergify auth login|logout|status`; the855mergify.nix comment now documents the non-stack credential chain.856857Change-Id: I323e343a51842dcf02a1a198766125796a6a6964858[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release859[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: fix(nix-fast-build): do not propagate python into consumers860861The package's propagated build inputs put its site-packages on862PYTHONPATH in every devshell that includes it, which overrides the863wrapper of any other nix-fast-build binary run from that shell (a newly864built one loads the old module). Remove865$out/nix-support/propagated-build-inputs in postFixup, exactly as866upstream's default.nix does.867868Change-Id: I5ce01d321cdfe1770858b78250f573856a6a6964869[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is patch870[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(nix-fast-build): 1.6.0 -> 2.0.4871872Upstream: https://github.com/Mic92/nix-fast-build/compare/1.6.0...2.0.48738742.x renders build logs itself: nix-output-monitor is dropped from the875wrapper PATH, --no-nom now selects the non-interactive renderer, and876interactive mode turns itself off without a TTY. --no-link is a877deprecated no-op (no out-links is the default), so check-fast stops878passing it. Every other flag our recipes pass is unchanged; --option now879reaches every nix call. The CI/CD skill's --no-nom description follows.880881Change-Id: Icc74b794021b6725bbdc47cd2277bc356a6a6964882[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release883[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(worktrunk): 0.76.0 -> 0.80.0884885Upstream: https://github.com/max-sixty/worktrunk/compare/v0.76.0...v0.80.0886887Bumps worktrunk-bin and, in lockstep, the agent-plugins/worktrunk source888and the version-control-and-forge apm.yml ref (the apm-skills-compose889drift guard requires both to name the v0.80.0 commit).890891Breaking upstream changes (0.77-0.80): wt list --format=json defaults to892schema 2; hook JSON context keys renamed to worktree_path / repo_path /893repo / primary_worktree_path; `wt config update --print` removed;894oh-my-pi plugin moved to `wt config plugins omp`; `{{ branch }}` unset in a895detached worktree. None is used here: the only config is896programs.worktrunk enable + package.897898Change-Id: I08b82b5e98fec40122348980c3481fb76a6a6964899[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release900[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(uncomment): 3.6.0 -> 3.10.2901902Upstream: https://github.com/Goldziher/uncomment/compare/v3.6.0...v3.10.29039043.8.0 makes .uncomment.toml the preferred config name (.uncommentrc.toml905still loads with a deprecation warning) and makes unknown config keys a906load error; scan, keep and lint subcommands are new.907908Rename the repository-root config to .uncomment.toml and the909preferences-comment-cleanup template to uncomment.toml. The skill now910states behaviour measured against 3.10.2: census via `scan --only911removable --group-identical`, `keep --id` to write ~keep markers, and912`--check` as the completion gate. XXX and tflint-ignore are default-kept913now, so the template drops them.914915Change-Id: Ie379fdf60fa2c6e5650467189469dc856a6a6964916[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release917[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(ouroboros): 0.42.0 -> 0.55.3918919Upstream: https://github.com/Q00/ouroboros/compare/v0.42.0...v0.55.39209210.55 pins mcp==2.0.0 in the [mcp] extra and mcp==1.28.1 in922[claude]/[claude-sdk] and declares them conflicting, so the old923`ouroboros-ai[mcp,claude,tui]` spec no longer resolves. Following the924upstream README, the wrapper uses [mcp,claude-cli,tui] with925`uvx --isolated --python '>=3.12'`, and the claude-code MCP server entry926uses [mcp] with `--runtime claude-cli --llm-backend claude_code`, as927upstream's own .mcp.json does, keeping our exact version pin.928929agent-plugins/ouroboros moves to the v0.55.3 tag peel.930931Change-Id: I5ac2e15a511b418dc5fa5bb5cbad3f2b6a6a6964932[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release933[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(omnigraph): 0.9.0-unstable-2026-08-05 -> 0.11.0934935Upstream: https://github.com/ModernRelay/omnigraph/compare/12a8596626c80a7dceed0fd72182d421052ff8d1...v0.11.0936937The unstable pin existed only because upstream published no releases;938it now does, and v0.11.0 contains the old pin. rev stays a commit sha939(the v0.11.0 tag peel) because OMNIGRAPH_SOURCE_VERSION is read from940src.rev and upstream stamps it with a sha. update.sh now tracks the941latest stable vX.Y.Z release instead of main.942943The lance-linalg AVX-512 VNNI postPatch moves to lance-linalg-11.0.0;944the three deleted lines are still present verbatim there.945946Cluster config migrated to the v0.11.0 policy schema (strict since947v0.9.0):948- server.policy.yaml drops `kind`; a bundle's kind follows its949  `applies_to` in cluster.yaml, which already scopes it to `cluster`.950- dev.policy.yaml drops the `stream_ingest`/`stream_manage` rules and951  the `cluster` group: upstream removed the RFC-026 streaming-ingest952  path (e1cd395) before v0.9.0, loads go through `change`, which953  operators already hold, and cluster apply no longer evaluates policy.954- the omnigraph-cluster wrapper passes `--as` to `apply`/`approve` only;955  `cluster stream` no longer exists.956957Deploy note: the old pin wrote internal manifest schema v19, an958abandoned format that 0.11 refuses and that `omnigraph upgrade` cannot959migrate. magnetite's storageUri therefore moves to a parallel root960(clusters/dev-graph-v9), following upstream's upgrade.md "same graph ID961in a parallel cluster root" procedure; the old root is untouched as the962export source and rollback copy. Carrying data over is a manual963export (old binary) / load (new binary) on magnetite.964965Change-Id: I4db767af7224204fa83f52a56b7f96e86a6a6964966[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release967[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(buzz): 0.5.20 -> 0.5.26968969Upstream: https://github.com/block/buzz/compare/desktop-v0.5.20...desktop-v0.5.26970971Only the shared source changes (src hash, passthru.rev, vendored cargo972hash); buzz-cli, git-credential-nostr and git-sign-nostr inherit it. The973line references in their comments are unchanged at the new tag.974975Change-Id: If97c50c44e8c19db3d109f98c235b15d6a6a6964976[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release977[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(no-mistakes): 1.60.2 -> 1.84.0978979Upstream: https://github.com/kunchenguid/no-mistakes/compare/v1.60.2...v1.84.0980981No release in the range is marked breaking. The package's assumptions982hold: internal/buildinfo.Version, empty telemetry host defaults, and the983NO_MISTAKES_TELEMETRY / NO_MISTAKES_NO_UPDATE_CHECK variables.984985Change-Id: Ie2d6877297cee4239c1b0f66f3faf4936a6a6964986[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release987[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(treehouse): 2.1.1 -> 3.1.0988989Upstream: https://github.com/kunchenguid/treehouse/compare/v2.1.1...v3.1.09909913.0.0 makes `treehouse return` (and `treehouse get` when its subshell992leaves the worktree dirty) exit 3 instead of 0; callers need --force or993must treat 3 as not-returned. 3.0.1 adopts pre-3.0 pool state994automatically. The only consumer, modules/home/ai/firstmate, lists the995package without invoking it. The -X main.version ldflag and996TREEHOUSE_NO_UPDATE_CHECK still exist. vendorHash is unchanged.997998Change-Id: I9e8389a12507f0270db99e2fa9f03b616a6a6964999[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release1000[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(atomic): 0.9.19 -> 0.9.2410011002Upstream: https://github.com/bastani-inc/atomic/compare/0.9.19...0.9.2410031004update.sh verified the npm tarball against the registry sha512,1005regenerated npm-dist-repairs.patch and manifest.json, and learned the new1006npmDepsHash from the build.100710080.9.20 renames TYPESAFE_AI_API_KEY to TYPESAFE_API_KEY and the Jev router1009models from typesafe-ai/jev* to typesafe/jev-latest; nothing here uses1010either. 0.9.21-0.9.24 are features and fixes.10111012Change-Id: Ic89cc417078e62bf7f338e24d6bcd3e16a6a69641013[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The commit should not trigger a release1014[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analyzing commit: chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.610151016Upstream: https://public.cdn.getdbt.com/fs/versions.json (latest.tag v2.0.6)1017Repository: https://github.com/dbt-labs/dbt-fusion10181019dbt Fusion is out of preview. Upstream no longer publishes the standalone1020dbt-lsp artifact (fs/lsp/fs-lsp-v2.0.6-* returns 404; install.sh says to1021run `dbt lsp` instead), so the package builds one src per platform and no1022longer installs bin/dbt-lsp. update.sh drops the LSP fetch and rewrites1023the single per-platform hash.10241025BREAKING CHANGE: pkgs.dbt-fusion no longer provides dbt-lsp; use1026`dbtf lsp`. Nothing in this repository referenced dbt-lsp.10271028Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a69641029[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  The release type for the commit is major1030[6:12:51 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ  Analysis of 2278 commits complete: major release1031[6:12:51 AM] [[secure]] › ✔  Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"1032[6:12:51 AM] [[secure]] › ℹ  The next release version is 1.0.01033[6:12:51 AM] [[secure]] › ℹ  Start step "generateNotes" of plugin "@[secure]/release-notes-generator"1034[6:12:55 AM] [[secure]] › ✔  Completed step "generateNotes" of plugin "@[secure]/release-notes-generator"1035[6:12:55 AM] [[secure]] › ⚠  Skip step "prepare" of plugin "@[secure]/npm" in dry-run mode1036[6:12:55 AM] [[secure]] › ⚠  Skip v1.0.0 tag creation in dry-run mode1037[6:12:55 AM] [[secure]] › ⚠  Skip step "publish" of plugin "@[secure]/npm" in dry-run mode1038[6:12:55 AM] [[secure]] › ⚠  Skip step "publish" of plugin "@[secure]/github" in dry-run mode1039[6:12:55 AM] [[secure]] › ⚠  Skip step "success" of plugin "@[secure]/github" in dry-run mode1040[6:12:55 AM] [[secure]] › ✔  Published release 1.0.0 on default channel1041[6:12:55 AM] [[secure]] › ℹ  Release note for version 1.0.0:1042# 1.0.0 (https://github.com/cameronraysmith/vanixiets/compare/v0.6.3...v1.0.0) (2026-10-03)10431044    * chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6 ([3ad03e9](https://github.com/cameronraysmith/vanixiets/commit/3ad03e9457194869f340fa607bf9b98fa1ff89c5))10451046### Bug Fixes10471048    * **agents-md:** lint vim rewrap at col 80 ([cb866ad](https://github.com/cameronraysmith/vanixiets/commit/cb866add13d017d240c71fdf5baee91fb09a5a61))1049    * **agents-md:** nits ([da4b7da](https://github.com/cameronraysmith/vanixiets/commit/da4b7da98f8a5a1e780594aafeb0c075ba5fb1ba))1050    * **agents:** record every deployed skill in the lockfile ledger ([0d55418](https://github.com/cameronraysmith/vanixiets/commit/0d5541887ae85249b89c7a7d3273ff1c3e66938d))1051    * **agents:** validate instructions packages, not just skills packages ([a294e05](https://github.com/cameronraysmith/vanixiets/commit/a294e0572edc55ce57c5b9abd69f4ce8fb9615d7))1052    * **ai:** declare .apm/skills container in plugin manifests ([3443101](https://github.com/cameronraysmith/vanixiets/commit/3443101f4c44f620ede4814497542349998b28e9))1053    * **apm-skills-install:** relock from an empty apm_modules cache ([83b45e2](https://github.com/cameronraysmith/vanixiets/commit/83b45e2dfcc2433bba713dbffd2572790006bac7)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257)1054    * **apm:** preserve offline cache hits with APM 0.31 ([4244103](https://github.com/cameronraysmith/vanixiets/commit/4244103505fcb44891e50e56ff917845e9abde8e))1055    * **apps:** add update-golem-cli ([c67213d](https://github.com/cameronraysmith/vanixiets/commit/c67213d13d6ca32fedf56637ab7dec40f9ed2811))1056    * **apps:** build apm-context-compile locally instead of querying caches ([05069eb](https://github.com/cameronraysmith/vanixiets/commit/05069eb3f2da35fdcf5b1e549f6cff655a5b7b7d))1057    * **apps:** drop update-beads flake app (beads uses nix-update-script) ([c2bacce](https://github.com/cameronraysmith/vanixiets/commit/c2baccee2a496086e2243cc13004e0617cfca59c))1058    * **apps:** drop update-dolt flake app (dolt uses nix-update-script) ([90cac5f](https://github.com/cameronraysmith/vanixiets/commit/90cac5fc8035785320e106d839298326e37ce530))1059    * **apps:** read the served marketplace manifest from apm.yml marketplace.output ([4f387cd](https://github.com/cameronraysmith/vanixiets/commit/4f387cd67fee06e5ca3a7e29f4a5818cde78565e)), closes [.#apm-marketplace-validate](https://github.com/./issues/apm-marketplace-validate)1060    * **apps:** reference seed-age-key through the per-system packages ([970c4ba](https://github.com/cameronraysmith/vanixiets/commit/970c4ba499f0b25dab9e7e8895902124c823120f))1061    * **argocd-repo-credentials:** roll local-k3d-argo-cd token ([d459a6d](https://github.com/cameronraysmith/vanixiets/commit/d459a6dbf6b899d952c0e152d75ef9f5cfdccb21))1062    * **atomic:** default new sessions to Astra medium ([541e7d2](https://github.com/cameronraysmith/vanixiets/commit/541e7d2f0969c3e0a44533536551f9b3d3c1e936))1063    * **atomic:** stop registering the statusline extension with atomic ([894558f](https://github.com/cameronraysmith/vanixiets/commit/894558f0e4f0dc42a6d1344062fc0797edfd2258))1064    * **atomic:** update to 0.9.17 ([27ad231](https://github.com/cameronraysmith/vanixiets/commit/27ad231101bfdba4d7b11be7d1f71df71eabc6c7)), closes [.#atomic](https://github.com/./issues/atomic)1065    * **atomic:** update to 0.9.18 ([add188e](https://github.com/cameronraysmith/vanixiets/commit/add188edd22874cb35743ed376a4882bc36c2cb0)), closes [.#update-atomic](https://github.com/./issues/update-atomic) [.#atomic](https://github.com/./issues/atomic)1066    * **bootstrap:** enable flakes and support hosts without systemd ([5dc2005](https://github.com/cameronraysmith/vanixiets/commit/5dc2005271d7774cd45729563b48a028a86ba9c5))1067    * **bootstrap:** trust the admin group on debian and ubuntu ([e029f9d](https://github.com/cameronraysmith/vanixiets/commit/e029f9de3e94aab7eb1c4146179441724e72acb9))1068    * **caddy:** rewrite Origin to loopback for hermes.zt dashboard WS ([c2f9e95](https://github.com/cameronraysmith/vanixiets/commit/c2f9e959d87ef4b0c3bb81e2f0e4f18e0fa63936))1069    * **casks:** remove riptide ([f86a2d3](https://github.com/cameronraysmith/vanixiets/commit/f86a2d3a96f55b86af7c38cc9b2df5972960f6f1))1070    * **catppuccin:** read bottom and starship themes from flake inputs ([e578a63](https://github.com/cameronraysmith/vanixiets/commit/e578a636c00af5bd96807537a695e35a9ddfd867))1071    * **catppuccin:** set autoEnable=true to make implicit port enrollment explicit ([3f4d4a3](https://github.com/cameronraysmith/vanixiets/commit/3f4d4a3fb13a74f29f147e7871892897e3744391))1072    * **ccstatusline:** declare settings version 4 for ccstatusline 2.2.29 ([36c23e3](https://github.com/cameronraysmith/vanixiets/commit/36c23e3c30abe786f1707ea40eff303a0c09d05f))1073    * **checks:** assert nixbot uploads via the uploaders option ([6652839](https://github.com/cameronraysmith/vanixiets/commit/665283994723f16cdd0b40470b716bf829a0cc5e))1074    * **checks:** defer scheelite from machine checks (uncacheable CUDA closure) ([8717103](https://github.com/cameronraysmith/vanixiets/commit/8717103d52a2df84343e76c571dae6bc7e673c0f))1075    * **checks:** derive pyrite input pins from their declarations and bump them ([0faa430](https://github.com/cameronraysmith/vanixiets/commit/0faa4300f65d3b2c83d8bd86929454417e1d8e17)), closes [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102)1076    * **checks:** drop the volatile pi version pin from the structural oracle ([fd63e9f](https://github.com/cameronraysmith/vanixiets/commit/fd63e9faa49e6284ee6ef9ce445784981bbabe96))1077    * **checks:** drop tsconfig baseUrl for typescript 7.0.2 ([023d635](https://github.com/cameronraysmith/vanixiets/commit/023d63596bc2bed1d5ec67bf6dd5405b748a1f8e))1078    * **checks:** expect pi 0.84.2 in pi-agent-environment ([93d9600](https://github.com/cameronraysmith/vanixiets/commit/93d9600667aaf615d86241ec967537d3bf3dd823))1079    * **checks:** refresh the golden without stale keys; state what the check pins ([b24e5ec](https://github.com/cameronraysmith/vanixiets/commit/b24e5ec80426a83207379dde0a2b079a9111bf0b))1080    * **checks:** report omnigent obligation failures legibly ([7d341d0](https://github.com/cameronraysmith/vanixiets/commit/7d341d0e418069bc46b61542343db7c1f7c03380))1081    * **checks:** stop the hook harness reporting crashes as allow ([e07f7f0](https://github.com/cameronraysmith/vanixiets/commit/e07f7f0a1f6852d4848b7a971527658fd4370fa0))1082    * **checks:** warm the zerotier controller's unfree build in the fleet cache ([c185bbc](https://github.com/cameronraysmith/vanixiets/commit/c185bbc639aaa5928c4682c4fc93b60d9012e7f1))1083    * **checks:** write clan-inventory-consistency scratch to $TMPDIR not /tmp ([9b0a6b5](https://github.com/cameronraysmith/vanixiets/commit/9b0a6b52041fd6cac3e51f216e6dbcb965281b4d))1084    * **cinnabar/caddy:** bind ZeroTier mesh addresses via ip_nonlocal_bind ([432efb8](https://github.com/cameronraysmith/vanixiets/commit/432efb840be2383b173bd77558ef2f0928ddbadb))1085    * **cinnabar/caddy:** rewrite Host header for hermes dashboard reverse-proxy ([72eae12](https://github.com/cameronraysmith/vanixiets/commit/72eae126dd02addaec73dc066a4672f1babd34bf))1086    * **cinnabar:** migrate zerotier to clanService API + bump clan-core to 004bb87d ([021d4fd](https://github.com/cameronraysmith/vanixiets/commit/021d4fdba4697ab3b6e904249c7741aa35c6317d))1087    * **ci:** separate KVM-only VM tests from PR checks ([7eb7fb8](https://github.com/cameronraysmith/vanixiets/commit/7eb7fb8c148a16ec718b46c672afd768969aa9b1))1088    * **clan/hermes-agent:** deliver matrix bootstrap vars via environment ([20d31cb](https://github.com/cameronraysmith/vanixiets/commit/20d31cb3887d37c58ebb60d3e9d77f0eefff0fb2))1089    * **clan/hermes-agent:** derive stateDir from config.users.users.<user>.home ([74d4570](https://github.com/cameronraysmith/vanixiets/commit/74d4570a46ed13ccc2fca8058ef78bff54d52b11))1090    * **clan/hermes-agent:** restore MATRIX_HOMESERVER/MATRIX_USER_ID env ([a0ac221](https://github.com/cameronraysmith/vanixiets/commit/a0ac221473f924140422477a8d9ecd9592aff40a))1091    * **claude-code:** 4-* -> 5 ([3de72a9](https://github.com/cameronraysmith/vanixiets/commit/3de72a9e5b4c8f13b6ed93494a4a1d38e47e9c1e))1092    * **claude-code:** pin editorMode = vim ([c8fcdf7](https://github.com/cameronraysmith/vanixiets/commit/c8fcdf7a5191f20fb457903b032c21345ce07f80))1093    * **claude:** disable cloudflare and ouroboros plugins ([d8129e6](https://github.com/cameronraysmith/vanixiets/commit/d8129e6da0c0ae645a2748ec2354717970525ddb))1094    * **cluster:** drive the CI integration run off the local-k3d-ci environment ([08c2e55](https://github.com/cameronraysmith/vanixiets/commit/08c2e55ef76cbfd9547e7d131d877519ec33e115))1095    * **cognee-cli-wrapper:** python313 -> python3 ([c32482e](https://github.com/cameronraysmith/vanixiets/commit/c32482ec4e98a98462388dffd5f1ceb6834c3488))1096    * **cognee:** bound DB connection leaks via role-level idle_in_transaction_session_timeout (safety net for the cognee session-lifecycle leak) ([470dd8d](https://github.com/cameronraysmith/vanixiets/commit/470dd8d927f0c5542e53fcc79625ac7d667fd16b))1097    * **cognee:** loopback TCP + scram so API startup migrations run ([0c539e1](https://github.com/cameronraysmith/vanixiets/commit/0c539e1e85693ebd33da8ea9c624fc48aedec8bf))1098    * **cognee:** own db-password secret by postgres for ALTER ROLE ([4d03d6e](https://github.com/cameronraysmith/vanixiets/commit/4d03d6ec19391649ec93f7b27657076d19d98f68))1099    * **cognee:** re-pin cognee-nix to 16167c00 for correct IPv6 --bind ([053d98f](https://github.com/cameronraysmith/vanixiets/commit/053d98f7c3042505c1f97659223e9ccd34a8b256))1100    * **commands:** drop jj git push --allow-new removed in jj 0.42 ([cdfe0f2](https://github.com/cameronraysmith/vanixiets/commit/cdfe0f248b8c443bce451102838089f33aadf7c6))1101    * **containers:** expose Darwin variants via legacyPackages to escape strict flake-check forcing ([31adcdc](https://github.com/cameronraysmith/vanixiets/commit/31adcdcc1529d5a5ed4c3c5366544428b03865bd))1102    * **context:** fire the README habit on claims about a directory, not only edits ([ef48197](https://github.com/cameronraysmith/vanixiets/commit/ef481977a299da41a6ca8bf48c14adcb6d3ab0c4))1103    * **context:** retire beads references, restore reference-repo lookup policy, repair cross-references ([c80de68](https://github.com/cameronraysmith/vanixiets/commit/c80de68d8e83274029624307f6a864707e4e0de0))1104    * **darwin/homebrew:** add --force-cleanup for Homebrew >=5.1.15 cleanup guard (nix-darwin[#1787](https://github.com/cameronraysmith/vanixiets/issues/1787)) ([b6964bc](https://github.com/cameronraysmith/vanixiets/commit/b6964bcbb9628bab2519b849abb4e0de645c15c1))1105    * **darwin:** decouple homebrew self-update from the activation bundle run ([bf60c25](https://github.com/cameronraysmith/vanixiets/commit/bf60c25919789b53599644ffb741b09218d07edc))1106    * **darwin:** disable allowUnsupportedSystem in nixpkgs.config ([2fd4de7](https://github.com/cameronraysmith/vanixiets/commit/2fd4de73d4feac4f48be342ab8805a0b2f186f88))1107    * **darwin:** disable scheduled nix store optimise ([16d9eef](https://github.com/cameronraysmith/vanixiets/commit/16d9eef1f9f096d0e9f1da39baf32f3c3f0f6f1b))1108    * **darwin:** keep DNS encrypted on every network adapter ([bf2424f](https://github.com/cameronraysmith/vanixiets/commit/bf2424f926038f416402c718b7f052c952c613fa))1109    * **darwin:** stop Sparkle apps installing updates unattended ([832f30d](https://github.com/cameronraysmith/vanixiets/commit/832f30d2bb6ddf39efddd3d0ea0952d8ba9fc0c0))1110    * **darwin:** stop the DNS resolver check aborting activation ([a767bc2](https://github.com/cameronraysmith/vanixiets/commit/a767bc2419199066430c3e1438409f01b0d02d3a))1111    * **deps:** pin conventional-changelog preset to the v9 line ([ab6c91e](https://github.com/cameronraysmith/vanixiets/commit/ab6c91e880de2e58895f4710063e71cbb9468666))1112    * **deps:** update astro ([29b174f](https://github.com/cameronraysmith/vanixiets/commit/29b174f345e5897eddea9b39fae6f01bf4c74ee4))1113    * **deps:** update astro monorepo ([60734de](https://github.com/cameronraysmith/vanixiets/commit/60734dee18f8016a3367cbbf99bed7221b16d8a6))1114    * **deps:** update astro monorepo ([6ebd2c6](https://github.com/cameronraysmith/vanixiets/commit/6ebd2c628be8a276a216f01afeb407ecb70bfdde))1115    * **deps:** update astro monorepo ([540a215](https://github.com/cameronraysmith/vanixiets/commit/540a215257a110c96aa0c9acb5a723d6f8e1b093))1116    * **deps:** update dependency @astrojs/starlight to v0.38.5 ([a4bc1dd](https://github.com/cameronraysmith/vanixiets/commit/a4bc1dd910614b790136baabdbc48a1790370634))1117    * **deps:** update dependency @astrojs/starlight to v0.41.10 ([9a7fd54](https://github.com/cameronraysmith/vanixiets/commit/9a7fd54508cfaca41be0558d39156a527d03026e))1118    * **deps:** update dependency @astrojs/starlight to v0.41.2 ([be57ecb](https://github.com/cameronraysmith/vanixiets/commit/be57ecb75d52873305846b6a834d3ebc499d3fb9))1119    * **deps:** update dependency @astrojs/starlight to v0.41.3 ([a5f3e20](https://github.com/cameronraysmith/vanixiets/commit/a5f3e208cfefa770d5ade0c3563a2a984ec52800))1120    * **deps:** update dependency @astrojs/starlight to v0.42.5 ([5d5e492](https://github.com/cameronraysmith/vanixiets/commit/5d5e49299201a1f1e68c83520aa2153030e89784))1121    * **development-packages:** elixir -> beamPackages ([c765939](https://github.com/cameronraysmith/vanixiets/commit/c76593907f1ab41f21a8bb35b2257ff94b780ffb))1122    * **development-packges:** use rclone home-manager module ([54aa120](https://github.com/cameronraysmith/vanixiets/commit/54aa1202907c737dcc1ef534fe131a9be772b711))1123    * **devin:** activate the home profile without secrets at snapshot build and reactivate at session start ([ac14ae3](https://github.com/cameronraysmith/vanixiets/commit/ac14ae301f8af1b34022b83b9ef4cec736346252))1124    * **devin:** activate without secrets in maintenance as well ([590f751](https://github.com/cameronraysmith/vanixiets/commit/590f75195cc7acbb3926d39397bf860c2c6efc65))1125    * **devshell:** platform-conditional playwright browsers ([6a47121](https://github.com/cameronraysmith/vanixiets/commit/6a4712105bcb5901cb24ea04a4035a9dc0a42ba6))1126    * **devshells:** match the project nix client to the fleet default ([4d97b62](https://github.com/cameronraysmith/vanixiets/commit/4d97b621c3d1864be87859160b47cebf63542854))1127    * **dnscrypt-proxy:** set blackphos userHome to /private/var to match on-disk user ([40593ec](https://github.com/cameronraysmith/vanixiets/commit/40593ece32b37ce95b90f35e35bb51171234b790))1128    * **docs-deploy:** pass wrangler globals after the subcommand ([3835e40](https://github.com/cameronraysmith/vanixiets/commit/3835e40b58e92f76cf49901616e830f0f670cfcb))1129    * **docs:** adapt starlight sidebar for v0.39 breaking changes ([5e6fb56](https://github.com/cameronraysmith/vanixiets/commit/5e6fb56997b3d250f4947d6773543fff20a556b6))1130    * **docs:** give each browser report build its own preview ports ([9caddea](https://github.com/cameronraysmith/vanixiets/commit/9caddeafdb03753fea0bb2aa3d994b91a1b68c4c))1131    * **docs:** isolated bun linker for local astro-7 dev ([4fec259](https://github.com/cameronraysmith/vanixiets/commit/4fec259e1782c80dc472d05da426f11a2e8d0860))1132    * **docs:** keep browser evidence valid under CI build contention ([3f8dbba](https://github.com/cameronraysmith/vanixiets/commit/3f8dbbaad23ff799c2b466924b5ba2b5719612a5))1133    * **docs:** keep runner-control deadlines above browser setup under load ([50ae451](https://github.com/cameronraysmith/vanixiets/commit/50ae45182a4e4d7f8d58d3b30ebf06531efe45a6))1134    * **docs:** keep the homepage hero within narrow viewports ([88a39fb](https://github.com/cameronraysmith/vanixiets/commit/88a39fbb7c24d2afcf2d13854cb64e04d73ed8a9))1135    * **docs:** keep WebKit failure screenshots in Darwin build reports ([1c82caa](https://github.com/cameronraysmith/vanixiets/commit/1c82caa79bcc0e2f801bd4c63f1002fdd84251d0))1136    * **docs:** pin unified() markdown processor for astro 7 ([e47a035](https://github.com/cameronraysmith/vanixiets/commit/e47a03515402828f0cf1796545e63e630e38eac8))1137    * **docs:** retain browser regression evidence and version observations ([075412d](https://github.com/cameronraysmith/vanixiets/commit/075412d01b14b0ef7178b884270a5ab4aee685cc))1138    * **docs:** run report verdict CLI through symlinked paths ([6345440](https://github.com/cameronraysmith/vanixiets/commit/6345440fc07af4d1593ce47e0661f6db37532d64))1139    * **docs:** run tests under node and fix wrangler path for cloudflare 14 ([c668a47](https://github.com/cameronraysmith/vanixiets/commit/c668a474aca64d99a64312bc802447c25ecca1d6))1140    * **docs:** source darwin playwright webkit from patched flake fork ([f32b987](https://github.com/cameronraysmith/vanixiets/commit/f32b9874bcae5bcca9cf46d79bb5bdebdc655084))1141    * **effects:** act only on pull requests that are open at the event's head ([ac676a0](https://github.com/cameronraysmith/vanixiets/commit/ac676a011e7211c353c8b1143cee79228b27f24a)), closes [#3245](https://github.com/cameronraysmith/vanixiets/issues/3245)1142    * **effects:** require permission guards for credentialed build-finished events ([c000f0c](https://github.com/cameronraysmith/vanixiets/commit/c000f0c43c27b41a8f6dd1c86edbebd3d2323449))1143    * **effects:** run nixbot effects only on pushes to main ([640fc17](https://github.com/cameronraysmith/vanixiets/commit/640fc173dd242c6b1aac604d6b5cea9bd9c1fac8))1144    * **flake:** drop unused input pins ([dd864cd](https://github.com/cameronraysmith/vanixiets/commit/dd864cdd12f6c130850d08483e540f683ef0bba0))1145    * **flake:** track niri-flake and zen-browser upstream instead of rev pins ([bd915fd](https://github.com/cameronraysmith/vanixiets/commit/bd915fd3997eed0406f8dda4385d4aecc1721e98)), closes [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169) [#3232](https://github.com/cameronraysmith/vanixiets/issues/3232) [#3261](https://github.com/cameronraysmith/vanixiets/issues/3261)1146    * **flake:** track playwright-cli's flake upstream instead of a rev pin ([81224d2](https://github.com/cameronraysmith/vanixiets/commit/81224d254ba7ee571a4299b021c7eec338b0bc48)), closes [#3268](https://github.com/cameronraysmith/vanixiets/issues/3268)1147    * **fonts:** correct Monaspace Nerd Font family name ([b1d14bf](https://github.com/cameronraysmith/vanixiets/commit/b1d14bfb76b0ce4e87c7c30216aa26710e1fd63e))1148    * **fonts:** use Mono Nerd Font cut for terminal grid ([598724e](https://github.com/cameronraysmith/vanixiets/commit/598724e45673c2db2a065ae857779787985f2e66))1149    * **fzf:** disable Ctrl-R history widget so atuin owns it ([876a25d](https://github.com/cameronraysmith/vanixiets/commit/876a25d209233e3e6f874f0f07c2b2d853ab2598))1150    * **gitea-mq:** match the required-check fallback to the authoritative ruleset ([00a7c20](https://github.com/cameronraysmith/vanixiets/commit/00a7c20ce5ebe353e891d5ea4565e41e531ee7a7))1151    * **gitignore:** anchor the archive pattern to the repository root ([9805d59](https://github.com/cameronraysmith/vanixiets/commit/9805d595f0a7600edd1c3f73aa31824c47a280c6))1152    * **gpg:** disable the darwin gpg-agent launchd service ([594b32f](https://github.com/cameronraysmith/vanixiets/commit/594b32f19393f927cede2df3a93fa381a9e7275f))1153    * **herdr:** restore the default pane-swap keybindings ([832f887](https://github.com/cameronraysmith/vanixiets/commit/832f887a77c746e323c4e4271b41f115fb50ac56))1154    * **hermes-agent:** break the config.yaml corruption loop with moshi-hook ([872679a](https://github.com/cameronraysmith/vanixiets/commit/872679a534bf477534ce0cc28cafece912f1f942))1155    * **hermes-agent:** set codex default ([c63754c](https://github.com/cameronraysmith/vanixiets/commit/c63754ce5e455b2744f96a488ea262be2c2a600e))1156    * **hermes-agent:** update configuration ([67cd7cc](https://github.com/cameronraysmith/vanixiets/commit/67cd7ccadb097ec6c0e4e745e218a8892608a136))1157    * **hermes:** bind dashboard to loopback for v0.17.0 ([#50551](https://github.com/cameronraysmith/vanixiets/issues/50551)) ([f264143](https://github.com/cameronraysmith/vanixiets/commit/f264143d1a1bb6a2617f435730806326815b080b))1158    * **home,clan/hermes-agent:** switch skills delivery to ~/.hermes/skills/ ([b169962](https://github.com/cameronraysmith/vanixiets/commit/b16996296f9c184b76e68d315beac974542e7059))1159    * **home/ai/claude-code:** drop unsupported "mcp__*" allow rule; MCP governed by defaultMode = "auto" ([5e231b1](https://github.com/cameronraysmith/vanixiets/commit/5e231b15a7bc813afcf51da0cd07243ffba705c8))1160    * **home/ai/claude-code:** use upstream marketplace name 'dagster' so dagster-expert plugin enables ([dc88ba4](https://github.com/cameronraysmith/vanixiets/commit/dc88ba49263f4ddf255f3a8f6f046fa4ef74b199))1161    * **home/ai/openspec:** anglicize vendored superpowers-bridge schema bundle ([c471dee](https://github.com/cameronraysmith/vanixiets/commit/c471dee7deab121f9f52da190c45e08e4515e772))1162    * **home/checks:** bind activationPackage directly to recover cache linkage ([f1ad224](https://github.com/cameronraysmith/vanixiets/commit/f1ad22402f58f7b3f5777f164981b6134639f094))1163    * **home/claude-code:** correct home.file override path to upstream's absolute key ([d6e727e](https://github.com/cameronraysmith/vanixiets/commit/d6e727e1ac9af598baa3a8994485780291da7d4f))1164    * **home/claude-code:** force-overwrite .claude/settings.json (nix-owned) ([b0e01f4](https://github.com/cameronraysmith/vanixiets/commit/b0e01f4b8924299f18d1b66c6086dff60ddb41a6))1165    * **home/core/ssh:** migrate matchBlocks to programs.ssh.settings ([8f1f691](https://github.com/cameronraysmith/vanixiets/commit/8f1f6917e26475d794beb2c9dff9d2d279c280d6))1166    * **home/core:** set GIT_OPTIONAL_LOCKS=0 to skip git status index writeback ([db970c9](https://github.com/cameronraysmith/vanixiets/commit/db970c98858c324dd53d013187c7bfeb59c8f87f))1167    * **home/crs58:** correct stale linear-cli bundled-skills comment (38 -> 1 dir/16 refs) ([930012a](https://github.com/cameronraysmith/vanixiets/commit/930012a6817fda0fe0138e4c4b70cbfe0a7ffb66))1168    * **home/direnv:** skip hanging direnv-instant tmux test in checkPhase ([730a7ae](https://github.com/cameronraysmith/vanixiets/commit/730a7ae7908ccd33771cf0387dbcfecb1400cc8a))1169    * **home/neovim:** pin git_config and fish treesitter parsers ([f927884](https://github.com/cameronraysmith/vanixiets/commit/f927884555f652dc6a8b33c789e4b309ca4907ec))1170    * **home/packages:** wrap gitmux with GIT_INDEX_FILE redirection in jj-colocated repos to avoid .git/index.lock races with jj export ([4c2429a](https://github.com/cameronraysmith/vanixiets/commit/4c2429a3bece06eacde21d3bf0e7b133590288f4))1171    * **home/starship:** set scan_timeout to 50ms ([5c4071d](https://github.com/cameronraysmith/vanixiets/commit/5c4071dcbc53c645e7b26bf1358ed1d15865b96a))1172    * **home/tools/agents-md:** correct jj-mode dispatch instruction to canonical wip-on-top recipe with --keep-emptied ([b16fe25](https://github.com/cameronraysmith/vanixiets/commit/b16fe25fb0e0364e1b07d6b2a5511fa0df640258))1173    * **home/tools/commands:** hermes-backup reads zip entries via bsdtar [@archive](https://github.com/archive) operand ([da917ff](https://github.com/cameronraysmith/vanixiets/commit/da917ffd762b89353e25b4076925e4b708d50ff7))1174    * **home/ubuntu:** use the sandbox's C.UTF-8 locale ([3e1a5fa](https://github.com/cameronraysmith/vanixiets/commit/3e1a5fa07d1f8181889b211c7ed86a345ba7f27d))1175    * **home/zed:** migrate agent.play_sound_when_agent_done to enum string ([bd4cc1c](https://github.com/cameronraysmith/vanixiets/commit/bd4cc1c6a280818ec5240d990e39582dcb3d4da8))1176    * **homebrew:** add element, itsycal, jayjay, linear, logi-options+ ([1800c41](https://github.com/cameronraysmith/vanixiets/commit/1800c41cc3650e66fca67c56955b89b1c431e3fe))1177    * **homebrew:** no-quarantine deprecated ([2325256](https://github.com/cameronraysmith/vanixiets/commit/2325256ee355d572e051901b50cf5c99175b8eb0))1178    * **homebrew:** update active dock items ([4b4d152](https://github.com/cameronraysmith/vanixiets/commit/4b4d1528570743618ca4c481928bce213f8d737b))1179    * **home:** let shell and development declare their own upstream imports ([7db2049](https://github.com/cameronraysmith/vanixiets/commit/7db20490e60a77c355c0d631ce4a761b22d777a2))1180    * **home:** let terminal aggregate declare its own nix-index import ([95d4d06](https://github.com/cameronraysmith/vanixiets/commit/95d4d06d869cf93b5b044bcc15d194984c7de3d6))1181    * **home:** migrate lazygit diff renderer config to the 0.65 schema ([27b0dad](https://github.com/cameronraysmith/vanixiets/commit/27b0dad1c62f6a7422d52388894f8a373186aded))1182    * **home:** name the queue each host serves instead of deriving it ([a6a8df6](https://github.com/cameronraysmith/vanixiets/commit/a6a8df65dd97634bf76bcdc8ae2015d39c6e7636))1183    * **home:** pass the configuration name to nh home switch ([7429300](https://github.com/cameronraysmith/vanixiets/commit/74293008f13ec7f26c9750555483f1449720914c))1184    * **home:** per-outpost credentials, id addressing, live registry values ([452c3b6](https://github.com/cameronraysmith/vanixiets/commit/452c3b67be0f8713925d33e6f0ef3463a73ef7a1))1185    * **home:** skip the sops-nix unit restart when no age key is present ([604d824](https://github.com/cameronraysmith/vanixiets/commit/604d82429aed1b75b43f828d0b06b82546d59e5d))1186    * **home:** state catppuccin auto-enrollment wherever the module is imported ([aea0f39](https://github.com/cameronraysmith/vanixiets/commit/aea0f39a94c1ee7297de112546261d12ca21f659))1187    * **home:** stop a tokenless darwin worker, and decouple the two hosts ([b81e1ef](https://github.com/cameronraysmith/vanixiets/commit/b81e1efcc28687a8404a34d287df683c8e1a70fd))1188    * **hooks/gate-dangerous-commands:** drop anchor on -b empty-body regex ([e0bcb53](https://github.com/cameronraysmith/vanixiets/commit/e0bcb53b326da899c55b0a90c63401d5a00ce7fa))1189    * **hooks:** assert the development join has exactly one child ([703350c](https://github.com/cameronraysmith/vanixiets/commit/703350c6121f0a995fdfbec9c027188a0fcd4ba2))1190    * **hooks:** don't gate kill word inside quoted search patterns ([108387f](https://github.com/cameronraysmith/vanixiets/commit/108387f46cdd01dc1a10b3e837abe65096f09694))1191    * **hooks:** gate kill by target hazard, not by the word kill ([dba57d1](https://github.com/cameronraysmith/vanixiets/commit/dba57d1f3eddbea241d368d247aeeb40e13bf46c))1192    * **hooks:** let permission notifications fire outside beads repositories ([ab47e98](https://github.com/cameronraysmith/vanixiets/commit/ab47e988cb70d181293b8148409d9f6be7e0853d))1193    * **hooks:** re-gate the destructive git push forms ([ce9c780](https://github.com/cameronraysmith/vanixiets/commit/ce9c7800dec819ad088964d2bd395d6bf8d443cb))1194    * **hooks:** repair the join detector and the diamond recovery text ([3bf142b](https://github.com/cameronraysmith/vanixiets/commit/3bf142b4ff84f71bdef5a376e8505c596936dc8d))1195    * **jj-linearize-join:** describe the reconstructed join from its actual parents ([f7d8cdb](https://github.com/cameronraysmith/vanixiets/commit/f7d8cdba0f6a3302ba9099ee2685de336403fde2))1196    * **jj-linearize-join:** stop the divergence marker reaching revision arguments ([41b3147](https://github.com/cameronraysmith/vanixiets/commit/41b3147d8709cdd710d01c8a7f852220981776df))1197    * **just:** retry remote check builds and document the ssh limit ([8b6f8d7](https://github.com/cameronraysmith/vanixiets/commit/8b6f8d7c6f710f4d84648d07dcd698660dbe3a75))1198    * **k3d:** run local integration through the offline CI path ([fb3ac14](https://github.com/cameronraysmith/vanixiets/commit/fb3ac140327aa0fdc20b9fd2756e91ad1975883a))1199    * **k8s:** follow sops-secrets-operator chart rename helm3 -> helm4 (0.21.2) ([fe1e9bc](https://github.com/cameronraysmith/vanixiets/commit/fe1e9bc79dbb379c9afea139c6f41b2997db5729)), closes [#3133](https://github.com/cameronraysmith/vanixiets/issues/3133) [#239](https://github.com/cameronraysmith/vanixiets/issues/239)1200    * **k8s:** repoint cilium CRD selector past upstream embed.go (v1.20.2) ([f074320](https://github.com/cameronraysmith/vanixiets/commit/f07432065aa42dfac9f769c364939f031ee89b0c)), closes [#3132](https://github.com/cameronraysmith/vanixiets/issues/3132)1201    * **kanidm:** enable online backups and align the branding cli package ([ebb45d8](https://github.com/cameronraysmith/vanixiets/commit/ebb45d81bfbe18b056c3ea8f597e3f2e9c276487))1202    * **kernel-modules:** move pyrite module boundary to Linux 6.18.52 ([16f068c](https://github.com/cameronraysmith/vanixiets/commit/16f068cdb3473bf4f639f68a8586e6e6d5769408))1203    * **linear-cli:** dispatch the denoDeps hash probe to the x86_64-linux remote builder ([1f575c6](https://github.com/cameronraysmith/vanixiets/commit/1f575c63d1259aae0c44cc666576f30bdc7b8d25))1204    * **linear-cli:** remove store references from vendored dependencies ([9518598](https://github.com/cameronraysmith/vanixiets/commit/9518598116f630d201cd0715329dcfff359c4c7f))1205    * **linear-cli:** update to 2.5.0 ([bd9a7ea](https://github.com/cameronraysmith/vanixiets/commit/bd9a7eaf0a7088c4dfe8da9943e8fca4a1c62410))1206    * **machines/magnetite:** enforce zfs quota and reservations against pool starvation ([aca5c70](https://github.com/cameronraysmith/vanixiets/commit/aca5c708baf1cc0b30d541fc7e88f38687d482fe))1207    * **machines/magnetite:** tighten nix gc and build-sandbox reaping for the build host ([e456caf](https://github.com/cameronraysmith/vanixiets/commit/e456caf62ffc7fe951f69db73d11c41374d6fb8e))1208    * **magnetite/kanidm:** add kanidm.service to oauth2-synapse restartUnits to re-run provision on rotation ([093549a](https://github.com/cameronraysmith/vanixiets/commit/093549a700b0980bab5d1bf45c58e1058c1f0b1b))1209    * **magnetite/kanidm:** manage matrix_users membership operationally to satisfy referential-integrity assertion ([9d5be21](https://github.com/cameronraysmith/vanixiets/commit/9d5be2120798fba11953e4f2b924741482e8d7db))1210    * **magnetite/kanidm:** reassign kanidm-oauth2-synapse secret ownership to kanidm:kanidm for provisioning access ([2fe9b91](https://github.com/cameronraysmith/vanixiets/commit/2fe9b914c0bcdfde2bc9d870cabe417d24db9100))1211    * **magnetite/kanidm:** replace trust_x_forward_for with http_client_address_info (V2 schema) ([3cd6dca](https://github.com/cameronraysmith/vanixiets/commit/3cd6dcae44933429d9005a41780feb3198f92d76))1212    * **magnetite/kanidm:** switch to enableACME + filesystem cert delivery ([c79f4bf](https://github.com/cameronraysmith/vanixiets/commit/c79f4bf4054c09120fe2bc54c2f39eb5f6785f2a))1213    * **magnetite/matrix:** expose federation OpenID userinfo endpoint for lk-jwt-service ([3966c86](https://github.com/cameronraysmith/vanixiets/commit/3966c86eb8e3fcdf2bd62df8d301f6535a6a8740))1214    * **magnetite/matrix:** grant nginx read access to acme cert via turnserver group membership ([6d68921](https://github.com/cameronraysmith/vanixiets/commit/6d68921f7e82ba293ad99a2827832bb93d9dd01b))1215    * **magnetite/matrix:** wire lk-jwt-service.livekitUrl and nginx /livekit/sfu proxy (nix-dk1) ([7d9d53b](https://github.com/cameronraysmith/vanixiets/commit/7d9d53b73e7d24c66959fb8cdceb4cf8032d17ab))1216    * **magnetite:** assert com.sun:auto-snapshot=false on root/nix at boot ([220b8a6](https://github.com/cameronraysmith/vanixiets/commit/220b8a6ba644fbc85c5e73c59057a6ee9f6dc26a))1217    * **magnetite:** confine the builder account's key to the nix protocol ([d3b3b64](https://github.com/cameronraysmith/vanixiets/commit/d3b3b646d383b164647fe3c7d25ddd3a489544e7))1218    * **magnetite:** drop dhparam options removed in nixpkgs 26.11 ([17c8b73](https://github.com/cameronraysmith/vanixiets/commit/17c8b735b1492e2c698c4c3d4975306eb401066c))1219    * **magnetite:** drop stale omnigraph systemPackages entry ([bc06590](https://github.com/cameronraysmith/vanixiets/commit/bc065901069d3b0b202b3f6194de51d9443d6f59))1220    * **magnetite:** raise sshd MaxStartups for the remote check lane ([45370c6](https://github.com/cameronraysmith/vanixiets/commit/45370c67cfa50b656b93b5bbf3e83b2adb1e60a1))1221    * **magnetite:** trust the builder account so distributed builds accept pushed paths ([b1d34d2](https://github.com/cameronraysmith/vanixiets/commit/b1d34d293c4a3bf0928e3a0b4323403c1b3ef7a8))1222    * **moshi:** reconcile hooks after managedConfigs ([3cc1559](https://github.com/cameronraysmith/vanixiets/commit/3cc155943c83230fd491643d51c36e66aaadc8e3))1223    * **neovim:** drop pplatex from lazyvim extraPackages ([2a5b261](https://github.com/cameronraysmith/vanixiets/commit/2a5b261f9b154cf698d238696fa732d406ff737d))1224    * **neovim:** mini_surround -> mini-surround ([18f7580](https://github.com/cameronraysmith/vanixiets/commit/18f75809f5bd2cff0c43d5e24d049a8a1968b71e))1225    * **neovim:** snacks_picker -> snacks-picker ([9a6550d](https://github.com/cameronraysmith/vanixiets/commit/9a6550dc9035e09c81997b4fbdcb30c756002261))1226    * **network:** clamp TCP MSS on zerotier for all NixOS hosts ([5725837](https://github.com/cameronraysmith/vanixiets/commit/5725837051d12e9f5f79f25b2e3f8faa60843b8c))1227    * **network:** make ZeroTier MSS rules lifecycle-safe ([2931154](https://github.com/cameronraysmith/vanixiets/commit/2931154b1f4bbf00bb5cfca24b69327a2b61f194))1228    * **nix-fast-build:** do not propagate python into consumers ([b200160](https://github.com/cameronraysmith/vanixiets/commit/b2001606ea6ade52f8a2e79285b3a543e6a57f32))1229    * **nix:** bound stalled substituter downloads to 60s ([03e7785](https://github.com/cameronraysmith/vanixiets/commit/03e7785965941d67b20b9f4cdaf9fe85e258fe5f))1230    * **nix:** declare KVM availability per host ([58765f2](https://github.com/cameronraysmith/vanixiets/commit/58765f23589773f56592493284715f5c90879ca2))1231    * **nix:** default fleet to Nix 2.35 for parallel cache queries ([aece57e](https://github.com/cameronraysmith/vanixiets/commit/aece57edc2865da308f37f58ffb8874420e75e58))1232    * **nixidy-push:** default to a sibling checkout and clone it when absent ([39216f1](https://github.com/cameronraysmith/vanixiets/commit/39216f1a0c4b383a9a2f8d972a823d2e1071f78b))1233    * **nixidy:** select the manifest repo by environment instead of getEnv ([dcc5acd](https://github.com/cameronraysmith/vanixiets/commit/dcc5acdae68cdf74e019005cf97fa0e1ad0f176f))1234    * **nixos/buildbot:** reap buildbot-nix gcroots that upstream's glob never matches ([0a62058](https://github.com/cameronraysmith/vanixiets/commit/0a62058b5803760ea239d8ce8614a11425883873))1235    * **nixpkgs:** expose flake packages only for supported systems ([cef64cc](https://github.com/cameronraysmith/vanixiets/commit/cef64cc79a300a0b52c294cef80da39df3ced625))1236    * **nixpkgs:** patch apm for SKILL_BUNDLE downloads ([855eba8](https://github.com/cameronraysmith/vanixiets/commit/855eba8a53dca01a08b1f44a748e78c4b2256303)), closes [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack)1237    * **nix:** replace retired CUDA binary cache ([69c0dff](https://github.com/cameronraysmith/vanixiets/commit/69c0dff7655a689e6e5b237742674e492a028e3c))1238    * **omnigent:** advertise registered ACP harness readiness ([421dcf2](https://github.com/cameronraysmith/vanixiets/commit/421dcf23c9c0a7edb0e7555544414c1068a690b8))1239    * **omnigent:** auto-approve worker OMP ACP tools ([32d5ffa](https://github.com/cameronraysmith/vanixiets/commit/32d5ffa221cbd8d949077e19d401718f596aa6fd))1240    * **omnigent:** avoid evaluator stack overflow in home guard ([a93430c](https://github.com/cameronraysmith/vanixiets/commit/a93430c2aef90f94d6eb1a88ae54cfcb82e8099c))1241    * **omnigent:** bind Darwin credential receipts to boot session ([2e4f3cc](https://github.com/cameronraysmith/vanixiets/commit/2e4f3cc71e84bd21cf7db5e5fd3529c67dc4d7bc))1242    * **omnigent:** create security sessions for Keychain workers ([d387509](https://github.com/cameronraysmith/vanixiets/commit/d3875091a466eebc054b7cca68d9266c07a4500a))1243    * **omnigent:** emit one script per worker credential generator ([d3e759c](https://github.com/cameronraysmith/vanixiets/commit/d3e759cf0bbc32fd8a73a0f269156c55ba57c874))1244    * **omnigent:** keep sops-rendered worker credentials out of home directories ([7984efc](https://github.com/cameronraysmith/vanixiets/commit/7984efc002d103d40853ebbcf5f8a4b60aea15c0))1245    * **omnigent:** omit platform-inapplicable worker checks ([2dfb253](https://github.com/cameronraysmith/vanixiets/commit/2dfb25332a523a29e18741f4a7a92fe016ea2be9))1246    * **omnigent:** relax openai cap for nixpkgs openai 2.53 ([83fff85](https://github.com/cameronraysmith/vanixiets/commit/83fff85e506fdd9f6e5beb9e5465e09910d44ce9))1247    * **omnigent:** resolve Linux worker groups by gid as well as name ([1bbac11](https://github.com/cameronraysmith/vanixiets/commit/1bbac11649a48fd1b1ea81c5fae961dd5ff2675e))1248    * **omnigent:** retire remaining legacy host services ([bebe0bc](https://github.com/cameronraysmith/vanixiets/commit/bebe0bc0beecd14cde8a5370ec4e8a20a04ddb43))1249    * **omnigraph:** assert apply convergence, bound restarts, add operator cluster cli ([0c11011](https://github.com/cameronraysmith/vanixiets/commit/0c110113e82851182fb8dc64351d330dac3a7fb5))1250    * **omnigraph:** fail startup fast and bootstrap new storage roots once ([3fb87c3](https://github.com/cameronraysmith/vanixiets/commit/3fb87c3881da98fe3f2b18b60ffeeccd9953f25a)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257)1251    * **omnigraph:** gate server start on readiness probe ([0904cf7](https://github.com/cameronraysmith/vanixiets/commit/0904cf74a2522ef957c33682f83b7ec7b8322eb6))1252    * **omnigraph:** pass --as only to actor-bound cluster subcommands ([faa2423](https://github.com/cameronraysmith/vanixiets/commit/faa24235406d455f0adde57b41920457b33195db))1253    * **omp:** adjust default model roles ([7c922cf](https://github.com/cameronraysmith/vanixiets/commit/7c922cf1d7719b0fe6772dd0481d7225bc6662d8))1254    * **openspec:** correct schema bundle provenance and drop the dead refresh recipe ([bdb104b](https://github.com/cameronraysmith/vanixiets/commit/bdb104b2946dae591111683e116072d10c4cdfe3))1255    * **openspec:** correct the cognee-memory-layer project id to its slugId ([73a5d0b](https://github.com/cameronraysmith/vanixiets/commit/73a5d0b6eed0a212b2daef38e00c3059fbfd5e7c))1256    * **openspec:** correct the fork and schemaDirs claims in the marketplace design ([2e7628d](https://github.com/cameronraysmith/vanixiets/commit/2e7628dba612fcbddae18464d1b4285de7199189))1257    * **openspec:** deliver schema directories as single symlinks ([801a73d](https://github.com/cameronraysmith/vanixiets/commit/801a73d931f0b6c09ee31a12233c591e81de4be4))1258    * **openspec:** make nixbot's world-assumptions delta a superset ([5fa7090](https://github.com/cameronraysmith/vanixiets/commit/5fa709073f2d450ecaae439f0208e1f69bbfaa3c))1259    * **openspec:** make the pre-install secrets gate fail closed ([54931cf](https://github.com/cameronraysmith/vanixiets/commit/54931cf3195c172f80678dba347c429b09e2453d))1260    * **openspec:** name the git-addressable projection path and correct archive ordering ([8687815](https://github.com/cameronraysmith/vanixiets/commit/86878157103fd2ca1d7d3aa6f7d33589418bf71a))1261    * **openspec:** point the irreversibility warning at task 7.12, not 7.9 ([b6ad271](https://github.com/cameronraysmith/vanixiets/commit/b6ad27185f6ec626cb1231b25d8a3c3a8a0a87c1))1262    * **openspec:** record the linear registry id as a slugId, not a defect ([41a1f7d](https://github.com/cameronraysmith/vanixiets/commit/41a1f7d105e9715531db1fea32ea9170cca9074d))1263    * **overlays/aeneas:** rebuild darwin charon from charon-unwrapped ([eabf3a9](https://github.com/cameronraysmith/vanixiets/commit/eabf3a9d14be3f666d00031565c1aef16ca9d069))1264    * **overlays:** use stdenv.hostPlatform predicates in stable fallbacks ([290017b](https://github.com/cameronraysmith/vanixiets/commit/290017b1d136e769dd50be06df52dce6bae41c81))1265    * **packages:** correct the llm-agents provenance comment ([f83341f](https://github.com/cameronraysmith/vanixiets/commit/f83341f661d6bc41442baeb625b765582b434c68))1266    * **pi-agent-extensions:** guard the direnv reload timer against a stale ctx ([7a9cfd1](https://github.com/cameronraysmith/vanixiets/commit/7a9cfd1f29b1976a7c43b98dc2a760ac29de0ee4))1267    * **pi:** block pi config package mutation ([d8eef7a](https://github.com/cameronraysmith/vanixiets/commit/d8eef7adb85ff4e7f63aec653aa0bb0b900835c0))1268    * **pi:** declare the compaction extension Pi-only at the package level ([534834c](https://github.com/cameronraysmith/vanixiets/commit/534834c0bce14f77ba88828c2c43e6de2e27c949))1269    * **pi:** fail closed on unclassified shell mutations ([e117efc](https://github.com/cameronraysmith/vanixiets/commit/e117efc3fc8fd25292dc92982596a3b0ef948575))1270    * **pi:** honor curl get negation order ([85278c9](https://github.com/cameronraysmith/vanixiets/commit/85278c9dcf876a3460489d671598f9be113641fd))1271    * **pi:** model jj development join correctly ([4fa2a0f](https://github.com/cameronraysmith/vanixiets/commit/4fa2a0f88ad26d2281c6daaed58362bc4b099352))1272    * **pi:** preserve recognized shell reads ([d12c8a1](https://github.com/cameronraysmith/vanixiets/commit/d12c8a155ad4c7bb1369db14bc101adc1ea9f962))1273    * **pi:** regenerate jj command inventory, model informational globals ([42944e1](https://github.com/cameronraysmith/vanixiets/commit/42944e145c49e8c4fbcc2fb445eff1a4818673cc))1274    * **pi:** treat a curl request body as mutating regardless of -X ([96f8b4b](https://github.com/cameronraysmith/vanixiets/commit/96f8b4be841c9dda2bc0cb453246f914989eadec))1275    * **pkgs/atomic:** keep the postgres symlink hydration idempotent ([2bf3cd6](https://github.com/cameronraysmith/vanixiets/commit/2bf3cd65888dd3a630184047887d8b6f247f0788))1276    * **pkgs/xsra:** harden update.sh for nix run .#update-xsra ([376c46b](https://github.com/cameronraysmith/vanixiets/commit/376c46bd6a23a825d070bc01ce392647fe4c215a)), closes [.#update-xsra](https://github.com/./issues/update-xsra)1277    * **pkgs:** build-verify uncomment-bin on every flake system it targets ([59e0124](https://github.com/cameronraysmith/vanixiets/commit/59e0124165015cd5f2e69dd29d3147d89cd7fe54))1278    * **pkgs:** disable git-repo-manager ([d6861c6](https://github.com/cameronraysmith/vanixiets/commit/d6861c68af77acaee89fb06e9481ba20923a65e5))1279    * **pkgs:** linear-cli — writable DENO_DIR so deno persists perf caches at runtime ([88dc7cd](https://github.com/cameronraysmith/vanixiets/commit/88dc7cd7547a67c0e03e25261068f339ee762490))1280    * **playwright-web-flake:** rebase on upstream ([acd019f](https://github.com/cameronraysmith/vanixiets/commit/acd019f6d750c0e8bc3a260366a7dd25433e994f))1281    * **pyrite:** bind keyboard illumination to the explicit DMS LED device ([eeb0bdf](https://github.com/cameronraysmith/vanixiets/commit/eeb0bdfae206bfde664df7645da08a96f3b53cfb))1282    * **pyrite:** bulk-disable PCIe d3cold before sleep (confirmed resume fix) ([a227253](https://github.com/cameronraysmith/vanixiets/commit/a22725304fd75f98c27d2ea0b48c571615a1245e))1283    * **pyrite:** correct the FIDO2 activation comment to the measured account ([937df26](https://github.com/cameronraysmith/vanixiets/commit/937df26a9524e481aac43a66a5d828ec711204e6))1284    * **pyrite:** correct the FIDO2 activation comments ([1e632ea](https://github.com/cameronraysmith/vanixiets/commit/1e632ea4d13675ff9a03afc83672727987719e32))1285    * **pyrite:** correct the FIDO2 activation comments to the observed unlock path ([a04fcf7](https://github.com/cameronraysmith/vanixiets/commit/a04fcf7c8746012ee41a78585e7e8f7afaedd665))1286    * **pyrite:** correct the recorded state-version var to 26.05 ([300a17d](https://github.com/cameronraysmith/vanixiets/commit/300a17d537b3fca42c067e85a39b1f6f51039ac1))1287    * **pyrite:** deduplicate the i915 kernel parameters ([3e14942](https://github.com/cameronraysmith/vanixiets/commit/3e1494271fc7e9fe6fb7eb723e072a936a089236))1288    * **pyrite:** disable initrd networking so brcmfmac stays out of stage 1 ([38e6973](https://github.com/cameronraysmith/vanixiets/commit/38e69739c1f0aac803c833a0669b3da0e0cba40e))1289    * **pyrite:** disable lid as S3 wake source (spurious auto-resume) ([ae60572](https://github.com/cameronraysmith/vanixiets/commit/ae60572fef4cc4772171d705899c1a3d26b3a3bc))1290    * **pyrite:** disable niri focus ring ([d579e26](https://github.com/cameronraysmith/vanixiets/commit/d579e260192322a4e0d26c2846e896505c14054f))1291    * **pyrite:** disable NVMe d3cold so suspend can resume, with panic-reboot fallback ([8f8a481](https://github.com/cameronraysmith/vanixiets/commit/8f8a481ab0668fa1c07096e14c6c8d4f23c15a17))1292    * **pyrite:** drop the defective --phases disko from task 7.3 ([b91d994](https://github.com/cameronraysmith/vanixiets/commit/b91d994b6da6e1d747eeaf4ec01664c48c8ec4fa))1293    * **pyrite:** integrate the Apple CS8409 initialization module ([460bce1](https://github.com/cameronraysmith/vanixiets/commit/460bce105704c8f3a3984d67f99c5da7d13ea9e1))1294    * **pyrite:** make firmware-closure decidability command runnable on pinned nixpkgs ([b1c6494](https://github.com/cameronraysmith/vanixiets/commit/b1c64941f637f54ec960835a9ee733c679265f3e))1295    * **pyrite:** override i915 psr/fbc/dc and disable nvme APST for resume ([1691a88](https://github.com/cameronraysmith/vanixiets/commit/1691a888fb9c386c2b4930e2eed60c4d4b2fc2bf))1296    * **pyrite:** persist the BCM UART wake omission at boot ([d028a65](https://github.com/cameronraysmith/vanixiets/commit/d028a6597cfd281507ef6b4157bc168a6e8f54df))1297    * **pyrite:** pin dms-src to the release tag of the packaged shell ([d0d917c](https://github.com/cameronraysmith/vanixiets/commit/d0d917c0655dcabe81703de5de9e99a6cd3bd136))1298    * **pyrite:** pin niri-flake by revision and derive its check ([952615c](https://github.com/cameronraysmith/vanixiets/commit/952615c075436a082745391d40c53b88f78087f2)), closes [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169)1299    * **pyrite:** point dms-greeter at its own package ([9e40eb3](https://github.com/cameronraysmith/vanixiets/commit/9e40eb30014e876ceaa87805d5325b9139477132))1300    * **pyrite:** regenerate the zfs passphrase var under the current generator ([6b51455](https://github.com/cameronraysmith/vanixiets/commit/6b51455729515d5ee8c511278d518750a5d1610d))1301    * **pyrite:** replace task 7.4's tautological zpool import check ([444fb38](https://github.com/cameronraysmith/vanixiets/commit/444fb388126892cc2ae6066de0eaae06db3ec973))1302    * **pyrite:** require the LTS ISO boot entry, the only one carrying zfs ([2cb7258](https://github.com/cameronraysmith/vanixiets/commit/2cb7258326fae33e9161e715dc0ae151e6bfd823))1303    * **pyrite:** set system timezone to America/New_York ([1aa80c6](https://github.com/cameronraysmith/vanixiets/commit/1aa80c6d31d7dc82160a3de44f8c5b0c84050652))1304    * **pyrite:** state the lid-handler comment as a decision, not a broken path ([602c621](https://github.com/cameronraysmith/vanixiets/commit/602c62138ae82e7970ed5e78d5e2c37b55cbdea0))1305    * **pyrite:** stop GNOME suspending on the power key ([31c2b60](https://github.com/cameronraysmith/vanixiets/commit/31c2b605ab702a5a56efb0eb5663b736a02240ce))1306    * **pyrite:** stop lid close from triggering broken suspend ([8df57f8](https://github.com/cameronraysmith/vanixiets/commit/8df57f8dccc4e132c43fa7bbf6ba99a6a8beb0d2))1307    * **python-lancedb:** package 0.36.0 to replace failing nixpkgs 0.32.0 ([b450633](https://github.com/cameronraysmith/vanixiets/commit/b4506337b3a82e74dde2117fb954c5c76aab5f72))1308    * **python-overrides:** remove pygame ([740edaa](https://github.com/cameronraysmith/vanixiets/commit/740edaa330c4d1bfcb16605dfb412608a0fe46bf))1309    * **quarto-bin:** declare openssl for Linux autoPatchelf (typst-gather) ([44ef515](https://github.com/cameronraysmith/vanixiets/commit/44ef5155d6e81f52d8fb6ab30c74f9899740c62f))1310    * **radicle:** correct cinnabar seed pairs and bump radicle-desktop ([bcfc663](https://github.com/cameronraysmith/vanixiets/commit/bcfc66325e7c83fb80cc39fbf9baec8dd856ee05))1311    * **renovate:** group astro with starlight, and regenerate the tree ([d1efe6c](https://github.com/cameronraysmith/vanixiets/commit/d1efe6c8e85b06b82cdfdebc8482d60acf795264)), closes [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913) [#2881](https://github.com/cameronraysmith/vanixiets/issues/2881) [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913)1312    * **renovate:** track every github flake input ref, not only playwright ([cdcd4c3](https://github.com/cameronraysmith/vanixiets/commit/cdcd4c336700adfa3b5f01b4fa002e656f342680))1313    * **secrets:** add codeberg ([15f3bf8](https://github.com/cameronraysmith/vanixiets/commit/15f3bf8f12fbe77804b2939dce242ffe6b583505))1314    * **secrets:** add nostr id ([2f2e686](https://github.com/cameronraysmith/vanixiets/commit/2f2e68651101629fcbbdd997458015db0df80071))1315    * **secrets:** cover .enc files in the update-all-keys recipe ([e986485](https://github.com/cameronraysmith/vanixiets/commit/e9864855081f6d54d22b9d2cc131f43740017028))1316    * **secrets:** enroll janettesmith signing key ([0aa505a](https://github.com/cameronraysmith/vanixiets/commit/0aa505afeb7348dfe2ce7980e101b01cb218a3f9))1317    * **shell-aliases:** add ca = "claude attach" ([e8a23e3](https://github.com/cameronraysmith/vanixiets/commit/e8a23e3dd7f5ba7aa2ffab44e3a9bde7ed371b75))1318    * **skills/agentic-planning:** runnable-command and external-tool-contract fixes ([dee3381](https://github.com/cameronraysmith/vanixiets/commit/dee33819f667de85cc3c4e01f742c9145385b5f5))1319    * **skills/jj-version-control:** correct route-and-extend recipe to canonical wip-on-top structure with --keep-emptied, remove single-commit-join misapplication ([34d1bbf](https://github.com/cameronraysmith/vanixiets/commit/34d1bbf474113eff929d2537523ffd839cb93eb4))1320    * **skills/jj:** correct squash flag guidance against jj 0.43.0 ([4a5d9f7](https://github.com/cameronraysmith/vanixiets/commit/4a5d9f72291f9305cf3eaa078607e135a07fdc61))1321    * **skills/jj:** correct the conflict() revset to conflicts() ([8b8f174](https://github.com/cameronraysmith/vanixiets/commit/8b8f1745cc8c553a9cb94bca04f3536106398cbc))1322    * **skills/jj:** make the rebase pair canonical for join add and remove ([fb11d5d](https://github.com/cameronraysmith/vanixiets/commit/fb11d5de2a5118586587ed4a0d4db089162615d9))1323    * **skills/jj:** replace the all: revset modifier removed in jj 0.38.0 ([b20100f](https://github.com/cameronraysmith/vanixiets/commit/b20100faad1fae5cf952b98a0cfe31c64fc6b727))1324    * **skills/meta-session-resume:** allow automatic invocation ([6bd801b](https://github.com/cameronraysmith/vanixiets/commit/6bd801b953356e2238502c71995895fc868f7099))1325    * **skills/openspec-linear-sync:** generalize operator-specific dependency note; record coupling in nix layer ([b3dc0b3](https://github.com/cameronraysmith/vanixiets/commit/b3dc0b3bc9fe5104044dabf30e023a78711d8fba))1326    * **skills:** align openspec-linear-sync consumer references to the monorepo registry + frontmatter ledger ([9f9ce11](https://github.com/cameronraysmith/vanixiets/commit/9f9ce11e3a612584473565316bc9e6a261e736d1))1327    * **skills:** code-comment minimization directive (skills + agents-md body) ([e662859](https://github.com/cameronraysmith/vanixiets/commit/e662859795e75707262a51ec7b01dbda4aea86af))1328    * **skills:** correct dependency-source-acquisition escalation guidance ([f0c1448](https://github.com/cameronraysmith/vanixiets/commit/f0c1448daa9e2b05bef08b737368a70654059625))1329    * **skills:** make checkpoint metadata valid YAML ([2d8d18a](https://github.com/cameronraysmith/vanixiets/commit/2d8d18a82c826cafe92eb287997ea83592ead5ff))1330    * **skills:** make dependency-source-acquisition frontmatter strict-YAML parseable ([4f57636](https://github.com/cameronraysmith/vanixiets/commit/4f57636ff439f2be42014de71b693f4d4dd11fc4))1331    * **skills:** preserve executable modes for Codex ([3e87528](https://github.com/cameronraysmith/vanixiets/commit/3e87528f72a713678bbb89705f8c203125948295))1332    * **skills:** quote portable argument hints ([df464a1](https://github.com/cameronraysmith/vanixiets/commit/df464a1eea0e0cfabdb02bc7ee31b0a3a6215c31))1333    * **skills:** replace the all: revset modifier outside the jj corpus ([46ff49d](https://github.com/cameronraysmith/vanixiets/commit/46ff49d861e05863fd4b1cfb048c3ec282e07735))1334    * **skills:** restore reconciliation duty content to verbatim canonical source ([9d879e8](https://github.com/cameronraysmith/vanixiets/commit/9d879e88811915b788463d4355dcc12a439c2390))1335    * **skills:** restore three companion rules to verbatim canonical source ([63cc1b4](https://github.com/cameronraysmith/vanixiets/commit/63cc1b4c473035946b442d8aacc45e40fc69b2d4))1336    * **skills:** restore turn-ordering mitigations 3-5 to verbatim canonical source ([6943aa7](https://github.com/cameronraysmith/vanixiets/commit/6943aa70fc89f5c95209fe6e268aafff5ad9bf69))1337    * **skills:** shorten Nucleus skill description ([2ce927a](https://github.com/cameronraysmith/vanixiets/commit/2ce927afe88cccb6d0a4cab9cdc96503514f192d))1338    * **skills:** stop routing third-party repos into the maintained tree ([72f3f1c](https://github.com/cameronraysmith/vanixiets/commit/72f3f1c1a72dda8056450e819c5b29201cd8ca0e))1339    * **stack-land:** accept non-blocking check states ([47ca9d8](https://github.com/cameronraysmith/vanixiets/commit/47ca9d8dec2cf10a985e8e6587e10a87c3df741b))1340    * **stibnite:** declare trusted users ([1ac1551](https://github.com/cameronraysmith/vanixiets/commit/1ac1551ed72403274e9e548198a4c599f6469228))1341    * **stibnite:** pin nix conf hash ([ca89c14](https://github.com/cameronraysmith/vanixiets/commit/ca89c14340d164664d1043fc9e07c50b2cef9bf3))1342    * **stibnite:** pin nixbld gid 350 ([37f3d07](https://github.com/cameronraysmith/vanixiets/commit/37f3d077b454904b4c466b5d997603df1aff1e14))1343    * **stibnite:** restore kvm on the rosetta builder, advertised for TCG ([a59cd31](https://github.com/cameronraysmith/vanixiets/commit/a59cd31c9f162bd02ba675f3fa472173c38dbbc0))1344    * **stibnite:** scope the rosetta builder kvm claim to aarch64-linux ([18597d6](https://github.com/cameronraysmith/vanixiets/commit/18597d6990db9ad02ada7bd225fe2d0e220b9a93))1345    * **terranix:** track google provider 8.x ([12a869d](https://github.com/cameronraysmith/vanixiets/commit/12a869dee328463c6ea557561c4c520d396d8f50))1346    * **texlive:** texlive.combine -> texliveSmall.withPackages ([c393eb3](https://github.com/cameronraysmith/vanixiets/commit/c393eb35645aee10b5e1d946a84a35707093af8b))1347    * **tmux:** enable focus-events for terminal focus tracking ([3a16ef3](https://github.com/cameronraysmith/vanixiets/commit/3a16ef34cbf540991e44f0b4347e90d35181b571))1348    * **updaters:** resolve package paths from repository root ([7f91baf](https://github.com/cameronraysmith/vanixiets/commit/7f91bafb3579ef00484d0961e7baa23507b1c337))1349    * **wezterm:** stop masking Shift+Enter for omp kitty protocol ([623ec73](https://github.com/cameronraysmith/vanixiets/commit/623ec732430b9ea37bf3dd361d3a86f0486456e8))1350    * **wezterm:** use bundled default font stack, size 12 ([302bebb](https://github.com/cameronraysmith/vanixiets/commit/302bebb163c4db7939803ce4ff3fc382d5942ed4))1351    * **workflows:** accept Atomic's real model-catalog shape in stand-up-gitea-mq preflight ([f7a2e73](https://github.com/cameronraysmith/vanixiets/commit/f7a2e73a96dd018bbbfc970e56d836c823b94e05))1352    * **workflows:** accept both DNS record name forms and contain plan state ([ff92e6f](https://github.com/cameronraysmith/vanixiets/commit/ff92e6fd4c42a2cbd16200a5a07acec1a56e7f3f))1353    * **workflows:** activate Linux hosts from the locally built closure ([a39f15a](https://github.com/cameronraysmith/vanixiets/commit/a39f15a2d8fae8a6582e531dacfe207ed8a44ca8))1354    * **workflows:** bridge native structured-output exhaustion and confine App tokens ([d59a90a](https://github.com/cameronraysmith/vanixiets/commit/d59a90ad5818f012730f7502b10f2d208dc2c42c))1355    * **workflows:** close stand-up-gitea-mq review findings before launch ([55f496f](https://github.com/cameronraysmith/vanixiets/commit/55f496f5120ee8a818069a01af8dac92309bcd1e))1356    * **workflows:** defer the forge ExecStartPre comparison until both sides are committed ([656c061](https://github.com/cameronraysmith/vanixiets/commit/656c0618d8c2db9da078e92d34ae02de7a42e3b1))1357    * **workflows:** harden stand-up-gitea-mq proposal, DNS routing, and report paths ([3a66612](https://github.com/cameronraysmith/vanixiets/commit/3a66612cfdfbbfa4172ecdcfc3d9448614912b73))1358    * **workflows:** isolate App token minting and bound ruleset draft repair ([b9d04fa](https://github.com/cameronraysmith/vanixiets/commit/b9d04fac2aa14a9d41bcec4b530c70adc2440e1f))1359    * **workflows:** keep terraform failures diagnosable while withholding plan state ([a0a4d5e](https://github.com/cameronraysmith/vanixiets/commit/a0a4d5eb86659df061f6bd1b542c1c77d3fdd25b))1360    * **workflows:** let stand-up-gitea-mq preflight tolerate foreign edits in the shared wip ([ecb6afa](https://github.com/cameronraysmith/vanixiets/commit/ecb6afaeaa317d361be136a6ef02b62b2daefc3f))1361    * **workflows:** make stand-up-gitea-mq runs viable and resumable ([3fdb937](https://github.com/cameronraysmith/vanixiets/commit/3fdb93773e0ee4ecf79d751955bac223598ba37e))1362    * **workflows:** never regenerate an existing credential, and scope the clan backstop ([d02919e](https://github.com/cameronraysmith/vanixiets/commit/d02919e70e289d3315d96226c85354cc3654487d))1363    * **workflows:** pair chain and integrated preservation baselines ([065484e](https://github.com/cameronraysmith/vanixiets/commit/065484e22a820e1218fec2b73699a384ee03ee84))1364    * **workflows:** permit derived github.user in Janette identity gate ([6f7dfb2](https://github.com/cameronraysmith/vanixiets/commit/6f7dfb2569763201499a1ccf2bc7ea10afbd395f))1365    * **workflows:** probe clan availability with a flag the installed CLI accepts ([b203bb3](https://github.com/cameronraysmith/vanixiets/commit/b203bb3a5747eabd70b9fd234d030155bde878e2))1366    * **workflows:** project Janette and Darwin worker homes in preservation gates ([de20266](https://github.com/cameronraysmith/vanixiets/commit/de20266153fa1445f877d1b0d13022e11f48f55c))1367    * **workflows:** project observations before they reach a checkpoint ([51090f2](https://github.com/cameronraysmith/vanixiets/commit/51090f29be1b624de8220b43e0a59e69cb64301c))1368    * **workflows:** prove the pre-S1 forge baseline and revalidate after change edits ([734b639](https://github.com/cameronraysmith/vanixiets/commit/734b639aae5463ff375bac2bfb06fcac419cb29c))1369    * **workflows:** read Atomic current model through its actual API ([6adfd41](https://github.com/cameronraysmith/vanixiets/commit/6adfd410a399337087227a7045b9e427124a312a))1370    * **workflows:** require only subscribable events in the app contract ([4e4047f](https://github.com/cameronraysmith/vanixiets/commit/4e4047f2a5a1305c248a8d8415c4999a1ace9c70))1371    * **workflows:** resolve the terraform source at use time and keep evidence outside the repo ([b281027](https://github.com/cameronraysmith/vanixiets/commit/b281027baa6d0fcf4f0baa022426e3056bfb57e1))1372    * **workflows:** respect disabled Home Manager file sources ([2cdc1e7](https://github.com/cameronraysmith/vanixiets/commit/2cdc1e74a7a03099235dbb4c1d7d70368eb8a303))1373    * **workflows:** scope credential-listing parsing to this workflow's own vars ([100967e](https://github.com/cameronraysmith/vanixiets/commit/100967ed545277f16e344a1c8c3dd76a745476ac))1374    * **workflows:** scope stand-up-gitea-mq drift guards to the workflow's own paths ([a9ce405](https://github.com/cameronraysmith/vanixiets/commit/a9ce405605a32f0941409ac2eb363955bb803bb6))1375    * **workflows:** tolerate foreign divergence in the shared working copy ([8df333c](https://github.com/cameronraysmith/vanixiets/commit/8df333c806a38b263f4634341981fd75821e8d1b))1376    * **workflows:** treat an already-applied dns record as success ([928e1f9](https://github.com/cameronraysmith/vanixiets/commit/928e1f9d994239c4b5f43f3699ddebb8680a5cc2))1377    * **workflows:** verify dns and service reachability against public resolvers ([422e6dc](https://github.com/cameronraysmith/vanixiets/commit/422e6dc044c169b10f13ceda0df679f9958a70fe))1378    * **workflows:** verify pinned worker model against the catalog ([61401b2](https://github.com/cameronraysmith/vanixiets/commit/61401b2b05b07e0d0045b27917a05ae27fd871d8))1379    * **zerotier:** migrate stibnite machine ID and IP ([ba2cbaa](https://github.com/cameronraysmith/vanixiets/commit/ba2cbaab7a4c6407022db51019b05374be080f09))13801381### Features13821383    * aeneas + charon + elan for stibnite host; drop home-manager lean4 ([d308362](https://github.com/cameronraysmith/vanixiets/commit/d3083620864d357488577990b65bbc726b2d43a6))1384    * **agent-skills:** proxy mergify stack skill ([1b0c76d](https://github.com/cameronraysmith/vanixiets/commit/1b0c76d064316cfee52d2dcdcc13bb12cfad3532))1385    * **agents-md:** adopt communication rules and long-running command capture ([7e68e32](https://github.com/cameronraysmith/vanixiets/commit/7e68e3262869e54568495903886e14c4e0f6a0d8))1386    * **agents-md:** slim claude.md orchestrator-mode stub ([54f2362](https://github.com/cameronraysmith/vanixiets/commit/54f2362eb586d99ac59c32b25c0ae901b7317d27))1387    * **agents:** add the vanixiets context tier ([fdeb11c](https://github.com/cameronraysmith/vanixiets/commit/fdeb11c924c1c279fce299f78932f683e83b6309))1388    * **agents:** compose the agent context on devShell entry ([716713a](https://github.com/cameronraysmith/vanixiets/commit/716713adf23366ba618576b5e317c083182ee816))1389    * **agents:** compose the repository context file from the fragments ([0cca178](https://github.com/cameronraysmith/vanixiets/commit/0cca17899534b4c83b1b7e7df5bff8c561c642cd))1390    * **agents:** extract fleet and repository-class context into apm packages ([70fa35c](https://github.com/cameronraysmith/vanixiets/commit/70fa35cedeb26aeaf02ef89c3ca6f86ca89372c0))1391    * **agents:** materialize marketplace skills into git-ignored .agents/ ([953b0ff](https://github.com/cameronraysmith/vanixiets/commit/953b0ff9c19236fc6ad8b1be4820768b7ca1d5ad))1392    * **agents:** refresh the openwiki wiki from a just recipe ([8935581](https://github.com/cameronraysmith/vanixiets/commit/8935581ed850a13ff33426b100fbf0d3a519daa9))1393    * **agents:** relock to deliver the mergify-stack skill ([fcf0253](https://github.com/cameronraysmith/vanixiets/commit/fcf0253f52365b6065e8ffb3c4258d81f201e695))1394    * **ai:** add tuicr code review TUI to the home-manager ai aggregate ([0f5980a](https://github.com/cameronraysmith/vanixiets/commit/0f5980a2c85e1647d2228313e47a6e491d65afd4))1395    * **ai:** allocate Opus 5.5 across claude-code and omp ([63b7b43](https://github.com/cameronraysmith/vanixiets/commit/63b7b43da364d995bc259f517f301be708e4f2ec))1396    * **ai:** compose Playwright skills through shared APM capabilities ([66a3036](https://github.com/cameronraysmith/vanixiets/commit/66a30360362d903ec3119b3fc733ace8b06b7522))1397    * **ai:** enable pi-vim modal editing for pi only ([848909e](https://github.com/cameronraysmith/vanixiets/commit/848909e5494e541a64f01da891ffbf2057cf8f17))1398    * **apm-skills-marketplace:** /opsx:* → openspec-* skill-form ripple (router + bridge docs); config.yaml default schema=superpowers-bridge ([58d246a](https://github.com/cameronraysmith/vanixiets/commit/58d246abb48814cfd1189a6562b708af6da1cb10))1399    * **apm-skills-marketplace:** experiment with MARKETPLACE_PLUGIN + .apm/skills + producer pack + dual-manifest ([17a30df](https://github.com/cameronraysmith/vanixiets/commit/17a30df4673bbc059134eaabe5343a633f6fa3d8))1400    * **apm-skills-marketplace:** generalize apm-skills-compose over 17 packages + superpowers; neutralize formal-spec [@alias](https://github.com/alias) devDep blocking apm install ([da6263e](https://github.com/cameronraysmith/vanixiets/commit/da6263eb68796f3b1d99f317df6adb095e99303d))1401    * **apm-skills-marketplace:** manifests — dep edges, producer marketplace, taxonomy ([0c8a430](https://github.com/cameronraysmith/vanixiets/commit/0c8a43047a03c374381b57f08bfa649d3f028770))1402    * **apm-skills-marketplace:** OpenSpec delivery=skills; drop /opsx:* commands + assets/commands; Migration-Plan coherence ([f1b64ad](https://github.com/cameronraysmith/vanixiets/commit/f1b64ad3b45b84f187ef55a32b5c1f46b9bd0b43))1403    * **apm-skills-marketplace:** parameterize apm-skills-compose via typed aiSkills options ([0efe448](https://github.com/cameronraysmith/vanixiets/commit/0efe4489f4c957a19028cd5a548582d755fb6595))1404    * **apm-skills-marketplace:** regenerate vendored OpenSpec skills at 1.5.0 (delivery=skills) ([94efe73](https://github.com/cameronraysmith/vanixiets/commit/94efe73fe1b6afa181accbfa35e19a9a71577fc8))1405    * **apm-skills-marketplace:** restructure 104 skills into 17 apm packages ([b13d561](https://github.com/cameronraysmith/vanixiets/commit/b13d5614a5baddd84eda5bd713a9cf4268414631))1406    * **apm-skills-marketplace:** spike hermetic apm+nix compose ([411d2df](https://github.com/cameronraysmith/vanixiets/commit/411d2dfd9c138493e880f1541155156edaa70b7d))1407    * **apm-skills-marketplace:** superpowers as a regular remote apm dep resolved offline via git-cache pre-warm; drop superpowers-src ([11b1f3c](https://github.com/cameronraysmith/vanixiets/commit/11b1f3c77df052e95f61bb94ca6a7d46e67041be))1408    * **apm-skills-marketplace:** vendor the 11 OpenSpec skills into planning-and-development; drop extraSkillDirs; retarget refresh app per-skill ([012b014](https://github.com/cameronraysmith/vanixiets/commit/012b014bd5c0b9e0aa83997b316dd77908a68136))1409    * **apps/update:** add update-beads parity entry ([6c58cd7](https://github.com/cameronraysmith/vanixiets/commit/6c58cd796a0ce0cb5fc84849260216b7973b444a))1410    * **apps/update:** add update-dolt parity entry ([c9782b7](https://github.com/cameronraysmith/vanixiets/commit/c9782b770e59cffed31ffd6988ec57c5685e2a24))1411    * **apps:** add cognee-agentskills cognee dataset refresh flake app ([f749714](https://github.com/cameronraysmith/vanixiets/commit/f749714661ca379e83bd652920ed8bea7ce554b0))1412    * **apps:** add openspec-refresh-vendored-artifacts flake app ([c473372](https://github.com/cameronraysmith/vanixiets/commit/c4733727e82da6f395b0ba575bbc0baec508c33e))1413    * **apps:** apm-marketplace consumer-path validation flake-app ([30d6571](https://github.com/cameronraysmith/vanixiets/commit/30d65718687c779f3a7769fbbecb5e0ad7637a21))1414    * **apps:** bootstrap a home profile from a remote flake ref ([4a3afb0](https://github.com/cameronraysmith/vanixiets/commit/4a3afb08f58634be6e1cfa0c3742ebe8691b877c))1415    * **apps:** expose the atomic update script as a flake app ([6c84d6d](https://github.com/cameronraysmith/vanixiets/commit/6c84d6dfeec800ffcafb1cd6058a4ac097247e75))1416    * **apps:** expose update-buzz-source ([04a2522](https://github.com/cameronraysmith/vanixiets/commit/04a25223f0814788a81b41c655031afe6751d970))1417    * **atomic:** declare pi-only extension scope for inherited extensions ([9bebce6](https://github.com/cameronraysmith/vanixiets/commit/9bebce6ca2946f508c9595426ac3e3bb5c14446c))1418    * **atomic:** manage settings.json with a merging activation ([eb13f0a](https://github.com/cameronraysmith/vanixiets/commit/eb13f0aa7ee0f3f0fac4ba9d5c162ea569b0e910))1419    * **atomic:** use Opus 5.5 instead of Opus 5 ([43906c2](https://github.com/cameronraysmith/vanixiets/commit/43906c25f9f609394331da181185dec388f2e14d))1420    * **bootstrap:** add uninstall-nix target ([d195bb6](https://github.com/cameronraysmith/vanixiets/commit/d195bb61f7e73d849de60965e5798c6678cd7702))1421    * **brand:** add modules/brand with flake.brand.logo asset for downstream NixOS modules ([3d6f727](https://github.com/cameronraysmith/vanixiets/commit/3d6f7272b44891dd78c67bc0507f35a2927aab33))1422    * **buildbot:** add Restart=always to buildbot-master and buildbot-worker ([3e25edd](https://github.com/cameronraysmith/vanixiets/commit/3e25edddce027548a7117ec76bb78252624fa8ec))1423    * **buildbot:** install buildbot-effects cli system-wide ([5b3e823](https://github.com/cameronraysmith/vanixiets/commit/5b3e823e8cf183422638bdb07509261d2ac144d3))1424    * **buildbot:** stop admitting sciexp/ironstar ([e8921a2](https://github.com/cameronraysmith/vanixiets/commit/e8921a24868caa70ac4810baccee9350bd819a07))1425    * **buildbot:** stop serving vanixiets, keep serving ironstar ([aeea35a](https://github.com/cameronraysmith/vanixiets/commit/aeea35abc90a4f9f04b554cf37ecbe199a07a766))1426    * **ccstatusline:** add layout variant toggle with simplified 1-line experiment ([7d5ba1d](https://github.com/cameronraysmith/vanixiets/commit/7d5ba1d70047cf0301a54669c125c9e752a9b2ec))1427    * **ccstatusline:** drop model segment from simplified variant ([8bbf7c3](https://github.com/cameronraysmith/vanixiets/commit/8bbf7c38068738c41f1ebd169d40a26a3120a9a2))1428    * **ccstatusline:** replace git-worktree+git-branch with short HEAD sha in simplified variant ([5c10d3e](https://github.com/cameronraysmith/vanixiets/commit/5c10d3ee5e06150adf63fb5216e3ee4415a443cf))1429    * **ccstatusline:** switch cwd to fishStyle in both layout variants ([c4608b2](https://github.com/cameronraysmith/vanixiets/commit/c4608b2afeaeb7145e91c7efb33c9a653a697501))1430    * **checks/machines:** include scheelite in nixos-* check coverage ([8ddff0b](https://github.com/cameronraysmith/vanixiets/commit/8ddff0b88683d60831ff93f2063d18ed6fb9fd91))1431    * **checks/machines:** programmatic per-system derivation, add darwin builds ([47d6cab](https://github.com/cameronraysmith/vanixiets/commit/47d6cab5d739c247e10c71e9d15475d120b5ccca))1432    * **checks:** add per-package and per-package-test re-exports ([f055844](https://github.com/cameronraysmith/vanixiets/commit/f0558448bd7916f4641ff282097e00a95d2735c6))1433    * **checks:** evaluate and build every flake app per system ([943482b](https://github.com/cameronraysmith/vanixiets/commit/943482bcbc7246af3feaf3d892e9bfe19bc49b46))1434    * **checks:** pin home.packages names per user ([26205b6](https://github.com/cameronraysmith/vanixiets/commit/26205b609497d4cd196b65213388ab7709279285))1435    * **checks:** regulate cilium, gateway-api, and k3s version coupling ([8217010](https://github.com/cameronraysmith/vanixiets/commit/821701072c56f0b95ca3595abf42b53b88be74e4))1436    * **checks:** validate the renovate config and expose renovate in the devshell ([0687da5](https://github.com/cameronraysmith/vanixiets/commit/0687da50613191567e683709e951aa1c36767dbf)), closes [hi#fidelity](https://github.com/hi/issues/fidelity)1437    * **chrome-devtools-axi:** package 0.1.29 as a by-name derivation ([4aff2f5](https://github.com/cameronraysmith/vanixiets/commit/4aff2f5885f8dfc257f3d892c20644618dc7efce)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi)1438    * **cinnabar/caddy:** add hermes.zt reverse-proxy to dashboard ([e99e918](https://github.com/cameronraysmith/vanixiets/commit/e99e91813d806b29200cf79c5cd2434dd95f2a15))1439    * **cinnabar/hermes-agent:** default to z-ai/glm-5.1 via OpenRouter + mono dashboard theme ([e750589](https://github.com/cameronraysmith/vanixiets/commit/e7505898aaf130b061a6b4e292e52e8795a66371))1440    * **cinnabar/hermes-agent:** wire matrixHomeserverUrl to colocated tuwunel ([44d6679](https://github.com/cameronraysmith/vanixiets/commit/44d66790a0fbcc6d3cff58ee5719229ddbbdbf6b))1441    * **cinnabar/inventory:** instantiate hermes-agent clan-service ([59c4b09](https://github.com/cameronraysmith/vanixiets/commit/59c4b0970ccebcd06f56e12b19cb204cdcd2c46b))1442    * **cinnabar/matrix:** register hermes matrix user ([f408aa1](https://github.com/cameronraysmith/vanixiets/commit/f408aa1aaa46c0769a0ad6efdb20668b42131bf2))1443    * **cinnabar/zt-dns:** add hermes.zt DNS records (IPv6 + IPv4) ([7ce6a0b](https://github.com/cameronraysmith/vanixiets/commit/7ce6a0b202ecf8d1638991af0f506b26ee8191bb))1444    * **clan-service:** scaffold hermes-agent wrapper module ([667e667](https://github.com/cameronraysmith/vanixiets/commit/667e6673b588fb902740ff31f75c17845bdac814))1445    * **clan/hermes-agent:** add 'matrix' to extraDependencyGroups for mautrix-python ([5ad73a3](https://github.com/cameronraysmith/vanixiets/commit/5ad73a3eaa8c180e2d354869e2b109d355036419))1446    * **clan/hermes-agent:** configure OpenRouter→openai/gpt-5.5 fallback ([bd4ca2e](https://github.com/cameronraysmith/vanixiets/commit/bd4ca2e9b8b4ec2329168bbfbc0c65ecf7263c56))1447    * **clan/hermes-agent:** enable holographic local memory provider ([a976d56](https://github.com/cameronraysmith/vanixiets/commit/a976d56e78b65a99c5b7daa57d32685fe79c4f62))1448    * **clan/hermes-agent:** expose CLI via addToSystemPackages ([a6e2f8a](https://github.com/cameronraysmith/vanixiets/commit/a6e2f8a7075ff061a968aab46d6ea897f8a219b5))1449    * **clan/hermes-agent:** expose homeRoom option and set "cron" room as matrix home channel ([bd80fdc](https://github.com/cameronraysmith/vanixiets/commit/bd80fdc90dd88c4d60474d20b2aaa59b90567a6f))1450    * **clan/hermes-agent:** expose matrixHomeserverUrl setting with loopback default ([a8c8f66](https://github.com/cameronraysmith/vanixiets/commit/a8c8f661315f68de9fa9b9705335fdef465f1f71))1451    * **clan/hermes-agent:** flip operationally-critical defaults for headless gateway ([8a227bb](https://github.com/cameronraysmith/vanixiets/commit/8a227bb8eb745904b0078af7b18a20b8ebdda3e1))1452    * **clan/hermes-agent:** wire channelsAllowlist into matrix settings deep-merge ([e0bc00f](https://github.com/cameronraysmith/vanixiets/commit/e0bc00f04956123289850ccc1f77d5263a03ccef))1453    * **clan/hermes-agent:** wire skills.external_dirs to ~/.hermes/external-skills ([3b30884](https://github.com/cameronraysmith/vanixiets/commit/3b30884567fdf0f65fbbdb3426c62790c0bb5ce0))1454    * **clan:** replace per-machine builder modules with a nix-builders service ([1f817ce](https://github.com/cameronraysmith/vanixiets/commit/1f817ce55e449026c169c51d0db567d1c335fb93))1455    * **claude-code/hooks:** register worktree-gate and diamond-verify hooks ([9a52a75](https://github.com/cameronraysmith/vanixiets/commit/9a52a75b3ed425ea9c74bee0e73a5298a0ab9bde))1456    * **claude-code:** default to auto permission mode, skip confirmation prompt ([06ddd81](https://github.com/cameronraysmith/vanixiets/commit/06ddd81b6525337d32ab143fcab997c0b5665213))1457    * **claude-code:** default to Opus 5.5 instead of Fable ([77ce242](https://github.com/cameronraysmith/vanixiets/commit/77ce2424d98d0134cba87f84f13d5b0badfcb9c9))1458    * **claude-code:** disable linear MCP plugin in favor of linear-cli ([009fad5](https://github.com/cameronraysmith/vanixiets/commit/009fad5e7815ebd5a8e2937e363a7d218afbe1dc))1459    * **claude-code:** make ccds an explicit --permission-mode auto alias ([290281c](https://github.com/cameronraysmith/vanixiets/commit/290281c8f0ec983a43383f3063f448c6ae059707))1460    * **claude-code:** pin and enable cognee-memory marketplace plugin ([4ea02eb](https://github.com/cameronraysmith/vanixiets/commit/4ea02eb495719e6a4ad48ad03e9dc8f89c36a324))1461    * **cli:** share portable capabilities with Omnigent workers ([87a35ff](https://github.com/cameronraysmith/vanixiets/commit/87a35ff98476aeedb5b2d8a99f97380f70dce547))1462    * **codex/mutable-settings:** mirror claude-code's mutable-config pattern ([610ffb2](https://github.com/cameronraysmith/vanixiets/commit/610ffb20deb94c6537a6a49ebfd486db9de4c017))1463    * **cognee/cli:** deliver quiet cognee SaaS wrapper + raw cognee-cli escape hatch ([e2e2b38](https://github.com/cameronraysmith/vanixiets/commit/e2e2b380404fc9368693ffaf97a012e87f0eeef9))1464    * **cognee/client:** drop MCP client, deliver plugin env + per-host X-Api-Key ([cf28aa7](https://github.com/cameronraysmith/vanixiets/commit/cf28aa7c476bcb054d8044cfc0e8c8415c29f7a5))1465    * **cognee:** add cognee-nix flake input and overlay ([87ba823](https://github.com/cameronraysmith/vanixiets/commit/87ba8231088a98a3c3ff504c63269072ef2b10ec))1466    * **cognee:** add global cognee-cli wrapper baking mesh api-url + per-host key ([6d10d30](https://github.com/cameronraysmith/vanixiets/commit/6d10d30418ae6806b494d48ef402d6fa7cc7f4e8))1467    * **cognee:** attach to magnetite and add ZFS dataset ([a287e25](https://github.com/cameronraysmith/vanixiets/commit/a287e254b3657758bea18985b3943d06bac59f52))1468    * **cognee:** bespoke ports 9270/9271, loopback API, enable server-side http MCP ([34db6cd](https://github.com/cameronraysmith/vanixiets/commit/34db6cd558a9fa7f9939ebee4218bb7282c78033))1469    * **cognee:** bind REST to ZeroTier, require auth, drop MCP, gate binds ([d6486a4](https://github.com/cameronraysmith/vanixiets/commit/d6486a41071ae5f07de2516c20b435a9a7eb8f3c))1470    * **cognee:** deliver stibnite per-host X-Api-Key via sops home-manager secret ([b8ba588](https://github.com/cameronraysmith/vanixiets/commit/b8ba5881e6336a840587e20585bcbf555c63ae4b))1471    * **cognee:** enable frontend on loopback + runtime backend env behind sso-gateway ([c107a8c](https://github.com/cameronraysmith/vanixiets/commit/c107a8cd15a3a446138e7804fa87176d8fa720c8))1472    * **cognee:** local http MCP client config (~/.mcp/cognee.json) ([44a0d17](https://github.com/cameronraysmith/vanixiets/commit/44a0d174cb6fd7ce596e4f7a47e43c3833522b57))1473    * **cognee:** magnetite service module with clan-vars secrets and resource caps ([d7d7de5](https://github.com/cameronraysmith/vanixiets/commit/d7d7de5cbb1b97dcc03a2a592e1dea00ba452388))1474    * **cognee:** seed flake.lib.hosts registry + derived flake.lib.cognee source of truth ([30b8b7b](https://github.com/cameronraysmith/vanixiets/commit/30b8b7b9e3dd2b75b7e0c29e2cba47f2b051e49a))1475    * **commands/dev:** add claude-sessions-live for live session enumeration ([12a605e](https://github.com/cameronraysmith/vanixiets/commit/12a605e8e78e570f9f528f943e1974ca545090be))1476    * **commands:** add ts-restore ([c16b2b3](https://github.com/cameronraysmith/vanixiets/commit/c16b2b33a64299ca6a2695d32976e37d47a851fa))1477    * **context:** add operating-principles section, factor task-scoped prose out of agents-md body ([e388625](https://github.com/cameronraysmith/vanixiets/commit/e3886254175131a63500b513f53669b98d251e0f))1478    * **context:** integrate the discharge obligation into agent context ([424efcc](https://github.com/cameronraysmith/vanixiets/commit/424efcce45dc3f20b8e2f3c9a204132fd01ee7d0))1479    * **darwin:** declare per-host sshd posture as an operator claim ([323adbb](https://github.com/cameronraysmith/vanixiets/commit/323adbba6c010be579d56e963155e1dcfb7aec3c))1480    * **darwin:** declare sshd server enablement for stibnite ([25d10e7](https://github.com/cameronraysmith/vanixiets/commit/25d10e7cc6efcf78b8f89ce9557778345df6c5ad))1481    * **darwin:** enable encrypted DNS on argentum and rosegold ([a0bdafd](https://github.com/cameronraysmith/vanixiets/commit/a0bdafda3e383af90fb9727f08b7e5864577a69e))1482    * **development-packages:** add apm ([6a1e807](https://github.com/cameronraysmith/vanixiets/commit/6a1e807b5c5edb9c6dbbe8f85cff42dbd2dd772d))1483    * **development-packages:** add ghq ([891c9a8](https://github.com/cameronraysmith/vanixiets/commit/891c9a8de8e321f20e7310b5c65df5cb2acd0c69))1484    * **development-packages:** add linear-cli to dev packages ([0c0fe8d](https://github.com/cameronraysmith/vanixiets/commit/0c0fe8d797cb2674c157a592d67a3bdd34623b25))1485    * **development-packages:** add openspec to dev packages ([962beb2](https://github.com/cameronraysmith/vanixiets/commit/962beb2e4a32141cccd17121db6da405ee77557f))1486    * **development-packages:** add ttyd ([0c4f193](https://github.com/cameronraysmith/vanixiets/commit/0c4f1937fad0c4fa7a9e0912bd35fb023f18d0ed))1487    * **development-packages:** install git-repo-manager (grm) ([2403cb5](https://github.com/cameronraysmith/vanixiets/commit/2403cb5c273b1e1bfb03808cedfd179e830cf9fa))1488    * **devin:** add git-backed devin environment blueprint ([cc73ba0](https://github.com/cameronraysmith/vanixiets/commit/cc73ba01a02e65cb2b8e194beb97f0a64aff5b6d))1489    * **devin:** enable Outposts workers on stibnite and magnetite ([059c731](https://github.com/cameronraysmith/vanixiets/commit/059c731d3a443b22f3c002393c3c4d0ce498fbbb))1490    * **devin:** install the interactive CLI for the crs58 home ([92c0a56](https://github.com/cameronraysmith/vanixiets/commit/92c0a56b93d7d9b6ea36f3672fa4291247efe9b5))1491    * **devshells:** add the kanidm 1.11 client for identity administration ([0f88ff8](https://github.com/cameronraysmith/vanixiets/commit/0f88ff8277f3874262c968681ed429d15f87a530))1492    * **devshell:** supply the CLIs the skill corpus shells out to ([ed836e5](https://github.com/cameronraysmith/vanixiets/commit/ed836e5817816151c7e16e94e6b7f6bdd7722a50))1493    * **docs:** index the module tree and state its local contracts ([b55ce4d](https://github.com/cameronraysmith/vanixiets/commit/b55ce4d17f9d28b12173a5a782f29a6205645a07))1494    * **docs:** preserve browser evidence behind a required verdict gate ([ab6b06b](https://github.com/cameronraysmith/vanixiets/commit/ab6b06b7a4fa718783d67cd882f1ab522f398df6))1495    * **docs:** publish validated browser evidence from finished builds ([c7884ce](https://github.com/cameronraysmith/vanixiets/commit/c7884cebd38a386d5fbfba3e60b81c531c39a547))1496    * **docs:** run firefox and webkit in the hermetic e2e check ([bb59487](https://github.com/cameronraysmith/vanixiets/commit/bb59487cfea5046c43c75da2dea4e378af90d854))1497    * **duckdb:** 1.5.2 -> 1.5.3 ([03aaa58](https://github.com/cameronraysmith/vanixiets/commit/03aaa58a9f33219bfceef1a77c21c053849d8f01))1498    * **effects:** add ironstar-effects-secrets clan-vars generator ([b88985c](https://github.com/cameronraysmith/vanixiets/commit/b88985c1eb76b1565529e972a3d3833ebda9d004))1499    * **effects:** declare secretsMap on the vanixiets effects ([5c9feee](https://github.com/cameronraysmith/vanixiets/commit/5c9feeeeffdf38ad31cc7fe6e7f628b4624a80e5))1500    * **effects:** provision R2 evidence credentials for the effects runner ([6c669b3](https://github.com/cameronraysmith/vanixiets/commit/6c669b33b8517488902ccc1ad2028d729870cef0))1501    * **effects:** publish browser evidence on build_finished and main pushes ([aaf54c1](https://github.com/cameronraysmith/vanixiets/commit/aaf54c1bd1c8f24454bad278d51ce8e8100711c0))1502    * **effects:** register ironstar-effects-secrets perRepoSecretFiles for github:sciexp/ironstar ([b562f4a](https://github.com/cameronraysmith/vanixiets/commit/b562f4a1bad0e59a8c10c0b2452bcdf8b0b06721))1503    * **effects:** resolve pull requests at runtime for both build services ([c252727](https://github.com/cameronraysmith/vanixiets/commit/c252727f40754670bbb9598df898e2528f57237c))1504    * **effects:** support build-finished event registration ([2c18d83](https://github.com/cameronraysmith/vanixiets/commit/2c18d83ceb925d2281655743cb954593f52d742c))1505    * **evidence-worker:** serve browser evidence read-only from R2 ([372fcd3](https://github.com/cameronraysmith/vanixiets/commit/372fcd352d2bdc4fa1d5f0ebdc1e3e65778f6f72))1506    * **firstmate:** install chrome-devtools-axi for the agent user ([e545e51](https://github.com/cameronraysmith/vanixiets/commit/e545e516aa0fc75e4a41f9fc180ddcfea2111f14))1507    * **flake:** add epireyn/niri-flake for typed niri configuration ([cc29b2b](https://github.com/cameronraysmith/vanixiets/commit/cc29b2b35d5e3e1136e90c452557d7ea278d0d2d))1508    * **flake:** add hermes-agent input with nixpkgs follows ([63c4e02](https://github.com/cameronraysmith/vanixiets/commit/63c4e02a7e0109726ce27c09510c661b637d034c))1509    * **gh-dash:** bind queue enqueue over the built-in merge ([c8f62e0](https://github.com/cameronraysmith/vanixiets/commit/c8f62e0bd3da1c40b8ddd4f0135f96e775b181a8)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash)1510    * **gh-dash:** review the selected PR in tuicr in a new herdr tab ([031b40d](https://github.com/cameronraysmith/vanixiets/commit/031b40d34fff079d5362db34abc5b82d7582ca6e)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [owner/repo#N](https://github.com/owner/repo/issues/N)1511    * **gh:** install stacked PR extension declaratively ([8641e50](https://github.com/cameronraysmith/vanixiets/commit/8641e504d4a740ede2154dcc78f95846179253fa))1512    * **ghq-sync:** register fetched/updated repos with zoxide and add --seed-zoxide ([b005177](https://github.com/cameronraysmith/vanixiets/commit/b00517792a7f72b08364bc30fec20a821933884c))1513    * **gitea-mq:** add magnetite credentials for the sciexp-gitea-mq app ([ca8f662](https://github.com/cameronraysmith/vanixiets/commit/ca8f6624707972235e8638f9643704fa90ce6505))1514    * **gitea-mq:** post-g1 ([1fdcdcf](https://github.com/cameronraysmith/vanixiets/commit/1fdcdcf14ddbe6ffdb26915f354bd2efd3c40724))1515    * **gitea-mq:** raise the batch cap to twenty for flake-update waves ([8e6a334](https://github.com/cameronraysmith/vanixiets/commit/8e6a334ec23fb432e450c59d8b0cdfd41826b21d))1516    * **gitea-mq:** retarget the stand-up change at queue-only batching ([aedc7dd](https://github.com/cameronraysmith/vanixiets/commit/aedc7dd3aa2e2fe9a04b0af79b369153eec8d5e9))1517    * **gitea-mq:** s1 ([9d33e2f](https://github.com/cameronraysmith/vanixiets/commit/9d33e2f6bbfa69d5f5d8cd4ae349a97470b6ee52))1518    * **gitea-mq:** s2 ([b677011](https://github.com/cameronraysmith/vanixiets/commit/b677011b131b59bdbde9de49c8ef0504549a9dd6))1519    * **gitea:** tune start-limit to survive postgres recovery window ([d4d1076](https://github.com/cameronraysmith/vanixiets/commit/d4d10764d6a7cab30d49795c82a2c9c9662d30c5))1520    * **hermes-agent:** add clan-vars generators for OPENROUTER_API_KEY and MATRIX_PASSWORD ([575b659](https://github.com/cameronraysmith/vanixiets/commit/575b659a97175a0450a97ea01253206b3a15cee4))1521    * **hermes-agent:** add defensive kernel-hardening directives; document upstream-default rationale ([5e82244](https://github.com/cameronraysmith/vanixiets/commit/5e8224469d2502f045db9d2c0103141c2fe42828))1522    * **hermes-agent:** add sibling hermes-agent-dashboard systemd unit ([7541a0f](https://github.com/cameronraysmith/vanixiets/commit/7541a0f1178d0a861af1c5ec6863d3b12b0ed3a6))1523    * **hermes-agent:** upgrade to upstream v2026.6.5, drop 27716 locale fork ([473f884](https://github.com/cameronraysmith/vanixiets/commit/473f8840f871a6e8877a8efa6c9f04055010eed1)), closes [#38383](https://github.com/cameronraysmith/vanixiets/issues/38383) [#27716](https://github.com/cameronraysmith/vanixiets/issues/27716)1524    * **hermes-agent:** wire clan-vars-to-environmentFiles adapter ([1d04a82](https://github.com/cameronraysmith/vanixiets/commit/1d04a826859f1bf2fcda20b57ffef4e5ab6f9b04))1525    * **hermes:** enable voice extra (local STT) + ffmpeg/portaudio native deps ([0696936](https://github.com/cameronraysmith/vanixiets/commit/069693651c75d5472a78b94ad1851a747bd7a1cc))1526    * **hermes:** provision firecrawl + fal gateway client deps in the sealed venv ([238085f](https://github.com/cameronraysmith/vanixiets/commit/238085f612f4cf5ae9f70ce506a8e916bd459db4))1527    * **home,devshell:** expose uncomment via home packages and default devShell ([97cf62a](https://github.com/cameronraysmith/vanixiets/commit/97cf62a80c97cc3c71bd1db2e2ec87d117831d50))1528    * **home/agents-md:** materialize ~/.hermes/SOUL.md for hermes persona injection ([b58bd9d](https://github.com/cameronraysmith/vanixiets/commit/b58bd9d3e8ff546732739bd19e362629c9f5a137))1529    * **home/ai/claude-code:** disable git instructions ([5e2cebe](https://github.com/cameronraysmith/vanixiets/commit/5e2cebebc5d5cf1e41af4c5139a117b6e7644b3e))1530    * **home/ai/claude-code:** enable Linear official plugin ([c5e39d8](https://github.com/cameronraysmith/vanixiets/commit/c5e39d87b95bcb21b1c4cdabff0dd245da48104c))1531    * **home/ai/claude-code:** pin dagster-skills marketplace and enable dagster-expert ([93c2300](https://github.com/cameronraysmith/vanixiets/commit/93c2300b72702529b7d6f1e89594f86ada6afb20))1532    * **home/ai/claude-code:** wire WorktreeCreate/WorktreeRemove hooks + git-worktree Bash deny + worktree.baseRef ([3ca4b26](https://github.com/cameronraysmith/vanixiets/commit/3ca4b26888140c5892cc99f7f1b545af9e0e09dc)), closes [anthropics/claude-code#32355](https://github.com/anthropics/claude-code/issues/32355)1533    * **home/ai/codex:** route Linear via direct MCP and curated plugin skill, disable apps connector channel ([86a7064](https://github.com/cameronraysmith/vanixiets/commit/86a7064379deb44d36dda3ddde4cff842282eb19))1534    * **home/ai/openspec:** add opt-in programs.openspec module ([a46fc92](https://github.com/cameronraysmith/vanixiets/commit/a46fc9255df3529a2e4fc020cca7155629d413e3))1535    * **home/ai/openspec:** regenerate vendored assets with all 11 openspec workflows ([0293fa5](https://github.com/cameronraysmith/vanixiets/commit/0293fa543452a0897efacccc4ecc1baeb4c7163e))1536    * **home/ai/openspec:** vendor openspec 1.3.1 claude skills + opsx commands + regen script ([7b38157](https://github.com/cameronraysmith/vanixiets/commit/7b381573d34046bb3da9e00c236b1e92b65090c8))1537    * **home/ai/openspec:** vendor superpowers-bridge schema for user-global openspec delivery ([4054a66](https://github.com/cameronraysmith/vanixiets/commit/4054a669fac039db2f2c3f193f5586419c536181))1538    * **home/ai/skills:** add knowledge-graph skill for cognee reference-corpus grounding ([910bd79](https://github.com/cameronraysmith/vanixiets/commit/910bd7996a9eef2cefa3d625c0dc3d4f4654c12b))1539    * **home/ai/skills:** add refinement-driven-development skill ([571474d](https://github.com/cameronraysmith/vanixiets/commit/571474d3100cbe5c7e282baa909e33e8f1cbd68e))1540    * **home/ai/skills:** exclude pocock tdd skill from delivery ([1a7ed6d](https://github.com/cameronraysmith/vanixiets/commit/1a7ed6da0d53ebb93570a01855ae3e0666e6874a))1541    * **home/ai/skills:** inject coreSkills into ~/.hermes/external-skills/ ([9f49c08](https://github.com/cameronraysmith/vanixiets/commit/9f49c081f66123af911761b33ff61b7cd109d0b2))1542    * **home/ai:** add herdr agent multiplexer via prebuilt herdr-bin ([996b3f2](https://github.com/cameronraysmith/vanixiets/commit/996b3f2ffd1fee0422c75129fd14d4f0d2250d49))1543    * **home/ai:** add hunk diff-review tool with vendored review skill ([6a432c3](https://github.com/cameronraysmith/vanixiets/commit/6a432c365e4b82a5571cd1732eca7fb0c254fadc))1544    * **home/ai:** add the moshi-hook service module ([42074c9](https://github.com/cameronraysmith/vanixiets/commit/42074c9555fed26de05f49e700e8a5f3e3fb66f7))1545    * **home/ai:** add worktrunk via upstream HM module over worktrunk-bin ([e210071](https://github.com/cameronraysmith/vanixiets/commit/e210071ab285ddb91f790b294809165a80377840))1546    * **home/ai:** assign omp model roles by consumer ([4bdc2db](https://github.com/cameronraysmith/vanixiets/commit/4bdc2db531810beed58ef9df3cba6575e719d81a))1547    * **home/ai:** bind prefix+! to break pane into a new tab ([bbcc33c](https://github.com/cameronraysmith/vanixiets/commit/bbcc33c56d3eca1fcb8cd0666af61dfb60f48726))1548    * **home/ai:** declare atomic model roles in settings.json ([d99a789](https://github.com/cameronraysmith/vanixiets/commit/d99a78919e6a7d2f1bdf988169cdc17958437686))1549    * **home/ai:** enable ouroboros claude code plugin with version-coupled mcp registration ([f59822f](https://github.com/cameronraysmith/vanixiets/commit/f59822f5619cd517a563648b12d62c69810a1d04))1550    * **home/ai:** install the atomic coding agent ([2d41664](https://github.com/cameronraysmith/vanixiets/commit/2d4166406b406b34c2a070e948f93d048791dadd))1551    * **home/ai:** migrate claude code plugin marketplaces to store-pinned directory sources ([4ca2f1c](https://github.com/cameronraysmith/vanixiets/commit/4ca2f1c8a7d31727a9d9a889551afc3548294137))1552    * **home/ai:** move omp memory from hindsight to the local mnemopi store ([e8ce188](https://github.com/cameronraysmith/vanixiets/commit/e8ce18857a37efa9b2e40f4ba304d19ecd0d1f1a)), closes [.#mnemopi-memory-validate](https://github.com/./issues/mnemopi-memory-validate)1553    * **home/ai:** split claude-code across an orchestrator and worker model ([c496ca3](https://github.com/cameronraysmith/vanixiets/commit/c496ca3cc30393519ab68d4af375c1c1a6c1cabc))1554    * **home/ai:** vendor herdr control skill from ogulcancelik/herdr@v0.7.1 ([c10cc42](https://github.com/cameronraysmith/vanixiets/commit/c10cc42a670afb70f6f94ef448dc741e00f4156f))1555    * **home/claude-code:** disable bg-isolation worktree guard fleet-wide ([13a770a](https://github.com/cameronraysmith/vanixiets/commit/13a770a1a21adec8e74cae9ed03676ad120430c4))1556    * **home/core:** colorize man pages via bat MANPAGER cross-shell ([d282f47](https://github.com/cameronraysmith/vanixiets/commit/d282f473c40b83f9a7dc871d82a5f79c992382d3))1557    * **home/crs58:** adopt schpet linear-cli credentials.toml config ([aeeb2f5](https://github.com/cameronraysmith/vanixiets/commit/aeeb2f5a325454e221ffa6ccd63bf6c2e60c2061))1558    * **home/crs58:** declarative linear-cli config via sops template ([f9c1cb0](https://github.com/cameronraysmith/vanixiets/commit/f9c1cb00b9cc30f93ed736e1b0c7acbf5b94a529))1559    * **home/crs58:** declaratively pin openspec global config (custom profile, 11 workflows) ([b10d58d](https://github.com/cameronraysmith/vanixiets/commit/b10d58d766d9c0a52b2c928aa7721afe7adf441e))1560    * **home/crs58:** declare buzz-nsec sops secret ([342f7e6](https://github.com/cameronraysmith/vanixiets/commit/342f7e6cd1835f47f07a0694c7212a811c4d34d4))1561    * **home/crs58:** inject linear-cli bundled skills via aiSkills.extraSkillDirs ([e8a3279](https://github.com/cameronraysmith/vanixiets/commit/e8a3279cf57509c365a462ea08b05d8d7150912c))1562    * **home/crs58:** inject openspec skills + opsx commands at user level ([3eb3040](https://github.com/cameronraysmith/vanixiets/commit/3eb3040c0b2f0e2038ed40e3b5a65786595e3b3b))1563    * **home/crs58:** route buzz credentials through the nix-built helper ([f33a945](https://github.com/cameronraysmith/vanixiets/commit/f33a9456d22f0bbf424c24ac969087532a220218))1564    * **home/crs58:** route buzz git credentials through git-credential-nostr ([d07fd77](https://github.com/cameronraysmith/vanixiets/commit/d07fd7758b50845673e99a35575226116331d777))1565    * **home/packages:** add datafusion-cli alongside the duckdb CLI ([9ec9364](https://github.com/cameronraysmith/vanixiets/commit/9ec93640b07229b34d7baa5ae8edda92d0e8ec7c))1566    * **home/packages:** add forgejo-cli (fj) to development tools ([2ce5425](https://github.com/cameronraysmith/vanixiets/commit/2ce54255b531bad540ba071f9cc075f630ab91cb))1567    * **home/packages:** install cursor-agent from llm-agents ([807b892](https://github.com/cameronraysmith/vanixiets/commit/807b892411f2133cd39116ba268997ea5d635181))1568    * **home/shell/fish:** plugin-git parity, superiority plugins, native editor-edit ([12ba639](https://github.com/cameronraysmith/vanixiets/commit/12ba639aa8a2a6386ca2c595209a027df8f3be62))1569    * **home/terminal:** add carapace cross-shell completer for nix and gap completions ([ff447f8](https://github.com/cameronraysmith/vanixiets/commit/ff447f87ab3ae5932dcee9f39bd77d56b8268be8))1570    * **home/terminal:** browser-terminal wrapper around ttyd and herdr ([c7d1607](https://github.com/cameronraysmith/vanixiets/commit/c7d160735aa44972ae0bad2a192d0ac08e06679e))1571    * **home/tools/agents-md:** invert dispatch instruction to mode-conditional three-tier model — diamond default in jj mode, worktrees only on explicit request ([506ef12](https://github.com/cameronraysmith/vanixiets/commit/506ef12971685c7b3cf059b1ceea87bad0aaf0d9))1572    * **home/tools/agents-md:** reconcile skill routing with beads/session-* deprecation ([02b504c](https://github.com/cameronraysmith/vanixiets/commit/02b504c2b1631e0b5fe5d43dd25cd3041e07bc54))1573    * **home/tools/agents-md:** surface compositional continuous verification and nix-flake-pr-cycle in development guidelines ([05f0399](https://github.com/cameronraysmith/vanixiets/commit/05f039927769adf39854952231cde455cf2b95f7))1574    * **home/tools/commands:** add hermes-backup tool for archival tar.zst snapshots ([76b9b8b](https://github.com/cameronraysmith/vanixiets/commit/76b9b8ba049bb0ae6baa8562f0aae30c689ec773))1575    * **home/tools/commands:** add hermes-restore for converting tar.zst back to hermes-import zip ([88042b2](https://github.com/cameronraysmith/vanixiets/commit/88042b247ce8ff29db663e7ba4f0e977742eec15))1576    * **home/tools/git:** add commit-checks script for github+gitea ([2e87043](https://github.com/cameronraysmith/vanixiets/commit/2e870432b50c417959877f67de3b46815312fedc))1577    * **home/tools/git:** wrap commit-checks as home-manager package ([689d85e](https://github.com/cameronraysmith/vanixiets/commit/689d85e4b74d694c79ee971517174753be9a2858))1578    * **home/tools/hooks/verify-diamond-before-edit:** accept in-chain and splice-stack @ positions; refine SKILL.md doctrine ([01dbf7a](https://github.com/cameronraysmith/vanixiets/commit/01dbf7acfccfd7459e31e7d91916298547a9eab4))1579    * **home/tools/hooks/verify-diamond-before-edit:** unify case D to mutable diamond interior for jj edit at any internal commit ([c2cd88c](https://github.com/cameronraysmith/vanixiets/commit/c2cd88ca1b44e29f137d12aaf48424cdf8acdc1a))1580    * **home/tools/hooks:** jj worktree-create/remove + git-worktree gate hooks ([47e0325](https://github.com/cameronraysmith/vanixiets/commit/47e0325ece27e35ecf5e7e1cef2c2e4fc8f4a4be))1581    * **home/tools:** add buzz CLI wrapper injecting the sops nostr key ([e510ab5](https://github.com/cameronraysmith/vanixiets/commit/e510ab5779da293c51365380f44e7b3cec3965ec))1582    * **home/tools:** add rclone-saturate cross-cloud copy command ([d503c4f](https://github.com/cameronraysmith/vanixiets/commit/d503c4f85a594d8a9ec4c5b631db11958d2a2b2c))1583    * **home/ubuntu:** import core and herdr; disable the systemd ssh-agent ([f640e26](https://github.com/cameronraysmith/vanixiets/commit/f640e26a97b0d403afea18442b47b9d35e577e58))1584    * **home:** add managedConfigs for files applications also write ([3c35e10](https://github.com/cameronraysmith/vanixiets/commit/3c35e10d68bb9b1c3c9e095ea7154791ec79718e))1585    * **home:** add ubuntu profile for the Devin sandbox ([b575fb0](https://github.com/cameronraysmith/vanixiets/commit/b575fb00dbdb87a2c3472cb2ea3a9839f9f98e55))1586    * **homebrew:** add buzz ([5f767ff](https://github.com/cameronraysmith/vanixiets/commit/5f767ff3429b5e52129627f2758f6492d274bf67))1587    * **homebrew:** add chatgpt, factory, and rescuetime ([b39942c](https://github.com/cameronraysmith/vanixiets/commit/b39942ce1a1f5103bbe26a3707bdabbfa0183faf))1588    * **homebrew:** add flighty ([06c4a84](https://github.com/cameronraysmith/vanixiets/commit/06c4a844871a7d06fb7df21715f52cc83bd5635b))1589    * **homebrew:** add handy ([1af7be9](https://github.com/cameronraysmith/vanixiets/commit/1af7be9aaaa174bc7f9b52711f7c379575bbeb0c))1590    * **homebrew:** add pomatez ([f495734](https://github.com/cameronraysmith/vanixiets/commit/f495734711fb95c412f35f475dc5835a033f3f36))1591    * **homebrew:** add spotify ([211adca](https://github.com/cameronraysmith/vanixiets/commit/211adca02050b9df87e6c471e568526aded34e55))1592    * **home:** declare Devin CLI configuration and Outposts workers ([e1b7936](https://github.com/cameronraysmith/vanixiets/commit/e1b79368f983a735aabd62b2429ada46e493a1fd))1593    * **home:** declare herdr onboarding, updates, and session recovery ([bbdeeb2](https://github.com/cameronraysmith/vanixiets/commit/bbdeeb2f40534bc8fd6d0d38bf504049349454ba))1594    * **home:** gate homeConfigurations emission on a per-user systems list ([0570a42](https://github.com/cameronraysmith/vanixiets/commit/0570a42bfc69e411db38e9bdf1ede9fee9508b4c))1595    * **home:** install sops secrets without a systemd user manager ([6ffc7bb](https://github.com/cameronraysmith/vanixiets/commit/6ffc7bb7283e3e4a7836606980db7ecdf45386e4)), closes [#2938](https://github.com/cameronraysmith/vanixiets/issues/2938)1596    * **home:** install ubuntu sops secrets at session start from a per-shell hook ([6e70397](https://github.com/cameronraysmith/vanixiets/commit/6e703977f57c0724cc67a77d2bd4e2a37c5111f3))1597    * **home:** ultracode by default + claude-name-background launcher ([3d1e9ce](https://github.com/cameronraysmith/vanixiets/commit/3d1e9ce3b0ff7fb3ec93d2f7fc2e6c2ac6ac508b))1598    * **hooks/gate-dangerous-commands:** permit canonical gh pr create -d, NOTICE via ntfy ([d602b2c](https://github.com/cameronraysmith/vanixiets/commit/d602b2cace14217d5680413894df85814ade4dea))1599    * **hooks/gate-dangerous-commands:** permit non-default push, NOTICE via ntfy ([2a2e598](https://github.com/cameronraysmith/vanixiets/commit/2a2e59827a80d1875d975311040b6523ada8d866))1600    * **hooks/gate-dangerous-commands:** permit ssh/scp/rsync to .zt hosts, NOTICE via ntfy ([d8e2532](https://github.com/cameronraysmith/vanixiets/commit/d8e253286359d67e66522c6e962928130da8a35b))1601    * **hooks:** add gate-worktree-surfaces enforcement script ([c476173](https://github.com/cameronraysmith/vanixiets/commit/c47617326abd8fc4ddb2f574f7346ad89e88cf85))1602    * **hooks:** add verify-diamond-before-edit tier-aware integrity check ([b70fd2d](https://github.com/cameronraysmith/vanixiets/commit/b70fd2dda66aec26577d8bd541ce2f8881170329))1603    * **hooks:** lift the nix run/shell and git push confirmation gates ([5aadf36](https://github.com/cameronraysmith/vanixiets/commit/5aadf3695ded35807cdb9caf4410a0bdf5a5170f))1604    * **hooks:** resolve the target repository and downgrade the worktree gates to ask ([3882b97](https://github.com/cameronraysmith/vanixiets/commit/3882b97cdff2791bfbc68f6c496b62df0fc522e5))1605    * **jj-join-chains:** list development-join chain bookmarks by tip timestamp ([78ae064](https://github.com/cameronraysmith/vanixiets/commit/78ae064c6232c8e61bab7ec83bdbf35c3d30ae37))1606    * **jj-linearize-join:** add --keep-remaining flag for subset Phase 4 ([9cfeb56](https://github.com/cameronraysmith/vanixiets/commit/9cfeb56cf7680774ce31af152c086b3dfa19125a))1607    * **jj-linearize-join:** reconstruct development join when --keep-remaining is set ([7216fa6](https://github.com/cameronraysmith/vanixiets/commit/7216fa66c777a00c9e1158ce842fb71f2b233cc1))1608    * **jj:** add diamond revset ([cb0c340](https://github.com/cameronraysmith/vanixiets/commit/cb0c340a3afb76cb852e9df0ff72d71a6f3b3578))1609    * **jj:** mark queued pull requests and add a dequeue key ([ab8caaf](https://github.com/cameronraysmith/vanixiets/commit/ab8caafaf0ab506b2b4ac5c900b14495633233d5))1610    * **jj:** mint gerrit change-id trailers from the jj change id ([4734755](https://github.com/cameronraysmith/vanixiets/commit/4734755c882488fef1b4a4e1b62a6f3d3f8001a4))1611    * **jj:** show pull request numbers next to bookmarks ([f44fcc1](https://github.com/cameronraysmith/vanixiets/commit/f44fcc151456c20988c5ceb068276ebeffaa8ce9))1612    * **just:** choose the remote host for check-fast ([3544c4c](https://github.com/cameronraysmith/vanixiets/commit/3544c4c46454265c62ff09b7a91d3591b9b15224))1613    * **justfile:** summarise renovate dry runs and guard bun updates against renovate holds ([0df9de3](https://github.com/cameronraysmith/vanixiets/commit/0df9de332e2b3896483c5eabaf1a592b4da81f18))1614    * **just:** let nix-flake-io target a chosen system ([321d6c8](https://github.com/cameronraysmith/vanixiets/commit/321d6c84e314e45802ec69c25ea2850d07c80b14))1615    * **just:** route check-fast by target system ([4fc789a](https://github.com/cameronraysmith/vanixiets/commit/4fc789aa46382bc2f26860edbb156a08e00b4cbc))1616    * **k3d:** run cilium with kube-proxy replacement on k3s v1.33.13 ([5066198](https://github.com/cameronraysmith/vanixiets/commit/5066198295ad8c3c843ffe3592bdca4dbf597b8a))1617    * **kanidm:** bump server to 1.11 and restore the default backup schedule ([fa0ca9c](https://github.com/cameronraysmith/vanixiets/commit/fa0ca9ca7c148fd953dc9685c98cc2029fe4ff33))1618    * **linear:** register the requirements-engineering project ([84bb7cb](https://github.com/cameronraysmith/vanixiets/commit/84bb7cb9eece6b2059d113562140a8d838a0f746))1619    * **machines/darwin/stibnite:** inject nix daemon prerequisites for nspawn nixos tests into rosetta-builder guest ([3788a57](https://github.com/cameronraysmith/vanixiets/commit/3788a573ca137adf02f383e28d411600172ab096))1620    * **machines/darwin/stibnite:** mkForce-replace nix.buildMachines entry to advertise uid-range for rosetta-builder dispatch ([dd16686](https://github.com/cameronraysmith/vanixiets/commit/dd16686c8988aa7e21223e92a7bb2c03b3cfa013))1621    * **machines/nixos/magnetite:** enable nix daemon prerequisites for nspawn nixos tests ([c0a82ff](https://github.com/cameronraysmith/vanixiets/commit/c0a82ff70b209970e617af7410966718ff06c92c))1622    * **magnetite-builder:** add shared remote-builder module and enable on stibnite ([fccff9f](https://github.com/cameronraysmith/vanixiets/commit/fccff9f1439c074e8cba4dce45f8e79b3c9620f8))1623    * **magnetite,pyrite:** enable the evaluation lock and memory guards ([36996d2](https://github.com/cameronraysmith/vanixiets/commit/36996d28f1b4f6dafe8e21752f06e4c4a54804ad))1624    * **magnetite/kanidm:** declarative site-branding via systemd oneshot (display=" ", logo=flake.brand.logo) ([26d308b](https://github.com/cameronraysmith/vanixiets/commit/26d308b2a2754c8cfcad38f97550d41a81644bc1))1625    * **magnetite/kanidm:** grant cameron synapse OIDC access via matrix_users membership ([93fc360](https://github.com/cameronraysmith/vanixiets/commit/93fc360b33ab88cb53d06e580fa5a854be3535a2))1626    * **magnetite/kanidm:** harden admin passwords to 7 words + restartUnits for rotation propagation ([b39a87d](https://github.com/cameronraysmith/vanixiets/commit/b39a87d12228fe26ad91ee8ca2a3ea1993029cb4))1627    * **magnetite/kanidm:** improve synapse RS /ui/apps tile (Element direct-login + logo) ([c815fa0](https://github.com/cameronraysmith/vanixiets/commit/c815fa004bef89c90e62a21b84c2001d6753c612))1628    * **magnetite/kanidm:** point /ui/apps tile to Cinny with hs pre-populated + client-agnostic matrix logo ([ab01db6](https://github.com/cameronraysmith/vanixiets/commit/ab01db616994dda0697d99f2975f7cbd358b7c31))1629    * **magnetite/matrix:** add matrix.scientistexperience.net CNAME to terranix ([e9bd237](https://github.com/cameronraysmith/vanixiets/commit/e9bd2371bdb3d3d78735613464c686cd51cfe3e2))1630    * **magnetite/matrix:** close synapse password rail (password_config.enabled=false) and remove matrix-password-cameron + register-users wiring ([1c6c7ff](https://github.com/cameronraysmith/vanixiets/commit/1c6c7ffb34b5d1f8795efd3e437787b64bd05001))1631    * **magnetite/matrix:** pre-deploy hardening + extended CI probes (nix-dk1) ([de0f381](https://github.com/cameronraysmith/vanixiets/commit/de0f3818851af060aeb8d6d2bea9c7041e646812)), closes [hi#entropy](https://github.com/hi/issues/entropy)1632    * **magnetite/matrix:** public Synapse + Element Call/LiveKit/coturn stack (mag-2..mag-13) ([4b0699f](https://github.com/cameronraysmith/vanixiets/commit/4b0699fa3bad97fe8c4f93eb06a4c5bbd0ecf696))1633    * **magnetite/matrix:** wire synapse OIDC client with kanidm IdP (LoadCredential + allow_existing_users) ([4e2abde](https://github.com/cameronraysmith/vanixiets/commit/4e2abde5bd968a48c6c97c4934506f70e3dd12d8))1634    * **magnetite:** add kanidm IdP module scaffold with nginx-fronted TLS ([867ef8b](https://github.com/cameronraysmith/vanixiets/commit/867ef8bbacd163759ec8fb50c2bed72725c07958))1635    * **magnetite:** apply omnigraph policy bundles ([836ebb6](https://github.com/cameronraysmith/vanixiets/commit/836ebb6298d83b1fc33f7e45efff19142133de56))1636    * **magnetite:** authorize stibnite nix-remote-build key on builder user ([8c8328d](https://github.com/cameronraysmith/vanixiets/commit/8c8328dbce558ff573ece3c7b4640e15c53230fd))1637    * **magnetite:** clan-vars generators for kanidm admin and synapse oauth2 secrets ([5b0dc95](https://github.com/cameronraysmith/vanixiets/commit/5b0dc95c37a27988b747b8a1f6cf85b807ec6f70)), closes [#7](https://github.com/cameronraysmith/vanixiets/issues/7)1638    * **magnetite:** deploy omnigraph server ([a2f7b86](https://github.com/cameronraysmith/vanixiets/commit/a2f7b8676769fd6d5e5c6963a2ed53280f6b0ce5))1639    * **magnetite:** disable self-hosted cognee server + SSO gateway (reversible; config retained) ([3783645](https://github.com/cameronraysmith/vanixiets/commit/378364579043559cea184ac937d31e553ad6cd21))1640    * **magnetite:** disable ZFS auto-snapshot on root/nix dataset ([d5b7bf1](https://github.com/cameronraysmith/vanixiets/commit/d5b7bf117967c151cf5609524f974325cb293206))1641    * **magnetite:** extend zfs auto-snapshot opt-out to docker and podman ([7051ee9](https://github.com/cameronraysmith/vanixiets/commit/7051ee95a06c6c375b2383698144f3055eab1738))1642    * **magnetite:** import effects-ironstar-secrets flake module ([0741380](https://github.com/cameronraysmith/vanixiets/commit/07413806b5b9fffb857dfbf0fd84c4ca98315b2d))1643    * **magnetite:** import kanidm IdP module on magnetite ([7983c22](https://github.com/cameronraysmith/vanixiets/commit/7983c22080fb080fa467c24ece78857f31abff10))1644    * **magnetite:** import matrix module into flakeModules (mag-14) ([e2c9dde](https://github.com/cameronraysmith/vanixiets/commit/e2c9dde71b573e651e42c04230c103197e12e7bc))1645    * **magnetite:** import sso-gateway, enable gateway + register cognee consumer ([f07466b](https://github.com/cameronraysmith/vanixiets/commit/f07466bcf0bca64aec66f15518e4f535f28ac674))1646    * **magnetite:** raise nix min-free/max-free thresholds for build host ([a0d5f64](https://github.com/cameronraysmith/vanixiets/commit/a0d5f64509bc5bc57d841b4e6f3cea8fedaf85d3))1647    * **magnetite:** size zram to 150% of RAM and raise swappiness to 100 ([ea70970](https://github.com/cameronraysmith/vanixiets/commit/ea70970e0bbf06c19c3e0d5b42ca29404cb81b29))1648    * **magnetite:** tune ZFS autoSnapshot retention for cloud VPS ([b19f746](https://github.com/cameronraysmith/vanixiets/commit/b19f746a239327a2ed8e54cc08b3a114bcf8a7eb))1649    * **mergify:** require nixbot's checks instead of buildbot's ([9745589](https://github.com/cameronraysmith/vanixiets/commit/97455891bae09df103cbc7299db8ba8a678e64b0))1650    * **meta-search-sessions:** search claude, codex, and pi sessions ([0cbb7ff](https://github.com/cameronraysmith/vanixiets/commit/0cbb7ff72bf636164ef377e9a6a64e133e960bb3))1651    * **modules/system:** add beads-client module gating BEADS_DOLT_SERVER_MODE wrap ([fc0945c](https://github.com/cameronraysmith/vanixiets/commit/fc0945c9023d9b38c3cde3d8fe023cc3d8a46607))1652    * **moshi:** disable usage collection declaratively ([0d703f6](https://github.com/cameronraysmith/vanixiets/commit/0d703f6d52b5ac34179a9c766e54740034a9ea8a))1653    * **nix.gc:** switch from weekly to daily cadence ([b1b779f](https://github.com/cameronraysmith/vanixiets/commit/b1b779fe8fe6933083775b3208d7b14c73cba924))1654    * **nixbot:** add nixbot aspect and compose it onto magnetite ([9919def](https://github.com/cameronraysmith/vanixiets/commit/9919defcd74bd1ce15ea819589f8f8573b6824e8))1655    * **nixbot:** add nixbot flake input ([bc9fe4c](https://github.com/cameronraysmith/vanixiets/commit/bc9fe4ca782d6a589776ea7a8b0a6a3fca2638c2))1656    * **nixbot:** admit sciexp/ironstar without effects secrets ([1a8951f](https://github.com/cameronraysmith/vanixiets/commit/1a8951f366098172eecce06799caa6771949620f))1657    * **nixbot:** admit vanixiets and push its builds to the binary cache ([de3b201](https://github.com/cameronraysmith/vanixiets/commit/de3b201913899ce83827a5fe64ebffe0c24f5557))1658    * **nixbot:** declare nixbot DNS record ([5afc3cd](https://github.com/cameronraysmith/vanixiets/commit/5afc3cd11a5e60db255f4a7bf765e1cb9bf39b90))1659    * **nixbot:** dispatch effects on pull requests as buildbot-nix does ([1c260eb](https://github.com/cameronraysmith/vanixiets/commit/1c260eb860d579e37348fb6c7d5d57a220e725c8))1660    * **nixbot:** enable the GitHub integration on the dedicated application ([6117bde](https://github.com/cameronraysmith/vanixiets/commit/6117bdeb188855c6f6540960f80cec211a6959cb))1661    * **nixbot:** read ironstar effects secrets from the existing generator ([59e438d](https://github.com/cameronraysmith/vanixiets/commit/59e438d85100ba6e1386f69af45d253206d2782a))1662    * **nixbot:** read vanixiets effects secrets from the existing generator ([e36b8ba](https://github.com/cameronraysmith/vanixiets/commit/e36b8ba5e2c326e33c534795c9df19c05721e525))1663    * **nixbot:** scope effect dispatch to default-branch pushes ([cb1fcb2](https://github.com/cameronraysmith/vanixiets/commit/cb1fcb2c918c8bc80f3b6f0f168c5627cd3ba36c))1664    * **nixos:** add memory-pressure guards and an omnigent slice cap ([6bac132](https://github.com/cameronraysmith/vanixiets/commit/6bac13233ce848d21e9d0ac6c764f1e8b5d11608))1665    * **nixos:** add reusable sso-gateway module — bespoke oauth2-proxy-kanidm unit + per-service registration + auto-derived kanidm client ([54217b1](https://github.com/cameronraysmith/vanixiets/commit/54217b1f23844f20e8be5e00454390b44cab117e))1666    * **nixos:** add the dnscrypt-proxy module for NixOS hosts ([7e8d9a5](https://github.com/cameronraysmith/vanixiets/commit/7e8d9a565c7e05904c17ff9116e955a3b13bf501))1667    * **nixpkgs:** patch nixos-facter for the MacBookPro14,1 SPI touchpad ([6fe80a6](https://github.com/cameronraysmith/vanixiets/commit/6fe80a67415ebf3b1dc80dd9ef928f9dc6049a64)), closes [#672](https://github.com/cameronraysmith/vanixiets/issues/672) [#339](https://github.com/cameronraysmith/vanixiets/issues/339)1668    * **nix:** register pyrite as the fleet's kvm remote builder ([fabd01a](https://github.com/cameronraysmith/vanixiets/commit/fabd01ae87076826e07536b30d5f7691f8c53611))1669    * **nix:** serialize nix-eval-jobs behind a host-wide evaluation lock ([b5e2b75](https://github.com/cameronraysmith/vanixiets/commit/b5e2b75d9ee0ed37f4e953685f6fb913deb04cd7))1670    * **omnigent:** acp-runtime-environment ([f8e6555](https://github.com/cameronraysmith/vanixiets/commit/f8e655544f417d688e4af56a687934dfa4f845c1))1671    * **omnigent:** add dedicated Darwin worker adapter ([6ef13c7](https://github.com/cameronraysmith/vanixiets/commit/6ef13c72e50cb6422efc4a5c98a06388d1c16810))1672    * **omnigent:** add dedicated-worker login helper ([5437b73](https://github.com/cameronraysmith/vanixiets/commit/5437b73356ebafd2f2a19f34523f8c7a48f276f7))1673    * **omnigent:** assign Janette the experimental Linux workers ([7592628](https://github.com/cameronraysmith/vanixiets/commit/7592628601edad9404e3131f2846c396fc97214e))1674    * **omnigent:** darwin-host ([b635aee](https://github.com/cameronraysmith/vanixiets/commit/b635aee887869661eee032a0f2a0b1a4c0157841))1675    * **omnigent:** declarative-config ([c121743](https://github.com/cameronraysmith/vanixiets/commit/c12174317d15240c568b4b274a480a4f2b9986bd))1676    * **omnigent:** declare worker credential sources and expected identities ([e97c897](https://github.com/cameronraysmith/vanixiets/commit/e97c897f5cec92d43342d382d90d93a115d88479))1677    * **omnigent:** deliver worker credentials through Clan vars ([c487904](https://github.com/cameronraysmith/vanixiets/commit/c48790428bfa294bb260d1c8d7bb6cf68e79b4b4))1678    * **omnigent:** enable dedicated laptop workers ([024b633](https://github.com/cameronraysmith/vanixiets/commit/024b633927890055fdd8c7759194fb4b02d1570d))1679    * **omnigent:** host-clan ([dd8cd63](https://github.com/cameronraysmith/vanixiets/commit/dd8cd63655ab1929aafaab84e3c7a14594959439))1680    * **omnigent:** manage private Darwin worker Keychain ([d8aacca](https://github.com/cameronraysmith/vanixiets/commit/d8aaccae17c32370b880dfa8d46f9231cb33b397))1681    * **omnigent:** mask worker Linear workspaces behind labels ([1c8006d](https://github.com/cameronraysmith/vanixiets/commit/1c8006d1bb178d4942f8d214bab30f7c500ad774))1682    * **omnigent:** migrate magnetite to personal workers ([a284643](https://github.com/cameronraysmith/vanixiets/commit/a2846434497623a10454170adc708a8c174ba08d))1683    * **omnigent:** omp-acp-and-tile ([d4157a9](https://github.com/cameronraysmith/vanixiets/commit/d4157a97b75d5121806a87b9ae98d3cd5f729ca7))1684    * **omnigent:** package ([9663d2c](https://github.com/cameronraysmith/vanixiets/commit/9663d2cb28399b48c07620eb6b1efe44b2ba079e))1685    * **omnigent:** prepare dedicated worker accounts ([d20ae85](https://github.com/cameronraysmith/vanixiets/commit/d20ae85993bdf24b1685b8df3569879b12f81ff5))1686    * **omnigent:** pyrite-host ([4114eea](https://github.com/cameronraysmith/vanixiets/commit/4114eea1328634fed48d466852fc7eb62ddce3ea))1687    * **omnigent:** runtime-environment ([7f64880](https://github.com/cameronraysmith/vanixiets/commit/7f6488001d65e67e2d2c0e1ec43baf01f5a4770d)), closes [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989) [#21654](https://github.com/cameronraysmith/vanixiets/issues/21654) [#22667](https://github.com/cameronraysmith/vanixiets/issues/22667) [#25990](https://github.com/cameronraysmith/vanixiets/issues/25990) [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989)1688    * **omnigent:** runtime-tooling ([7170924](https://github.com/cameronraysmith/vanixiets/commit/7170924d1c9c7d6b519d910d26444ae606bbf1f2))1689    * **omnigent:** select worker engineering capabilities ([72cd472](https://github.com/cameronraysmith/vanixiets/commit/72cd4728e861418f91613e64972655e4c104fe93))1690    * **omnigent:** select worker GitHub tokens by resource owner ([61e3b19](https://github.com/cameronraysmith/vanixiets/commit/61e3b198c3b80cba14a5ec29b6f0c10677834308))1691    * **omnigent:** server ([093f46a](https://github.com/cameronraysmith/vanixiets/commit/093f46a8b7a6a0662db173ba62fa607b77713263))1692    * **omnigent:** share worker credentials per person across hosts ([f292242](https://github.com/cameronraysmith/vanixiets/commit/f292242f60233d554e5324eb32ec22c7802f3956))1693    * **omnigent:** supervise dedicated Linux workers ([a12b3c6](https://github.com/cameronraysmith/vanixiets/commit/a12b3c6c503eb215b85a3bfa1685ad5d03a62e8c))1694    * **omnigent:** upgrade-0-13-0 ([a7c0bd9](https://github.com/cameronraysmith/vanixiets/commit/a7c0bd99d50a31602987af3d39d5b21d8bc8c83f))1695    * **omnigraph:** add cli to crs58 home packages ([b54c839](https://github.com/cameronraysmith/vanixiets/commit/b54c839b2a12b384608b51fd16f9df98719848af))1696    * **omnigraph:** add dev graph policy bundle ([8dce2e1](https://github.com/cameronraysmith/vanixiets/commit/8dce2e11dbfef76a8c50bc580d1b1a12a0af2842))1697    * **omnigraph:** add home-manager client module ([25b7492](https://github.com/cameronraysmith/vanixiets/commit/25b749279c95d7fabe76cbaf4c89ad23c426b39f))1698    * **omnigraph:** add nixos module ([c8d465b](https://github.com/cameronraysmith/vanixiets/commit/c8d465b30fb6fc02fd1625c35b3082f0d7474d65))1699    * **omnigraph:** add server policy bundle ([8d986ae](https://github.com/cameronraysmith/vanixiets/commit/8d986aed0072b03ac2bbd4003fdd8db28da6e058))1700    * **omnigraph:** add update script ([984595d](https://github.com/cameronraysmith/vanixiets/commit/984595d27e968e43949af1b936c1a253348bf82e))1701    * **omnigraph:** adopt cookbook aliases for crs58 ([c4532f6](https://github.com/cameronraysmith/vanixiets/commit/c4532f6669f2556ee82ec96c54144bfa890813f2))1702    * **omnigraph:** deliver the upstream omnigraph skill with the client ([d21bddd](https://github.com/cameronraysmith/vanixiets/commit/d21bddd0f7472fe9616b60bd090656d3024fe2a2))1703    * **omnigraph:** package server and cli from pinned main ([1b87b63](https://github.com/cameronraysmith/vanixiets/commit/1b87b635c96b73e0bd78a34c485fdfdd6ed461cd))1704    * **omnigraph:** wire update-omnigraph app ([fe9494e](https://github.com/cameronraysmith/vanixiets/commit/fe9494e74104f1be1bcc64b2477caec2d72ee926))1705    * **omp:** declare the user-level config and advisor roster ([841123e](https://github.com/cameronraysmith/vanixiets/commit/841123e2f9efbb1b7d205db253127b6b8cc74c56))1706    * **omp:** install the oh-my-pi coding agent ([df7f6f2](https://github.com/cameronraysmith/vanixiets/commit/df7f6f23d69bfcd88eb6f041bb927b03f73da5ff))1707    * **omp:** plan with Opus 5.5 instead of Fable ([38c8d76](https://github.com/cameronraysmith/vanixiets/commit/38c8d76c3fc281a1e967343a8412c1a410b4f028))1708    * **omp:** route memory to the hosted Hindsight service ([72d4c90](https://github.com/cameronraysmith/vanixiets/commit/72d4c906f55bdc16a6fd1198c5988a7c0e8d3b06))1709    * **omp:** set direnv preflight budget for agent bash commands ([106f539](https://github.com/cameronraysmith/vanixiets/commit/106f539447ba48f4855c224198adccf719ac14fc))1710    * **openclaw:** add enable toggle and self-contain vhost/DNS/registration in the clan-service ([38558b6](https://github.com/cameronraysmith/vanixiets/commit/38558b61b8c0b16eb7b0fb51e8bee9ab132ce13f))1711    * **openspec/superpowers-bridge:** align governance bundle + version prose to 1.4.1 ([ca6b68e](https://github.com/cameronraysmith/vanixiets/commit/ca6b68e7eddf5080009debf04a10118ffac59ee1))1712    * **openspec:** add sso-gateway change — reusable shared kanidm OIDC SSO gateway spec ([97910fe](https://github.com/cameronraysmith/vanixiets/commit/97910fecbd7776d15d7dd68382543a9d9c5d4780))1713    * **openspec:** apm-skills-marketplace change artifacts ([a97da9f](https://github.com/cameronraysmith/vanixiets/commit/a97da9fd5fb5ad0fda9c8a4ce0fad42586872b33))1714    * **openspec:** archive both changes and sync four capabilities ([170664a](https://github.com/cameronraysmith/vanixiets/commit/170664ab80cf337a60ed06cc3223c0a412c8a55c))1715    * **openspec:** deliver both schema bundles so pinned changes resolve ([e870f95](https://github.com/cameronraysmith/vanixiets/commit/e870f952fc7ab67a27a55791bc5de51c2e47394f))1716    * **openspec:** fork superpowers-bridge as a first-party wrspm schema ([1cb1084](https://github.com/cameronraysmith/vanixiets/commit/1cb1084151f0f87b009fc1774d10cb07c76e5d65))1717    * **openspec:** populate project context, rules, and archive guidance ([caea330](https://github.com/cameronraysmith/vanixiets/commit/caea3304a7f8d727e964eaa956eec8b7b7209362))1718    * **openspec:** state corpus self-containment in the schema and the requirements skill ([e77b87c](https://github.com/cameronraysmith/vanixiets/commit/e77b87c84da48fb573a90eaa3f18b75bae274086))1719    * **packages:** add git-repo-manager (grm) rust package ([b254ce2](https://github.com/cameronraysmith/vanixiets/commit/b254ce222baef4078f1ab4058359462274c7b5d2))1720    * **packages:** add pinned Playwright CLI with matching browsers ([894d1ff](https://github.com/cameronraysmith/vanixiets/commit/894d1ffa68f5a93753eb064093eda7738a76e872))1721    * **pi:** add pi coding agent home-manager module ([28098f2](https://github.com/cameronraysmith/vanixiets/commit/28098f2d2ebd19afcba80e4d34793d1eec578af9))1722    * **pi:** compose exact resources and theme ([5550aa4](https://github.com/cameronraysmith/vanixiets/commit/5550aa4b1379162c6bda2cdbbf4885168b5a52ad))1723    * **pi:** decide edit and write by recoverability rather than severity ([a54760f](https://github.com/cameronraysmith/vanixiets/commit/a54760f271b97453005d5fccf26086cc9d342ac9))1724    * **pi:** enforce agent safety policy ([bf9e6fe](https://github.com/cameronraysmith/vanixiets/commit/bf9e6fea684dadd051bb71050de80611b3629257))1725    * **pi:** fold thinking blocks by default in pi and atomic ([bd8d593](https://github.com/cameronraysmith/vanixiets/commit/bd8d593e11760d44822ad8fe2b08665565a1c869))1726    * **pi:** package selected extensions ([d67c7dd](https://github.com/cameronraysmith/vanixiets/commit/d67c7dd450880819f402db083f92cc9e6cddc5b9))1727    * **pi:** package the openai server-side compaction extension ([c5cd3fd](https://github.com/cameronraysmith/vanixiets/commit/c5cd3fdebceb72f1a9b5d53ff270b124dbd989e7))1728    * **pi:** register the server-side compaction extension ([ab9451b](https://github.com/cameronraysmith/vanixiets/commit/ab9451bc91129355f092f621879c3a7e12322085))1729    * **pkgs/atomic:** switch to the npm distribution from-source build ([4f9848d](https://github.com/cameronraysmith/vanixiets/commit/4f9848d6c72d0911a7a35ed359b70d244d0e3f1c)), closes [.#atomic](https://github.com/./issues/atomic)1730    * **pkgs/beads:** restore at 1.0.4 with darwin cgo and dolt PATH from llm-agents shape ([cd4c68a](https://github.com/cameronraysmith/vanixiets/commit/cd4c68a7685a9700099f4e8012b57a42433f5427))1731    * **pkgs/buzz:** add buzz-source update script tracking desktop-v tags ([e572e0a](https://github.com/cameronraysmith/vanixiets/commit/e572e0a7ca05d5936498560d359687f43da1be3c))1732    * **pkgs/buzz:** add pinned buzz-source carrying the shared cargo vendor ([579f2d8](https://github.com/cameronraysmith/vanixiets/commit/579f2d84d6040daf8501c32570260df95b20b4ab))1733    * **pkgs/buzz:** package buzz-cli ([be3a7f7](https://github.com/cameronraysmith/vanixiets/commit/be3a7f76feacbbe21f0ff7a82d5a109f25a392a1))1734    * **pkgs/buzz:** package git-credential-nostr with git wrapped onto PATH ([70d3f01](https://github.com/cameronraysmith/vanixiets/commit/70d3f01cc5d65d152c82e8c527aa11bf9bb4f0da))1735    * **pkgs/buzz:** package git-sign-nostr ([c7a20f4](https://github.com/cameronraysmith/vanixiets/commit/c7a20f4cedbbaa91b33d41daa6ffa586d5e6e2c4))1736    * **pkgs/dolt:** bump 1.85.0 -> 1.88.1 for beads 1.0.4 driver pin compatibility ([a17ceda](https://github.com/cameronraysmith/vanixiets/commit/a17ceda541d62b6d2fec2e692a91ae056486f936))1737    * **pkgs/golem-binary:** add flake-aware multi-platform update script ([de966bf](https://github.com/cameronraysmith/vanixiets/commit/de966bfddebd1d318d8279196c6d81e6386cddea))1738    * **pkgs/golem-binary:** add prebuilt full Golem CLI derivation ([9d373eb](https://github.com/cameronraysmith/vanixiets/commit/9d373eb45555e85095a6da370e6fbcc1c6ce07fc))1739    * **pkgs:** add dependency-sources by-name package + home install ([7232204](https://github.com/cameronraysmith/vanixiets/commit/7232204793a17fee1884ce011d0c755807ea2cbb))1740    * **pkgs:** add ghq-sync by-name package + home install ([9ccc956](https://github.com/cameronraysmith/vanixiets/commit/9ccc9568a4b51a0597ac0bdcf073e830e179446e))1741    * **pkgs:** add ouroboros uvx wrapper package ([0555773](https://github.com/cameronraysmith/vanixiets/commit/0555773e74b4ddff1d76b9821a033bf72c544bd4))1742    * **pkgs:** add repo-sync by-name package + home install ([41ef988](https://github.com/cameronraysmith/vanixiets/commit/41ef9881936de8255bac3273ee59e98fc73c8dbd))1743    * **pkgs:** add store-pinned agent plugin marketplace sources ([1eddda5](https://github.com/cameronraysmith/vanixiets/commit/1eddda581699fe6d0ce33b81e508388c659204a1))1744    * **pkgs:** add the hindsight CLI ([3d482ca](https://github.com/cameronraysmith/vanixiets/commit/3d482caf8b3ecfe0d513eb3cf20304f92f042fdf))1745    * **pkgs:** add the moshi-hook daemon ([8c17d01](https://github.com/cameronraysmith/vanixiets/commit/8c17d01e5b381e5d99e3dcce7a6a6d8102c6bde8))1746    * **pkgs:** add uncomment-bin prebuilt release derivation ([49f2eb8](https://github.com/cameronraysmith/vanixiets/commit/49f2eb82fd2da2bca51ab86976e1bbb26494ace0))1747    * **pkgs:** add worktrunk-bin prebuilt wrapper with update app ([3d6dffe](https://github.com/cameronraysmith/vanixiets/commit/3d6dffe69a1980655ab25d8c23fd5a87b5d10053))1748    * **pkgs:** package linear-cli — prebuilt on Darwin, deno-run from source on Linux + update app ([e17d844](https://github.com/cameronraysmith/vanixiets/commit/e17d844781c170c998d3b2fe5fb09830c89021ea))1749    * **pkgs:** package linear-cli (Linear.app CLI) and add to dev packages ([4edfa59](https://github.com/cameronraysmith/vanixiets/commit/4edfa59e034674c8b781538919cb187071fb481e))1750    * **pkgs:** package mergify CLI as mergify-cli-bin and wire it home ([6b2d411](https://github.com/cameronraysmith/vanixiets/commit/6b2d411311f3e03016457d300322fe86db41f41d)), closes [.#mergify-cli-bin](https://github.com/./issues/mergify-cli-bin)1751    * **pkgs:** package the atomic coding agent from its release tarball ([98adbdf](https://github.com/cameronraysmith/vanixiets/commit/98adbdffd116569a641a83614dcd3f9fb197ff13)), closes [.#atomic](https://github.com/./issues/atomic)1752    * **pkgs:** package the firstmate toolchain and put it on the agent user's PATH ([1c1cd6c](https://github.com/cameronraysmith/vanixiets/commit/1c1cd6c1d13b2c9adeb523186656e8b9fdcac0c1)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi)1753    * **pkgs:** re-enable local duckdb and python-duckdb with machine-shadowing toggle ([7d85560](https://github.com/cameronraysmith/vanixiets/commit/7d855604f51e23479aeee3b52ccd8f6ec7953222))1754    * **pkgs:** vendor devin-cli 3000.6.2 with a repo-root updater ([43c5d9f](https://github.com/cameronraysmith/vanixiets/commit/43c5d9fd0ab4412ebb7a052f5585145d39e94cdb))1755    * **planning-and-development:** add pocock skills as locked apm dependency ([0d25b15](https://github.com/cameronraysmith/vanixiets/commit/0d25b15a08c05f8033e39b7a61096e5036c663fa))1756    * **playwright:** pin playwright-web-flake to a fork tag at 1.63.0 ([5491998](https://github.com/cameronraysmith/vanixiets/commit/54919980e6152f35faec6a788e3a73c148925ee1)), closes [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097) [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097)1757    * **plugins:** distribute the gh-stack skill as a transitive apm dep ([fd46b90](https://github.com/cameronraysmith/vanixiets/commit/fd46b90feadd308c19c7c6409cb38c3f728698b3)), closes [#stack](https://github.com/cameronraysmith/vanixiets/issues/stack) [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack)1758    * **plugins:** distribute unslop skill as transitive apm dep ([1271dda](https://github.com/cameronraysmith/vanixiets/commit/1271dda993c8089ecc5dfad530378d2b8ec4c1ff))1759    * **plugins:** distribute worktrunk skills as transitive apm dep ([3c22a6f](https://github.com/cameronraysmith/vanixiets/commit/3c22a6ffeafac0500b53a845c6fbaf9f8094cc0e))1760    * **plugins:** source hickey and lowy from srid/agency ([c0ceba1](https://github.com/cameronraysmith/vanixiets/commit/c0ceba12579f29072b69dce8c4ac3d1aa59d70f2))1761    * **publish-evidence:** publish each distinct report once and comment only on pull requests that change it ([6d2300f](https://github.com/cameronraysmith/vanixiets/commit/6d2300f40a3dbfc3df98a95c4310d05803c676fb))1762    * **pyrite:** add DankMaterialShell to niri ([c71e816](https://github.com/cameronraysmith/vanixiets/commit/c71e8161d00358c5e3dbc658b9c6501187ffaaab))1763    * **pyrite:** add nixos-hardware flake input (nixpkgs.follows) ([0d661b8](https://github.com/cameronraysmith/vanixiets/commit/0d661b86272b72ab71d2c41d232b7187dd16950d))1764    * **pyrite:** add the encrypted-ZFS disko layout ([28edecd](https://github.com/cameronraysmith/vanixiets/commit/28edecdcce5419f37d04e175746d3459aa4ebf74))1765    * **pyrite:** add the pyrite age anchor and bridge recipient to .sops.yaml ([c117107](https://github.com/cameronraysmith/vanixiets/commit/c11710706f2a2dda619251c1584f420942a26666))1766    * **pyrite:** add the pyrite host module (Apple MacBookPro14,1) ([7649907](https://github.com/cameronraysmith/vanixiets/commit/7649907b01470166602e89ebccbd2c5a20e0175c))1767    * **pyrite:** associate with the fleet SSID via the clan wifi service ([1335125](https://github.com/cameronraysmith/vanixiets/commit/133512502e898065d8b5c9c3e5c0ccdd4fc7663a))1768    * **pyrite:** defer FIDO2 enrollment to first boot ([dba79c6](https://github.com/cameronraysmith/vanixiets/commit/dba79c6bb7f70c586bb62808f685a9ba20ff0aeb))1769    * **pyrite:** enable declarative DankBar auto-hide ([69540f0](https://github.com/cameronraysmith/vanixiets/commit/69540f05b3c400dd2bf550ecc8726693b9d903e2))1770    * **pyrite:** enable the GNOME desktop under GDM ([f204463](https://github.com/cameronraysmith/vanixiets/commit/f2044639e81c18990f20c96976e7e43594ee9c76))1771    * **pyrite:** install pinned Zen Browser for cameron ([91c0aba](https://github.com/cameronraysmith/vanixiets/commit/91c0aba6f02770ca9b9f466435c81d01fd81d95f))1772    * **pyrite:** LUKS2-on-mapper disko restructure (Piece 2, eval-only; deploy ONLY via 7.12 reinstall) ([0c14a02](https://github.com/cameronraysmith/vanixiets/commit/0c14a02dce58b51e6c651a94ec8e2d375dbb5b99))1773    * **pyrite:** never auto-suspend on idle ([208ed13](https://github.com/cameronraysmith/vanixiets/commit/208ed134465768e37eb390fa4e90b635072ceeee))1774    * **pyrite:** offer niri as a second selectable session ([2a17a7d](https://github.com/cameronraysmith/vanixiets/commit/2a17a7dc1b5b62ee53356192cd8602385f66caea))1775    * **pyrite:** provision clan vars — sops machine key, openssh/initrd/emergency/tor host keys + cert, zerotier identity+ip, zfs passphrase, wifi fleet creds, cameron user-password recipient ([33b86d0](https://github.com/cameronraysmith/vanixiets/commit/33b86d0c89fa3f9c4fecb05de30912986f819280))1776    * **pyrite:** put encrypted-root admin tools in the system closure ([21f0999](https://github.com/cameronraysmith/vanixiets/commit/21f09992ecf40559e978199afd8f19e063408213))1777    * **pyrite:** register the machine across clan inventory, users, and structure checks ([da284a6](https://github.com/cameronraysmith/vanixiets/commit/da284a6fc4e4763aac19bf57027cf7f3ff122119))1778    * **pyrite:** register the pyrite.zt address record on cinnabar ([88a3d35](https://github.com/cameronraysmith/vanixiets/commit/88a3d35de987914dab3a5786b601fa7b31754745))1779    * **pyrite:** replace GDM with native DankGreeter ([03c9f5f](https://github.com/cameronraysmith/vanixiets/commit/03c9f5fc24ae346b747bb3aa40171f86f2e79e0d))1780    * **pyrite:** resolve .zt names through cinnabar's zone server ([48e1705](https://github.com/cameronraysmith/vanixiets/commit/48e17051bcde02708b54ba3d88c2df4cf8bdef10))1781    * **pyrite:** resolve all DNS through the local dnscrypt-proxy ([e3375ab](https://github.com/cameronraysmith/vanixiets/commit/e3375abbd13b73c96acf01694127810f62f31a8d))1782    * **pyrite:** set MaxAuthTries to 20, matching the rest of the fleet ([02f2bc4](https://github.com/cameronraysmith/vanixiets/commit/02f2bc4b98580a1ec666e7502aeb67e6bd1eba53))1783    * **pyrite:** set stateVersion to 26.05 matching the installer ISO release ([84e2241](https://github.com/cameronraysmith/vanixiets/commit/84e2241d71f900b4be765bb9dd67552c6992d03a))1784    * **pyrite:** set the GNOME idle lock and suspend timeouts ([215cba0](https://github.com/cameronraysmith/vanixiets/commit/215cba0c77d8d3cf394f71a54eefc5b378aaa9ba))1785    * **quarto-bin:** vendor upstream quarto-cli 1.9.37 binary + nix run .#update-quarto updater ([79c8f16](https://github.com/cameronraysmith/vanixiets/commit/79c8f16c23e0ff69bbbcf846a1ec15b94e65dad3)), closes [.#update-quarto](https://github.com/./issues/update-quarto)1786    * **radicle:** run radicle-node as a user service on darwin and linux ([6ff3fa2](https://github.com/cameronraysmith/vanixiets/commit/6ff3fa2f128ae7e32d4ae021884667c74ab6464a))1787    * **release:** forecast each pull request's release as a check run ([976a4d0](https://github.com/cameronraysmith/vanixiets/commit/976a4d0438fbba67cc5afbdebe4810c0de4d6816))1788    * **secrets:** add hindsight creds ([98b5dd9](https://github.com/cameronraysmith/vanixiets/commit/98b5dd9035fe899c757f7250a602dd1310ae7dc2))1789    * **secrets:** add linear ([29c9719](https://github.com/cameronraysmith/vanixiets/commit/29c9719448b52aad363503298b74e6b2da27307c))1790    * **secrets:** wire the moshi-hook pairing token for crs58 ([cfa04a0](https://github.com/cameronraysmith/vanixiets/commit/cfa04a030afd955345af2bad94437e2e5994904e))1791    * **skill/meta-session-resume:** collapse multi-step procedure into one self-contained command ([83a4532](https://github.com/cameronraysmith/vanixiets/commit/83a4532ca9c7db366d65bf4f2b4167f3c32f0918))1792    * **skills/agentic-planning-development-workflow:** state-machine router skill ([e70d88f](https://github.com/cameronraysmith/vanixiets/commit/e70d88f8d901a1a7b67a0cf06a19c826c9ef8fb0))1793    * **skills/agentic-planning:** bind roborev gate to inline codex review (advisory, triage-surface, calibrated effort) ([13bc402](https://github.com/cameronraysmith/vanixiets/commit/13bc4027df1fd96ecfd3ac638a673c335b5a89b8))1794    * **skills/agentic-planning:** scope board execution-mode mechanisms to HIL ([8080b18](https://github.com/cameronraysmith/vanixiets/commit/8080b18fcc1cabbef7640864c0a411a5a059f80b))1795    * **skills/jj-{workflow,summary}:** avoid interactive editors with multi-boundary split, JJ_EDITOR escape hatch, SIGTERM recovery ([572841c](https://github.com/cameronraysmith/vanixiets/commit/572841c8f42183a55d0358526835911d41f7567a))1796    * **skills/jj-summary:** restructure decision tree with three-tier escalation, demote workspace to explicit-request escape hatch ([e7c3037](https://github.com/cameronraysmith/vanixiets/commit/e7c30378a8a925f7a5f9ab8095e872aa8828f1c4))1797    * **skills/jj-version-control/diamond-workflow:** formalize as canonical operational reference with bidirectional cross-references ([be5be41](https://github.com/cameronraysmith/vanixiets/commit/be5be41c29e4d1126cbba4dc89b00d5516ed59bb))1798    * **skills/jj-version-control:** consolidate development-join entity definition into canonical subsection with route-step recovery recipe ([f864e34](https://github.com/cameronraysmith/vanixiets/commit/f864e340dd9cf5a3215c1075f7ffe1d2a02652b7))1799    * **skills/jj-version-control:** establish tiered ceremony model for jj-mode work ([002a126](https://github.com/cameronraysmith/vanixiets/commit/002a126b42882353821cc45bcb57ebaaf5cba42a))1800    * **skills/jj-workflow:** reframe workspace section as explicit-user-request-only, demote isolation enumeration to informative context ([4b8ec78](https://github.com/cameronraysmith/vanixiets/commit/4b8ec7814afc9ca559ea62b8a0f428ba69c06edc))1801    * **skills/nix-flake-pr-cycle:** add validate-to-merge workflow skill with traceability-audit framing ([245b81c](https://github.com/cameronraysmith/vanixiets/commit/245b81c373c19190d6a015e4c8028aa664490a99))1802    * **skills/openspec-linear-sync:** generalize openspec/linear.yaml into a monorepo registry; move D10 ledger to per-change frontmatter ([b9fe0aa](https://github.com/cameronraysmith/vanixiets/commit/b9fe0aa6984c841c6f34613feb908736af5c6ff3))1803    * **skills/openspec-linear-sync:** linear-cli Linear/OpenSpec sync overlay skill ([5565be6](https://github.com/cameronraysmith/vanixiets/commit/5565be6776c2f7abf1cc6f5835cdd4f906998726))1804    * **skills/openspec-linear-sync:** make linear_project optional; gate archive spec-mirror on project presence (skip+log when absent) ([5b74365](https://github.com/cameronraysmith/vanixiets/commit/5b74365fb12ab1094878aee098bc8416d7f4b03a))1805    * **skills/openspec-linear-sync:** make setup/selection registry-aware and resolve document UPSERT per project ([815b449](https://github.com/cameronraysmith/vanixiets/commit/815b449de9ea6fa18b8ea1216faac448c3d78ece))1806    * **skills/openspec-linear-sync:** relocate D10 sync ledger to per-change proposal frontmatter with team-scoped state resolution ([f87a839](https://github.com/cameronraysmith/vanixiets/commit/f87a839376524d364325195ab23e634f14a835be))1807    * **skills/openspec-linear-sync:** resolve archive-mirror canonical spec path via 1.4.1 status --json (jq, repo-mode guarded) ([d16774b](https://github.com/cameronraysmith/vanixiets/commit/d16774b572ab6ae3a6c863e0b9cd9bce5ae18fc5))1808    * **skills/openspec-linear-sync:** seed and re-sync the Linear issue description from proposal.md business content ([a98d74a](https://github.com/cameronraysmith/vanixiets/commit/a98d74a48f2b886b6231846b3f0dd9d8672dbced))1809    * **skills/preferences-compositional-continuous-verification:** add theoretical anchor for compositional continuous verification ([e6696cb](https://github.com/cameronraysmith/vanixiets/commit/e6696cba848ae89ea495e1124ae1112f43ff386b))1810    * **skills/preferences-nix-checks-architecture:** add CCV meta-checks section and per-artifact observability expectation ([f21a34f](https://github.com/cameronraysmith/vanixiets/commit/f21a34fc28a0b18bc52ecc4c55112c11cf45ca71))1811    * **skills/preferences-nix-ci-cd-integration:** disambiguate compositional continuous verification from existing continuous-validation references ([1308096](https://github.com/cameronraysmith/vanixiets/commit/130809692efb5f05087f3a5cf1d08c2edb24858a))1812    * **skills/preferences-observability-engineering:** frame observability checks as first-class CCV regulators ([bdff03e](https://github.com/cameronraysmith/vanixiets/commit/bdff03ec6d07844cdfc45fb9d8855d81724a6b04))1813    * **skills/preferences-production-readiness:** disambiguate narrow continuous validation from compositional continuous verification ([674ac81](https://github.com/cameronraysmith/vanixiets/commit/674ac8123f497ea16ae17ad6a1b0d3a6d8e42d84))1814    * **skills/preferences-validation-assurance:** cross-ref CCV as systems operationalization of severity, refinement, and confidence promotion ([d2a9432](https://github.com/cameronraysmith/vanixiets/commit/d2a94329c666d2cf6064bb1d6031314ff4bb91f1))1815    * **skills/project-management:** human-facing PM hub skill ([7986cc4](https://github.com/cameronraysmith/vanixiets/commit/7986cc470659af8889c8ce3052aed32e10d5b21f))1816    * **skills/theoretical-foundations:** add type-checked Lean and Python worked example ([7faabbc](https://github.com/cameronraysmith/vanixiets/commit/7faabbc4ee65fc7266c21137278ab02d09c34544))1817    * **skills:** add aiSkills.extraSkillDirs store-path hook to skills injector ([7ac8bb4](https://github.com/cameronraysmith/vanixiets/commit/7ac8bb4f0564c241c7c6d43b48a944482f18fc4c))1818    * **skills:** add atdd-outer-loop skill ([b7081e9](https://github.com/cameronraysmith/vanixiets/commit/b7081e9f26070a6f4c29c807a99da249669e1182))1819    * **skills:** add bdd-gherkin-formulation skill ([078deaf](https://github.com/cameronraysmith/vanixiets/commit/078deaf1396ab8c3be3ed783676bf0d02c9118c5))1820    * **skills:** add bdd-step-definitions skill ([6aa8488](https://github.com/cameronraysmith/vanixiets/commit/6aa8488af5f50924b8f1241c604eaf76a00983fa))1821    * **skills:** add dependency-source-acquisition skill for ghq-based source review ([58e716e](https://github.com/cameronraysmith/vanixiets/commit/58e716ead2334409dcd08762b00a618cbca3bf23))1822    * **skills:** add meta-orchestrator-checkpoint handoff-payload-schema sub-file ([f38245e](https://github.com/cameronraysmith/vanixiets/commit/f38245e42b3f5cdfa0b6742efdb14debb2f7119b))1823    * **skills:** add meta-orchestrator-checkpoint routing-layer SKILL.md ([d52ca5d](https://github.com/cameronraysmith/vanixiets/commit/d52ca5d8c0484bd480392637c108363deb3746bd))1824    * **skills:** add meta-orchestrator-initiate discipline-and-cycle-patterns sub-file ([1b69e0c](https://github.com/cameronraysmith/vanixiets/commit/1b69e0cce523fbf1ff851d8fa6d0ab4b6a9ed37d))1825    * **skills:** add meta-orchestrator-initiate exemplar-session sub-file ([71a6bc8](https://github.com/cameronraysmith/vanixiets/commit/71a6bc87a1b2aab82fea609c1ed087d5e9558d9b))1826    * **skills:** add meta-orchestrator-initiate operational-patterns sub-file ([e9ddd81](https://github.com/cameronraysmith/vanixiets/commit/e9ddd817cf88c29872af513d3226086cdfd9219e))1827    * **skills:** add meta-orchestrator-initiate routing-layer SKILL.md ([8837eda](https://github.com/cameronraysmith/vanixiets/commit/8837edafee791b57737495b40022e4964db83e1e))1828    * **skills:** add meta-orchestrator-initiate spawn-prompt-template sub-file ([4c2a763](https://github.com/cameronraysmith/vanixiets/commit/4c2a763ecdb0559089d26b4dfa9549e8b8755fa3))1829    * **skills:** add meta-orchestrator-initiate tier-and-gate sub-file ([be10082](https://github.com/cameronraysmith/vanixiets/commit/be10082f20e2eae4dd9257c704ec1a6b18b97576))1830    * **skills:** add nucleus-platform thin-router skill ([37a9699](https://github.com/cameronraysmith/vanixiets/commit/37a9699ab6228d2fbaf129ac55f49e17fafa7146))1831    * **skills:** add preferences-comment-cleanup uncomment workflow skill ([2b0dd02](https://github.com/cameronraysmith/vanixiets/commit/2b0dd02bf5298d922e2a2df7a6b02ce8b1be6df3))1832    * **skills:** add preferences-workflow-orchestration-algebra core skill ([c19349c](https://github.com/cameronraysmith/vanixiets/commit/c19349c642f42d2220117099addc380b1566dd14))1833    * **skills:** add prose-clarity, essential-complexity, ci-log-verification skills and jj hazards reference ([ced2c4d](https://github.com/cameronraysmith/vanixiets/commit/ced2c4d3d52ca23f5156decbeccea02bb9007187))1834    * **skills:** add the README hierarchy as a documentation tier ([3665eb0](https://github.com/cameronraysmith/vanixiets/commit/3665eb0b56679848b50282a921684d44a0dbf805))1835    * **skills:** add the satisfaction argument audit ([bcd5655](https://github.com/cameronraysmith/vanixiets/commit/bcd565546b687bc0a83308f91b4f5998cf20fffc))1836    * **skills:** add the stratum dimension to the acceptance layer ([8fe17e7](https://github.com/cameronraysmith/vanixiets/commit/8fe17e7aaa841a207b057823d4fcc7cca1c281f2))1837    * **skills:** add the WRSPM requirements engineering hub ([fabb6c3](https://github.com/cameronraysmith/vanixiets/commit/fabb6c335fda15effaac5f6cb596d4c9bcc66f33))1838    * **skills:** additively integrate executable-specification-testing into the HIL TDD apply path ([e6b4394](https://github.com/cameronraysmith/vanixiets/commit/e6b439478f8a00d8f9bfa382a650e431e20044b6))1839    * **skills:** allow jj-workflow auto-invocation by removing disable-model-invocation flag ([278e19e](https://github.com/cameronraysmith/vanixiets/commit/278e19ed9d458e06e6fd9f4e9f71d6421d602f91))1840    * **skills:** bump superpowers to v6.3.0 and mattpocock to v1.2.3 ([2cec15a](https://github.com/cameronraysmith/vanixiets/commit/2cec15aa4a630f20acc7c7639764fbbf0c14c7e1))1841    * **skills:** bump worktrunk to v0.76.0 ([8ed34f4](https://github.com/cameronraysmith/vanixiets/commit/8ed34f4aff7ab101f6a83952bf01d3cf8146b02b))1842    * **skills:** cohere data-modeling siblings with the LinkML lowering-path bifurcation ([30e7759](https://github.com/cameronraysmith/vanixiets/commit/30e77598eaa07e4fb8c41be695f1e262c8f81d4c))1843    * **skills:** compress diamond-workflow paraphrases across jj-workflow, jj-summary, 03-jj-mode to pointer summaries with canonical link ([e29017b](https://github.com/cameronraysmith/vanixiets/commit/e29017b84802d5a28b09269b6ff225e141a6a3ba))1844    * **skills:** cross-ref CCV from scientific-inquiry-methodology, session-orient, session-review ([9016bd4](https://github.com/cameronraysmith/vanixiets/commit/9016bd45791d798af992c8ce3864e67eae7cc656))1845    * **skills:** deliver ~/.agents/skills as real files for codex (codex skips symlinked SKILL.md leaves) ([b0cb66f](https://github.com/cameronraysmith/vanixiets/commit/b0cb66fcf8ec14fb9fe7001bff59fe48e9d23871))1846    * **skills:** ground discovery and glossary in designation discipline ([aaf5064](https://github.com/cameronraysmith/vanixiets/commit/aaf50643b2fe24be0cea68a22f02f73277228dfd))1847    * **skills:** harden @-stays-[wip] diamond invariant across version-control skills ([85c7fb0](https://github.com/cameronraysmith/vanixiets/commit/85c7fb0a8dff4a472299bbcfdbc69f00229e8116))1848    * **skills:** own contract and institution theory in foundations ([b479a18](https://github.com/cameronraysmith/vanixiets/commit/b479a18e8265483cb43daff8c31f458735d80ac3))1849    * **skills:** propagate the linear-cli skill through planning-and-development ([62ad543](https://github.com/cameronraysmith/vanixiets/commit/62ad543627ab0b4d9b2725ab7352e21695e3d4c2))1850    * **skills:** record Linear assignee and label conventions at creation ([3463998](https://github.com/cameronraysmith/vanixiets/commit/34639980d660fa96aa52da966994b3124fc818a1))1851    * **skills:** record the WRSPM shear and the openspec corpus relationship ([f035f0b](https://github.com/cameronraysmith/vanixiets/commit/f035f0ba9eb104f42f718e9f35dc839f335414e4))1852    * **skills:** refine workflow-orchestration-algebra from dogfooding ([9a10484](https://github.com/cameronraysmith/vanixiets/commit/9a104842d0c03fb958a40a4bf2bfce37051949b0))1853    * **skills:** route the satisfaction argument through the verification triad ([6a0eb0e](https://github.com/cameronraysmith/vanixiets/commit/6a0eb0ec35f39162f1f67018501d14fa9f49dd12))1854    * **skills:** scaffold testing-and-quality apm group ([c59fd78](https://github.com/cameronraysmith/vanixiets/commit/c59fd781cf391fa7f6140944fe94059fe0e09ebe))1855    * **stack-land:** add hermetic landing mechanism ([33f94e2](https://github.com/cameronraysmith/vanixiets/commit/33f94e2ce211948a8ccabbd6e712ef812aa48765))1856    * **stack-land:** demote the landing tool to assertion-only diagnostics ([138f311](https://github.com/cameronraysmith/vanixiets/commit/138f311dae305a9a2b516514dd40e9d2f803a6a5))1857    * **system:** add the stibnite build-access module and wire both machines ([4d39c00](https://github.com/cameronraysmith/vanixiets/commit/4d39c00b1878bfa0c71ce2d6516da52c80eefb35))1858    * **system:** declare mosh across nixos and darwin machines ([a1639fd](https://github.com/cameronraysmith/vanixiets/commit/a1639fdf2b5a4e3b6260831b5c4a3b9d5b8477b9))1859    * **terranix:** add kb + auth Cloudflare DNS records (CNAME -> magnetite) ([7fbcb42](https://github.com/cameronraysmith/vanixiets/commit/7fbcb42d60bc2a43a5deb044aa36478dc5122d22))1860    * **terranix:** adopt the sciexp R2 bucket and own its lifecycle rules ([53b1e96](https://github.com/cameronraysmith/vanixiets/commit/53b1e96702b0d2afe521fded4839c5982053c620))1861    * **terranix:** pre-emptively add accounts.scientistexperience.net CNAME for kanidm ([1845430](https://github.com/cameronraysmith/vanixiets/commit/1845430a0a69d1bc93b6d683e9707a59a48f83d6))1862    * **test-and-quality:** add bdd skills ([75ec0af](https://github.com/cameronraysmith/vanixiets/commit/75ec0af959df163180fc1e245d34ed35f98a2fb5))1863    * **testing-and-quality:** add executable-specification-testing skill and wire atdd/algebraic-laws routing ([b63d136](https://github.com/cameronraysmith/vanixiets/commit/b63d136be7819e2e4d04f6c163aa8f4b48422fcd))1864    * **tm-restore:** register restored directory destinations with zoxide ([3420734](https://github.com/cameronraysmith/vanixiets/commit/3420734b76cf95f56491a6750976c2b7fd2d632e))1865    * **tmux:** scrub HM session-vars guards on activation ([acb2282](https://github.com/cameronraysmith/vanixiets/commit/acb228243e8c5b14e52b0e77c0bd81b83370da52))1866    * **tools/git:** add jj-linearize-join script and nix wrapper ([c46bd4e](https://github.com/cameronraysmith/vanixiets/commit/c46bd4ec9c0c1e4dcc73be8bd38da5f4544f16e9))1867    * **tools/git:** add jj-stack-submit script and nix wrapper ([327b198](https://github.com/cameronraysmith/vanixiets/commit/327b198df7cf6003d1a7baaf27e1ac844c4b3c1f))1868    * **tools:** add nixbot-logs CLI for nixbot build log retrieval ([d07a0f8](https://github.com/cameronraysmith/vanixiets/commit/d07a0f8bde7d5bcf57d692bdbf92aad313dcfc04))1869    * **tools:** replace gh-approve-open-prs with gh-queue-open-prs ([653ae31](https://github.com/cameronraysmith/vanixiets/commit/653ae31be4627626d079e506e167ffde1a167001)), closes [#approve-open-prs](https://github.com/cameronraysmith/vanixiets/issues/approve-open-prs) [#queue-open-prs](https://github.com/cameronraysmith/vanixiets/issues/queue-open-prs)1870    * **tuicr:** deliver the upstream skill bundle with the pinned package ([004dfea](https://github.com/cameronraysmith/vanixiets/commit/004dfea93725b4b01496e895d459a80e6b8ca214))1871    * **uncomment:** init config ([f3482c6](https://github.com/cameronraysmith/vanixiets/commit/f3482c69fea57b301a7aea1468eb5a6d7ab47b0d))1872    * **wezterm:** add Shift+Enter soft-newline keybind ([f79c5c9](https://github.com/cameronraysmith/vanixiets/commit/f79c5c93500d1db62637e2e969f051f4bcd94c78))1873    * **workflows:** add dedicated Omnigent worker lifecycle ([cce8918](https://github.com/cameronraysmith/vanixiets/commit/cce89188d18afe0ae0634a8b824f1ecf969e8992))1874    * **workflows:** add Janette identity and credential phases ([c59d94f](https://github.com/cameronraysmith/vanixiets/commit/c59d94fd263beaee9850390ce5db10ed7a57bb6f))1875    * **workflows:** add stand-up-gitea-mq durable execution workflow ([3f0f6d3](https://github.com/cameronraysmith/vanixiets/commit/3f0f6d3b041f44df62af2142587ae01d7ef9d92a))1876    * **workflows:** add the atomic derivation bump workflow ([31f8656](https://github.com/cameronraysmith/vanixiets/commit/31f86568dab026e45c847b4473ebb4a427e7c4b9)), closes [.#atomic](https://github.com/./issues/atomic)1877    * **workflows:** apply terraform from an integrated source and adopt routed slices ([edda078](https://github.com/cameronraysmith/vanixiets/commit/edda0780388e50ace4fea73c694d25185799b38f))1878    * **workflows:** defer app installation and adopt an already-routed S1 ([15f2280](https://github.com/cameronraysmith/vanixiets/commit/15f22804edf5b9fa45d7b657a5712889a55b790a))1879    * **workflows:** generalize derivation bump workflow ([00fbc80](https://github.com/cameronraysmith/vanixiets/commit/00fbc8095fed2ca18b1018f262680cc2031f42c5))1880    * **workflows:** let stand-up-gitea-mq adopt an S1 implementation already in the working copy ([79193d4](https://github.com/cameronraysmith/vanixiets/commit/79193d4233531bed649cc805e2498e1948e661c7))18811882### Performance Improvements18831884    * **checks:** assert omnigent capability rejections with one composite home ([6b723a1](https://github.com/cameronraysmith/vanixiets/commit/6b723a17427265662b802f7f591f41a8c5f7ffff))1885    * **checks:** assert omnigent fleet obligations on the machine checks ([501ec37](https://github.com/cameronraysmith/vanixiets/commit/501ec37517a80ce7d06a2b8577aadf312c74620f))1886    * **cognee:** switch chat model to gpt-5-nano to cut LLM completion cost ([fe80d31](https://github.com/cameronraysmith/vanixiets/commit/fe80d315b714649c8fc2fb457ffcef2b8f1da320))1887    * **devshells:** only compose agent context when AGENTS.md is absent ([a728ccc](https://github.com/cameronraysmith/vanixiets/commit/a728ccc43b0c2b9f80640fec5ab7d2260d369256))1888    * **docs:** consume vanixiets-docs-deps and narrow its workspace cache entry ([01c1b57](https://github.com/cameronraysmith/vanixiets/commit/01c1b57c56eda1a8cfc5fe6a34eea193dd677a05))1889    * **magnetite:** raise nix daemon cache-fetch concurrency ([023c5a5](https://github.com/cameronraysmith/vanixiets/commit/023c5a5253d05388d6c504037a7af780ccaf6112))1890    * **nixbot:** raise eval workers to 6 to shorten the serial eval chain ([45b05a5](https://github.com/cameronraysmith/vanixiets/commit/45b05a549393765caa68ac86a14809dcd41e0958))1891    * **nixbot:** run 8 eval workers at 4096 MiB under a 12 GiB MemoryHigh ([e2b51e9](https://github.com/cameronraysmith/vanixiets/commit/e2b51e9d121524d30580e599d0ef168d6620f4b2))1892    * **pyrite:** declare nix job concurrency against its actual hardware ([e047814](https://github.com/cameronraysmith/vanixiets/commit/e04781434e81fd9c10030d202320c0fd71940b4b))18931894### Reverts18951896    * Revert "chore(caches): disable cachix" ([94a1489](https://github.com/cameronraysmith/vanixiets/commit/94a14892446ee366694c6ef42a13caf92eb33829))18971898### BREAKING CHANGES18991900    * pkgs.dbt-fusion no longer provides dbt-lsp; use1901      `dbtf lsp`. Nothing in this repository referenced dbt-lsp.19021903Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a696419041905RELEASE-PLAN: evidence-worker 0.6.3 -> 1.0.0