building '/nix/store/i47frri07xpca7v2gv7jzl8qbxhizbml-effect-release-packages-env.drv'... RELEASE-PLAN-CLONE-START: https://github.com/cameronraysmith/vanixiets.git #3306 b5ca2e2d664afd6ef7491dbcb789ae3b6e8af7e3 RELEASE-PACKAGES-ACTION: plan (#3306 at b5ca2e2d664afd6ef7491dbcb789ae3b6e8af7e3 onto main at f41e741270e9a382a9b1de33bbe278568f17e00f) packages discovered: [{"name":"docs","path":"packages/docs"},{"name":"evidence-worker","path":"packages/evidence-worker"}] RELEASE-PACKAGE-ITERATION: packages/docs running semantic-release in packages/docs... [4:33:00 PM] [[secure]] › ℹ Running [secure] version 25.0.9 [4:33:01 PM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/changelog" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/changelog" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github" [4:33:01 PM] [[secure]] › ✔ Loaded plugin "success" from "[secure]-major-tag" [4:33:01 PM] [[secure]] › ⚠ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode [4:33:01 PM] [[secure]] › ✔ Allowed to push to the Git repository [4:33:01 PM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/changelog" [4:33:01 PM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/changelog" [4:33:01 PM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github" [4:33:01 PM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication [4:33:02 PM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github" [4:33:02 PM] [[secure]] › ℹ Found git tag @vanixiets/docs-v0.13.0 associated with version 0.13.0 on branch main [4:33:02 PM] [[secure]] › ℹ Found 8 commits since last release [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Found 2 commits for package @vanixiets/docs since last release [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analyzing commit: feat(effects): publish browser evidence once per settled pull request build, including reused builds nixbot reuses a terminal build for a pushed commit with an identical tree and then delivers pull_request but no build_finished, so a PR returning to an already-built tree kept a stale comment (#3304, head bab7fb26 reused build 1014). The effect now runs on pull_request after every succeeded build, fresh or reused, and on build_finished for failed builds only, under one shared lock. The when.permission gate is removed: nixbot's CI approval already gates which builds run, and the gate skipped bot-authored PRs such as Renovate's. Change-Id: I92b37b7b2d5f644907ba3e2018e9e1026a6a6964 [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ The release type for the commit is minor [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a6964 [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ The commit should not trigger a release [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analysis of 2 commits complete: minor release [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer" [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/release-notes-generator" does not provide step "analyzeCommits" [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/changelog" does not provide step "analyzeCommits" [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/github" does not provide step "analyzeCommits" [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "[secure]-major-tag" does not provide step "analyzeCommits" [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ The next release version is 0.14.0 [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/commit-analyzer" does not provide step "generateNotes" [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Start step "generateNotes" of plugin "@[secure]/release-notes-generator" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Found 2 commits for package @vanixiets/docs since last release [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Completed step "generateNotes" of plugin "@[secure]/release-notes-generator" [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/changelog" does not provide step "generateNotes" [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/github" does not provide step "generateNotes" [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "[secure]-major-tag" does not provide step "generateNotes" [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins [4:33:02 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "[Function: [secure]-monorepo]" [4:33:02 PM] [[secure]] › ⚠ Skip step "prepare" of plugin "@[secure]/changelog" in dry-run mode [4:33:02 PM] [[secure]] › ⚠ Skip @vanixiets/docs-v0.14.0 tag creation in dry-run mode [4:33:02 PM] [[secure]] › ⚠ Skip step "publish" of plugin "@[secure]/github" in dry-run mode [4:33:02 PM] [[secure]] › ⚠ Skip step "success" of plugin "@[secure]/github" in dry-run mode [4:33:02 PM] [[secure]] › ⚠ Skip step "success" of plugin "[secure]-major-tag" in dry-run mode [4:33:02 PM] [[secure]] › ✔ Published release 0.14.0 on default channel [4:33:02 PM] [[secure]] › ℹ Release note for version 0.14.0: ## @vanixiets/docs-v0.14.0 (https://github.com/cameronraysmith/vanixiets/compare/@vanixiets/docs-v0.13.0...@vanixiets/docs-v0.14.0) (2026-10-03) ### Features * **effects:** publish browser evidence once per settled pull request build, including reused builds ([b5ca2e2](https://github.com/cameronraysmith/vanixiets/commit/b5ca2e2d664afd6ef7491dbcb789ae3b6e8af7e3)), closes [#3304](https://github.com/cameronraysmith/vanixiets/issues/3304) RELEASE-PLAN: docs 0.13.0 -> 0.14.0 RELEASE-PACKAGE-ITERATION: packages/evidence-worker running semantic-release in packages/evidence-worker... [4:33:04 PM] [[secure]] › ℹ Running [secure] version 25.0.9 [4:33:04 PM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/npm" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "analyzeCommits" from "@[secure]/commit-analyzer" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "generateNotes" from "@[secure]/release-notes-generator" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/npm" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/npm" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/npm" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github" [4:33:04 PM] [[secure]] › ✔ Loaded plugin "fail" from "@[secure]/github" [4:33:04 PM] [[secure]] › ⚠ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git in dry-run mode [4:33:04 PM] [[secure]] › ✔ Allowed to push to the Git repository [4:33:04 PM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/npm" [4:33:04 PM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/npm" [4:33:04 PM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github" [4:33:04 PM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication [4:33:05 PM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github" [4:33:05 PM] [[secure]] › ℹ Found git tag v0.6.3 associated with version 0.6.3 on branch main [4:33:05 PM] [[secure]] › ℹ Found 2275 commits since last release [4:33:05 PM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer" [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Simulated merge of pull request #3306 into main for the release plan [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): publish browser evidence once per settled pull request build, including reused builds nixbot reuses a terminal build for a pushed commit with an identical tree and then delivers pull_request but no build_finished, so a PR returning to an already-built tree kept a stale comment (#3304, head bab7fb26 reused build 1014). The effect now runs on pull_request after every succeeded build, fresh or reused, and on build_finished for failed builds only, under one shared lock. The when.permission gate is removed: nixbot's CI approval already gates which builds run, and the gate skipped bot-authored PRs such as Renovate's. Change-Id: I92b37b7b2d5f644907ba3e2018e9e1026a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): publish browser evidence on build_finished and main pushes Change-Id: Iefc0a86c16780cfc0e3510a99d9844416a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(publish-evidence): publish each distinct report once and comment only on pull requests that change it Change-Id: I10c6813e147769c60a45d62b4153d7de6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(evidence-worker): serve browser evidence read-only from R2 Change-Id: I74a6a4974b4dd6c81fb45a27267e87786a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(terranix): adopt the sciexp R2 bucket and own its lifecycle rules Change-Id: I72ccef728d044fca6ac751d3412629636a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): provision R2 evidence credentials for the effects runner Change-Id: If5d2b9f244dece12246fe7962d4224086a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 1f817ce55e449026c169c51d0db567d1c335fb93 into gitea-mq/batch/57 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(clan): replace per-machine builder modules with a nix-builders service Change-Id: I190a8bbe177d27389703a5f887d3e86e6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): mark queued pull requests and add a dequeue key PR tags now show whether a PR is queued to land: an open PR with auto-merge enabled, or carrying the merge-queue label (a stack's top), renders #N⇡ next to its bookmark. Merged (✓) and closed (✗) still take precedence, and the reused-branch rule is unchanged. jj-pr-sync fetches the two extra fields in the same request. `jj-pr dequeue`, bound to G d in jjui, withdraws the GitHub signal that authorized landing: auto-merge is disabled, or the merge-queue label is removed. gitea-mq treats both as a dequeue, including from an in-flight batch. An unqueued PR is a no-op; a merged PR reports when it merged, since a landed batch cannot be undone. Each change refreshes the tags at once. jj-pr-tags-rehearsal gains rows for the queued marker on a single PR and a labelled stack top, and for every dequeue outcome, judged by the gh mutations made. Change-Id: Ic011d2e749a8b10228253cf10ff018376a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix Change-Id: Ie1ca1c075cb5cc70fe50173fcc480d096a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep runner-control deadlines above browser setup under load Playwright's test deadline also covers context and page setup. Under builder load setup exceeded the 5 s deadline, so controls failed as test-level deadlines (infrastructure) before their own failure ran (nixbot builds 1000, 1001). Each control's failure stays bounded by its own mechanism. Change-Id: Ic05f5683ec74a702033b0c40688995e56a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge bec748fc0a820563329385f1a04e0096b94da7be into gitea-mq/batch/55 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): show pull request numbers next to bookmarks jj has no forge integration, so which bookmark is which PR was invisible in `jj log` and jjui, and enqueueing meant leaving the graph for gh-dash. - `jj-pr-sync`, run once in a repository, registers it and caches `gh pr list` as a jj config file in conf.d scoped to that repository (`--when.repositories`). A branch name reused across PRs maps to its open PR, else its newest; merged and closed PRs are marked ✓ and ✗. - A user service (launchd agent on darwin, systemd timer on Linux) runs `jj-pr-sync --all` every five minutes at background priority. A refresh that cannot reach GitHub keeps the previous mapping; a repository that no longer exists is unregistered; a lock prevents overlapping runs. - An override of `format_commit_labels(commit)` keeps jj's builtin labels and appends each bookmark's PR number, in `jj log` and jjui alike. - jjui, on a revision's bookmark: `G o` opens its PR; `G m` enqueues a single PR (auto-merge, rebase) and `G M` labels the topmost PR of a stack merge-queue, mirroring gh-dash's m/M. `jj-pr` applies the landing protocol: it refuses drafts, auto-merge on stack members, and labels on anything but a stack's top, and is a no-op when already enqueued. Each action refreshes the tags immediately. jj-pr-tags-rehearsal runs against a stubbed gh in scratch jj repositories: registration and rendering (reused, merged, slash-named and PR-less bookmarks; no leakage into another repository), --all refresh, offline retention and unregistration, every enqueue decision judged by the gh mutations made, no G-prefix collision with the packaged jjui's default bindings, and drift of jj's builtin format_commit_labels. Change-Id: I7468279a834fb1fea2876295a64c921a6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(secrets): rotate the Cloudflare effects token The docs preview and production effects, and the local docs recipes, used a user API token that expires on 2026-10-24. They now use an account API token (vanixiets-effects, expiring 2027-10-02) limited to Workers: Editor on the account and Workers Routes: Write on the cameronraysmith.net zone, which serves the docs custom domain. Updated in secrets/shared.yaml and in magnetite's vanixiets-effects-secrets var; the account ID and GitHub token are unchanged, only re-encrypted. Change-Id: I24963c05cb0bfc454231e0280b6709476a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: claude-code: 2.1.286 -> 2.1.288 Change-Id: Iacd4ed321e4898358b12d43f02590c366a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix Change-Id: I09dee06e0e5db47e519e3bc3354891416a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency @types/node to ^26.6.4 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep WebKit failure screenshots in Darwin build reports On aarch64-darwin, Nix build users have no LaunchServices database, so WebKit's image encoder returns an empty data URL and Playwright writes a 0-byte failure screenshot without raising an error. The report validator rightly rejects empty attachments, so a WebKit product failure on Darwin kept no report. A shared test fixture now replaces a 0-byte WebKit screenshot with the latest screencast frame, or fails the attempt as infrastructure if none exists. e2e-webkit-negative-control proves that a WebKit failure keeps a real PNG. Change-Id: I01c2ad58cb950529278fb87dda109414ead21c09 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): give each browser report build its own preview ports Darwin Nix builds are unsandboxed and share the host network, so report derivations built at once all served on localhost:4321 and raced for the workerd inspector port from 9229; one build's server broke another's tests. The report build now picks a free loopback port and passes it to Playwright as DOCS_PREVIEW_PORT, and sets DOCS_DISABLE_WORKER_INSPECTOR so astro preview opens no inspector. Local runs keep 4321 and the inspector. Change-Id: Ia0c3192bbfed2940fbd062e68105432e6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep the homepage hero within narrow viewports The homepage hero uses raw markup inside Starlight's .hero-html wrapper, which Starlight sizes but does not constrain. On phones the image overflowed and widened the layout viewport past the device, cutting off the logo and header search. The mobile scenario now requires no horizontal overflow and a hero image inside the viewport; it failed on all three engines before the CSS fix and passes after it. Change-Id: Id64a1dfa32e0a68946327dba89fc8362f7f62473 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): publish validated browser evidence from finished builds publish-evidence is the trusted build_finished sidecar. It finds the docs report check through nixbot's build API, validates it with its own copy of validate-report.mjs, and copies run.json, completion.json and the referenced PNG screenshots beside a deterministic receipt. Unsafe paths, symlinks, non-PNG data and identity mismatches are rejected; missing outputs are reported, never rebuilt. No effect runs it yet: storage, access and retention are undecided, so publication ends at a local --out directory. publish-evidence-rehearsal covers each case against a loopback API and a chroot store. Change-Id: I9adcceeed84b3fe7e7c86c572fdc8f5b5a0d7b02 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(agents): relock root apm lock for the playwright-cli skill The planning-and-development plugin gained the microsoft/playwright-cli skill dependency in #3265. The root lock follows published plugin refs on main, so it could only record that dependency after the merge. Change-Id: I9d4bfe9b21276c10c2ef01b88c6d689389875957 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge cb6fceccfd628dca78c94bf290a8012922987d56 into gitea-mq/batch/51 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 81224d254ba7ee571a4299b021c7eec338b0bc48 into gitea-mq/batch/50 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(docs): type the browser evidence tooling Change-Id: I356b84749e0208e8cb45b4cfa884595b6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep browser evidence valid under CI build contention nixbot build 951 failed correct docs changes with navigation timeouts while three PRs built on magnetite. The builders run cores = 0, so each concurrent report build got NIX_BUILD_CORES=16 and started 16 workers against its own astro preview, and the validator rejected the run even where retries recovered, because it required every failed attempt to be a product failure. Report builds now run at most four workers. Navigations no longer have their own 10 s deadline, since a failed navigation is never product evidence. An infrastructure-class attempt, including a test deadline, is accepted only when a later attempt of the same test completed, and is counted as infrastructureRetries; a terminal one still invalidates the report. The negative controls inherit the suite's retries and require every attempt to fail with a product-class terminal attempt. Change-Id: I50a0cab69083ddca584cdea07880a5d7a03f0963 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge d23c077f79b6e0df7e6f89cc5a15629882201f39 into gitea-mq/batch/49 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track playwright-cli's flake upstream instead of a rev pin The input was pinned to a commit of halfwhey/nix-playwright-nightly, but the CLI release is already fixed in pkgs/by-name/playwright-cli (version 0.1.21, read from the flake's pins/cli/0.1.21.json), and apm-skills-compose guards that version against the skill's apm.yml ref. Upstream keeps every release pin (0.1.5 through 0.1.22, none ever deleted), so tracking its default branch cannot change what we build; the commit pin only routed this input through Renovate digest PRs instead of the flake-updater bot like the other inputs. Relocking advances to 59e4df6 (the commit #3268 proposed); the CLI stays 0.1.21. Change-Id: If28f81c80c8c25ae75eb31597cc4413e6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fa357c817941e5ec5128060962347991454ddc9 into gitea-mq/batch/48 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 42d26efa13b47b99956ee33f3a973412c99b9bb1 into gitea-mq/batch/48 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: openspec: update artifacts for 1.11.0 -> 1.14.0 Regenerated with `just openspec-regen`. The vendored workflow skills were last generated by 1.11.0 while the packaged CLI is 1.14.0. Every removed line traces to OpenSpec v1.11.0's own templates, so no local text is lost; the skill set is unchanged. Change-Id: I30a25ccf3763955308b686890f9e10786a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix Change-Id: Idfa8f8dee160ce27f5c3a900de4c4e616a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(darwin): stop the DNS resolver check aborting activation The post-activation check read the active resolver with `scutil --dns | awk '... { print; exit }'`. awk exited after the first match while scutil was still writing; scutil then died of SIGPIPE, and under the activation's pipefail the `$(...)` assignment failed with 141 and set -e aborted activation (seen on stibnite once its resolver list grew). awk now keeps reading to the end and prints only the first match. Change-Id: I677b7ec56ea4b1350aceeb8f3d4304156a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: ci: evaluate without import-from-derivation nixbot now evaluates with allow-import-from-derivation = false, through NIX_CONFIG on its unit, which nixbot forwards into its evaluator sandbox; buildbot-nix and interactive use are unaffected. `just check-ifd` runs the same evaluation locally for all three systems without building anything. The flake deliberately leaves the setting out of nixConfig: with accept-flake-config it would override both the command line and nixbot's NIX_CONFIG. preferences-nix-development records the rule: why IFD is avoided, the IFD-free patterns, the enforcement, and the bar for an exception. Change-Id: I98fc5ca74a8db78ac2dd8bc96f97a0e66a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(cryolite): require import-from-derivation-free rendering The cryolite tree and the capi-cryolite render must evaluate on every system with import-from-derivation disallowed: charts, CRDs and upstream YAML enter evaluation only as committed JSON goldens or flake-input files, and a sandboxed regulator re-renders and diffs them. Adds R17, SP24 and AC24 to the charter, requirements and tasks to both OpenSpec changes, tightens the platform VM regulator's chart sourcing, and corrects the statements that still listed the retired nixidy checks. Change-Id: I25b495d6d47706cc95b1432f4173d9b76a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(checks): retire the local k8s and nixidy checks The k8s-manifests-local*, nixidy-*-local-k3d and k8s-cilium-compat checks and the k8s-deploy-* apps in apps-build rendered Helm charts and YAML at evaluation time, about 29 evaluation-time builds per system for output identical on every system. The local cluster is a frozen prototype; the code stays and remains buildable on demand. The cryolite programme reintroduces cluster checks with IFD-free rendering. Change-Id: Ie302e3d90e4f0b754b2014694eff54866a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(omnigent): test the credential policy without a synthetic clan machine omnigent-worker-credentials evaluated a synthetic clan machine over a committed tree of fake sops secrets, only so clan's sops backend would resolve vars paths, and mostly asserted that options forwarded those paths. It also needed import-from-derivation. - flake.lib.omnigentCredentialPolicy is the one pure boundary from clan vars to the worker credential policy; the Home Manager module consumes only the policy record, including the rendered Linear credentials. - Value-level cases cover what the boundary decides: disabled sources are omitted, Linear requires the rendered template, no Linear means no template. - Delivery ordering (secrets installed before workers start, readiness in the host unit, rendered template required instead of the raw key) is asserted on the real worker hosts: magnetite, pyrite and stibnite. - Runtime behaviour (credentials.py readiness, the TS loader, gh and Linear mocks, disclosure audit) stays a hermetic build fed synthetic paths. The fixture tree and the forwarding assertions are deleted. Change-Id: Iafadccceba9fa05233c7ede63ceb61c36a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(catppuccin): read bottom and starship themes from flake inputs catppuccin's bottom and starship ports importTOML their theme from whiskers build outputs, the only import-from-derivation in the configurations of christophersmith, janettesmith, raquel, tara and ubuntu. Both ports stay enabled and read the committed themes/ of the same upstream revisions, pinned as flake = false inputs. Change-Id: Ia61f24b77f899c75edae5055a7f9f22b6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(skills): enumerate skills from a committed index Skill delivery read the built apm-skills-compose output with readDir at evaluation and wrapped every skill in builtins.path, realising that unsubstitutable output once per skill per sink (514 realisations per AI user, 1028 for stibnite). Every NixOS, darwin and home configuration of the AI users therefore needed a builder for its own platform just to evaluate. - pkgs/by-name/apm-skills-compose/skills.json lists the composed skill names; the compose build fails, printing the corrected index, when the two drift, and `just agents-skills-index` regenerates it. - Skills are `"${composed}/.claude/skills/"` strings with context: no read, no builtins.path. Home Manager passes such sources through. - aiSkills.extraSkillDirs (directories read with readDir) is replaced by aiSkills.extraSkills (name to directory) for linear-cli, tuicr and omnigraph. The delivered skill set is byte-identical: 696 home.file entries per AI user before and after. Change-Id: If1ae8e9f5a648670680e900fdf37ceac6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nixpkgs): expose flake packages only for supported systems nixpkgs re-applies the default overlay to nested package sets such as pkgsi686Linux. withSystem on i686-linux then evaluated a whole perSystem whose packages read per-system flake outputs that do not exist there (playwright-cli), so nixosConfigurations.scheelite failed to evaluate with `attribute 'i686-linux' missing`. The overlay now adds the flake's packages only for systems in config.systems. Change-Id: Iab8193713bde096ba3b9543ffa3e48fa6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(incidents): record the magnetite concurrent-evaluation OOMs Accounting for the 2026-09-27 and 2026-10-01 OOM kills: nixbot's evaluation overlapping a remote check-fast evaluation, the swap-blind nix-eval-jobs governor, the uncharged zram pool, and victim selection by nix-daemon's OOMScoreAdjust; the mitigations shipped and the measurements left for phase two. Change-Id: Ifa6aeee15ba01cd5f7711787f65f55626a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(just): choose the remote host for check-fast check-fast takes a fourth parameter, remote (magnetite by default, or pyrite), and sizes evaluation for it: magnetite keeps 4 eval workers, pyrite runs 2 with a 2 GiB per-worker cap. Remote evaluations now queue behind nixbot's on the host lock. The skill, agent-context fragment and docs describe the parameter and the waiting message. Change-Id: I367b756e6a4ec00cf61bd42ebd398b136a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(magnetite,pyrite): enable the evaluation lock and memory guards Both hosts enable the evaluation lock and MGLRU protection. pyrite also caps zram's resident pool at 55% of RAM, the recorded livelock mode; gives nix-daemon OOMScoreAdjust 250 and user@ -100, so builds and evaluators are killed before niri and DankMaterialShell; and caps its two omnigent workers at 8G combined, which previously could reach 16G on a 15.5 GiB machine. Stale headroom comments on magnetite and in buildbot.nix are corrected. nixbot's worker count, memory limits and magnetite's zram are unchanged. nix-eval-lock-wiring asserts nixbot and buildbot resolve nix-eval-jobs to the wrapper on both hosts. Change-Id: Iba3b9e2f3975daae2e61dee23989ff416a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nixos): add memory-pressure guards and an omnigent slice cap services.memoryPressureGuards enables MGLRU thrashing protection (min_ttl_ms = 1000), which makes sustained thrashing end in a prompt kill instead of a livelock. services.omnigent-host.workerSliceMemoryMax places all omnigent workers in one omnigent.slice with a combined MemoryMax; unset keeps the existing per-unit limits. Change-Id: Ib183fb9a53c9cd7c920166b1f486d1096a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nix): serialize nix-eval-jobs behind a host-wide evaluation lock Two concurrent nix-eval-jobs evaluations on magnetite (nixbot's 8 workers plus a remote `just check-fast`) exhausted RAM and zram twice. A wrapper now takes an exclusive flock on /etc/nix/eval.lock before evaluating, so evaluations on a host queue instead of overlapping; a waiter prints every 30 s which process holds the lock and since when (or that the holder is not visible from its sandbox). The evaluator then raises its own oom_score_adj to 900: nix-eval-jobs requeues a worker the kernel kills, so it is the cheapest victim. services.nixEvalLock provides the wrapper; nixbot, buildbot-nix and the home-manager nix-eval-jobs on PATH use it when enabled, which also covers remote nix-fast-build sessions. nix-eval-lock-rehearsal drives the wrapper: uncontended exec, waiting with and without a visible holder, release on holder death, exit status propagation. Change-Id: I9e6643ac44790eb0ffe00294d082b5956a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update cloudflare-workers-tooling [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: describe both verdict wiring negative fixtures Change-Id: Ied7532ff7d45fdf5c6e2c2feb7412d246a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): run report verdict CLI through symlinked paths Change-Id: I2084d4f6f61b99a554bb7330b8ae09136a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): retain browser regression evidence and version observations Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: test(nix): verify report dependencies and aggregate capabilities Change-Id: If6d1644ec30318b99cf7addf56e59b2a6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(effects): require permission guards for credentialed build-finished events Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: specify the closed-loop web verification reference design Change-Id: If14f8d7b146627ee546faa5eacbd97cc6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): preserve browser evidence behind a required verdict gate Change-Id: Iaf02384766e531cc30c510abd62877cf6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): support build-finished event registration Change-Id: I0489702282e4a89827bcd0b02a3caa906a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(ai): compose Playwright skills through shared APM capabilities Change-Id: Ifef0eea7fb531d088f68e89f482799a16a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(packages): add pinned Playwright CLI with matching browsers Change-Id: I1c568c44d8960ffd22c1bdb04965b3826a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate flake.lock [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(deps): update dependency @astrojs/starlight to v0.42.5 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency argoproj/argo-helm to argo-cd-10.9.6 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omp): plan with Opus 5.5 instead of Fable Opus 5.5 now runs planning as well as the session and delegated work, so the plan comes from the model that executes it, at 40% of Fable's price. Fable stays available when picked deliberately, and the Anthropic server-side fallback stays on for those sessions. Change-Id: Ic790baf18c08c434908f94e7fb52c7446a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(atomic): use Opus 5.5 instead of Opus 5 atomic stayed on claude-opus-5 because its bundled model registry (@bastani/pi-ai) did not know claude-opus-5-5. Since atomic 0.9.24 it does (providers/data/anthropic.json; `atomic --list-models` lists it), so the Opus fallback, the codebase-* research agents and the Opus thinking level move to claude-opus-5-5, matching omp and Claude Code. The omp comment recording the exception is removed. Change-Id: I4722e4acb437418ce1dc6d024b61f9526a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(claude-code): default to Opus 5.5 instead of Fable The session model was Fable 5.1 with Opus 5.5 only for subagents. Opus 5.5 is now the default for both: `model = "opus"`, which resolves to claude-opus-5-5 through ANTHROPIC_DEFAULT_OPUS_MODEL. Fable stays one alias away (ccfable) and keeps its medium effort setting. fallbackModel moves from Opus, which is pointless as its own fallback, to Sonnet 5. Change-Id: Ic5cd168d981e22c119a154e8d41fa1796a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(moshi): reconcile hooks after managedConfigs moshi-hook install writes into every supported agent's config, devin's included, which turned devin's store symlink into a regular file and made every second activation block on a .before-home-manager backup collision. The reconcile step was ordered after a hand-kept list of four per-agent steps that did not include devin. It now runs after the single managedConfigs step, which rewrites every file moshi touches, and managed-config-wiring asserts both halves: every config moshi writes for an enabled agent is a managed config and none is also a home.file target, and moshi orders after managedConfigs. Change-Id: I086a785cc40a31183d04eb0d4778ed426a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(ai): manage agent config files with managedConfigs Eleven agent configuration files moved from five mechanisms (install copies behind mutableSettings toggles, a shallow jq merge, two deep yq merges, and plain store symlinks) to managedConfigs: - replace (no app-owned keys): claude-code and its glm and cerebras wrappers, codex, pi, devin, openspec, omp WATCHDOG.yml; - with app-owned keys: atomic (onboarding and changelog versions), omp config.yml (setupVersion, dev.autoqaConsent), omnigent (host identity and server, 0600). The mutableSettings options, six activation steps, the three merge scripts and flake.lib.omnigentMergeConfig are removed. devin and openspec no longer render store symlinks; openspec declares completionTipSeen and atomic declares enableAnalytics = false so the first activation keeps both. crs58 declares the omp UI preferences (tui.vimMode, tui.vimModeDisplay, composer.shape) instead of relying on runtime state. The atomic, omnigent-worker and pi-agent-environment checks exercise the new program and wiring. Change-Id: Ie3e1e56e8b65f66e1df9bf289b3522046a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(home): add managedConfigs for files applications also write A configuration file that its application rewrites at runtime cannot be a home-manager store symlink: the first runtime write replaces the link with a regular file, the next activation backs it up, and the one after collides with that backup and blocks. managedConfigs. writes such a file as a real file on every activation: the declared settings, plus the `appOwned` key paths copied from the existing file. Every other key is dropped and reported by name, never by value, so state that leaked in at runtime is either declared, listed as app-owned, or removed, and keys Nix stops declaring are retracted. `externalPaths` keeps subtrees that a later activation step rewrites out of the report. Writes are atomic, honour `fileMode`, and a target that cannot be read is left untouched when app-owned keys would have to be preserved from it. The module lives in modules/home/modules beside agents-md because it is not specific to any aggregate. managed-config-rehearsal drives the program over json, yaml and toml targets, including preservation, retraction, the name-only report, unreadable targets, file modes and multi-spec failure. Change-Id: I989f1589b7c10542e045a9c4c88308c36a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix Change-Id: Id494be9893dc2095a1fe045d6b3d6e8a6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml for the linear-cli dependency Records schpet/linear-cli at 196315343d2b (v2.6.0), added to planning-and-development by #3262, with the ownership ledger for the 22 files its skill deploys, and moves the self-dependency entries to d5d75ca5. apm 0.32.0; 173 skills deployed. Change-Id: I45b6531bef4542b526eb8373ffc445cd6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fb87c3881da98fe3f2b18b60ffeeccd9953f25a into gitea-mq/batch/43 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 19610a72e7d680cd426bdb52d58795935f22ac15 into gitea-mq/batch/43 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track niri-flake and zen-browser upstream instead of rev pins The pyrite desktop check once asserted niri-flake's revision as a literal, so every flake-updater lock bump failed by construction (#3101, #3102, #3169). #3232 answered that by pinning the URL by revision and having the check assert `pinnedToDeclaredRev`, which passes only when flake.nix names a revision: the check enforced the pin it was meant to justify, and niri-flake and zen-browser moved to Renovate digest PRs while every other unpinned input goes through the flake-updater bot. Both inputs now track their upstream default branch like the rest, and the two pinnedToDeclaredRev clauses and their helpers are gone. The behavioural assertions stay: niri's options come from nixpkgs' module, and the installed Zen package is the one zen-browser provides, built against our nixpkgs. dms-src keeps its release-tag pin, which encodes a real coupling to nixpkgs' dms-shell version. Relocking advances niri-flake to dd2f795 (the commit #3261 proposed); zen-browser's upstream head is the commit it was pinned to. nixos-pyrite and every pyrite-* check build on x86_64-linux. Change-Id: I16223a5ba0d1e1889c94f935d868a9aa6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(skills): list companion skills for marketplace consumers Add a Companion skills section to the consuming-marketplace-plugins guide with upstream `apm install` lines for omnigraph, tuicr, duckdb-skills, dagster-expert, hf-cli and huggingface-datasets. They complement plugins here but are deliberately not bundled: bundling would add their descriptions to every consumer's sessions and hold them at our pins. Each command was run with apm 0.32.0 and installs exactly the named skills; tagged upstreams use release tags per the pinning policy, the tagless ones carry commit SHAs with the policy's caveat. Transitive dependencies now names the linear-cli skill that planning-and-development brings. Change-Id: I99457cfd1e89b6128737470e9d3a8ded6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omnigraph): deliver the upstream omnigraph skill with the client Wire `${programs.omnigraph.package.src}/skills` into aiSkills.extraSkillDirs, as tuicr does, so the skill comes from the same pinned source the client and server are built from and always describes the deployed version (currently v0.11.0). The definition lives on the ai aggregate in the same file, guarded on the omnigraph option existing and being enabled: tools reaches users without ai (christophersmith, janettesmith, raquel, tara), where an aiSkills definition would fail to evaluate. Change-Id: I4ae90fe76122ef1c0423bb07a4b917e66a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(skills): propagate the linear-cli skill through planning-and-development openspec-linear-sync, which planning-and-development ships to marketplace consumers, drives the linear CLI, but the upstream linear-cli skill reached only Nix users (flake.lib.linearSkillDirs). A consumer who installed the plugin with apm got a skill whose dependency was missing. - apm.yml declares `git: schpet/linear-cli`, ref 196315343d2b (the v2.6.0 tag commit), `skills: [linear-cli]`; a scratch-project `apm install schpet/linear-cli/skills/linear-cli#` with apm 0.32.0 installs exactly that skill. - pkgs.linear-cli.src pins that commit instead of the tag name, so one pin serves the package, apm's offline cache in apm-skills-compose, and the drift guard. update.sh resolves the tag commit and rewrites both package.nix and the apm.yml ref, and its platform map now lists only the two Darwin binaries package.nix pins (Linux builds from source; the Linux prefetches were downloads with no hash line to update). - apm-skills-compose pre-seeds the cache from pkgs.linear-cli.src and guards the apm.yml ref against it; the composed tree goes from 172 to 173 skills. - Nix delivery is unchanged: linear-cli joins excludedUpstreamSkills, and Nix users keep receiving it from linearSkillDirs only where they opt in, from the same pin. Change-Id: I048122dca5256fb58cc503d4c19fd4b06a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(omnigraph): fail startup fast and bootstrap new storage roots once Deploying #3257 stalled magnetite's switch-to-configuration for the full start timeout. omnigraph-server v0.11.0 loads the cluster ledger and opens every graph before binding, and any boot failure (here [cluster_state_missing] on the new, never-applied dev-graph-v9 root) exits the process within seconds. The ExecStartPost readiness probe kept polling /healthz until readinessTimeout because it never noticed the main process had died. Readiness probe (flake.lib.omnigraphReadinessProbe): - polls /readyz and exits 1 at once when $MAINPID is gone, naming the journal and the apply remedy; - treats quarantined graphs and, under requireAllGraphs, fewer served graphs than declared as permanent: the server has no runtime graph registration, and an imported-but-never-applied root boots empty yet passes /healthz; - keeps 503 and ready=false transient until the timeout. Create-once bootstrap (flake.lib.omnigraphBootstrap, unit omnigraph-cluster-bootstrap, option cluster.bootstrap.enable, default on with the cluster): `cluster status` decides whether the root has state, and a marker at /_omnigraph-markers/.initialized (outside the root's key prefix, so deleting the root never deletes it) records that it ever had state: - state and marker: nothing; - state, no marker: adopt the existing root by writing the marker; - no state, no marker: first initialization, runs the existing converge program, then writes the marker; - no state, marker: a lost root; refuse without applying. That initializes a new storageUri on deploy while keeping the protection that holds apply.auto off: a lost root is never recreated empty. S3 markers use curl SigV4 path-style requests with credentials passed on stdin; local roots must sit under /var/lib/omnigraph, the only directory the hardened units can write. The server Wants (not Requires) the bootstrap, so a refusal stays visible and the server then fails fast. Checks: omnigraph-readiness-rehearsal and omnigraph-bootstrap-rehearsal drive the real scripts against loopback HTTP/S3 stubs and a stub CLI (every probe outcome; the truth table for both marker backends, apply and status failures, S3 errors, missing endpoint, rejected roots, SigV4 path-style signing). omnigraph-wiring asserts magnetite's unit ordering and that the server's ExecStartPost is the new probe. Change-Id: I931bf6ff300ba859422474546798e1d96a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml against main and apm 0.32.0 Follows #3257. The vanixiets self-dependency moves to 8aa5fb47; the transitive worktrunk and mergify-cli entries move to the v0.80.0 and 2026.9.16.1 commits that version-control-and-forge/apm.yml now pins; the comment-cleanup ledger records uncomment.toml instead of uncommentrc.toml; content hashes follow the updated skills. Change-Id: I5a8c3678bf1382d0eaf1a42edb5a5b556a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(apm-skills-install): relock from an empty apm_modules cache apm 0.32.0 `install --update` re-fetches an already-materialized dependency only when its ref is a semver range (should_force_ref_recheck, src/apm_cli/drift.py:174-193). A literal commit pin that changed in a dependency's own manifest reuses the cached checkout and writes the old resolved_commit back into apm.lock.yaml. Plain `apm install` does detect that drift; --update does not. Observed after #3257 moved the worktrunk and mergify-cli refs in version-control-and-forge/apm.yml: the relock kept de0052d8 and 727ce50b. Relock now removes the git-ignored apm_modules/ cache first, so every dependency is resolved from its declaring manifest. Ownership of deployed files lives in the lockfile ledger, so the only cost is a re-fetch. Reproduced and verified: with main's lock and the old worktrunk checkout materialized, the patched relock resolves b49ca7ee/e7c1ebbc and matches a cache-free relock byte for byte apart from generated_at. Change-Id: I802a23af0d15cbaa526857556f6eede06a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigent): 0.15.0 -> 0.16.0 Upstream: https://github.com/omnigent-ai/omnigent/compare/v0.15.0...v0.16.0 omnigent, omnigent-client and omnigent-ui-sdk move together (wheel hashes from the PyPI JSON digests). Only the version-locked pins change in pyproject; the existing relaxations and overrides still hold. acp-readiness.patch is still needed (0.16.0 still reports acp readiness only for the bare `acp` harness) and is rebased: the ACP branch moved into _harness_availability_core behind a new Windows guard. The readiness test passes in the build. Upstream breaking notes #8137/#8143 (65,535-byte caps on saved preferences and inference snapshots) affect server-side data only. The host CLI surface, config keys and environment variables our modules use are unchanged. Change-Id: I242bf10d54e879d31acbef5573af65ed6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(mergify-cli): 2026.8.31.1 -> 2026.9.16.1 Upstream: https://github.com/Mergifyio/mergify-cli/compare/2026.8.31.1...2026.9.16.1 Bumps mergify-cli-bin and, in lockstep, agent-plugins/mergify-cli (version, releaseTag, tag commit) and the version-control-and-forge apm.yml ref. #1833 removes `mergify stack push --github-native`: native stack registration is now the default (opt out with --no-github-native or mergify-cli.stack-github-native=false). The git-stacked-pr-integration skill and the adopt-queue-landing-protocol specs now publish with `mergify stack push --trunk origin/main -R` and require the default to stay on; the ADR note and its review keep their history with a dated note. #1803/#1806/#1807 add `mergify auth login|logout|status`; the mergify.nix comment now documents the non-stack credential chain. Change-Id: I323e343a51842dcf02a1a198766125796a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nix-fast-build): do not propagate python into consumers The package's propagated build inputs put its site-packages on PYTHONPATH in every devshell that includes it, which overrides the wrapper of any other nix-fast-build binary run from that shell (a newly built one loads the old module). Remove $out/nix-support/propagated-build-inputs in postFixup, exactly as upstream's default.nix does. Change-Id: I5ce01d321cdfe1770858b78250f573856a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(nix-fast-build): 1.6.0 -> 2.0.4 Upstream: https://github.com/Mic92/nix-fast-build/compare/1.6.0...2.0.4 2.x renders build logs itself: nix-output-monitor is dropped from the wrapper PATH, --no-nom now selects the non-interactive renderer, and interactive mode turns itself off without a TTY. --no-link is a deprecated no-op (no out-links is the default), so check-fast stops passing it. Every other flag our recipes pass is unchanged; --option now reaches every nix call. The CI/CD skill's --no-nom description follows. Change-Id: Icc74b794021b6725bbdc47cd2277bc356a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(worktrunk): 0.76.0 -> 0.80.0 Upstream: https://github.com/max-sixty/worktrunk/compare/v0.76.0...v0.80.0 Bumps worktrunk-bin and, in lockstep, the agent-plugins/worktrunk source and the version-control-and-forge apm.yml ref (the apm-skills-compose drift guard requires both to name the v0.80.0 commit). Breaking upstream changes (0.77-0.80): wt list --format=json defaults to schema 2; hook JSON context keys renamed to worktree_path / repo_path / repo / primary_worktree_path; `wt config update --print` removed; oh-my-pi plugin moved to `wt config plugins omp`; `{{ branch }}` unset in a detached worktree. None is used here: the only config is programs.worktrunk enable + package. Change-Id: I08b82b5e98fec40122348980c3481fb76a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(uncomment): 3.6.0 -> 3.10.2 Upstream: https://github.com/Goldziher/uncomment/compare/v3.6.0...v3.10.2 3.8.0 makes .uncomment.toml the preferred config name (.uncommentrc.toml still loads with a deprecation warning) and makes unknown config keys a load error; scan, keep and lint subcommands are new. Rename the repository-root config to .uncomment.toml and the preferences-comment-cleanup template to uncomment.toml. The skill now states behaviour measured against 3.10.2: census via `scan --only removable --group-identical`, `keep --id` to write ~keep markers, and `--check` as the completion gate. XXX and tflint-ignore are default-kept now, so the template drops them. Change-Id: Ie379fdf60fa2c6e5650467189469dc856a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(ouroboros): 0.42.0 -> 0.55.3 Upstream: https://github.com/Q00/ouroboros/compare/v0.42.0...v0.55.3 0.55 pins mcp==2.0.0 in the [mcp] extra and mcp==1.28.1 in [claude]/[claude-sdk] and declares them conflicting, so the old `ouroboros-ai[mcp,claude,tui]` spec no longer resolves. Following the upstream README, the wrapper uses [mcp,claude-cli,tui] with `uvx --isolated --python '>=3.12'`, and the claude-code MCP server entry uses [mcp] with `--runtime claude-cli --llm-backend claude_code`, as upstream's own .mcp.json does, keeping our exact version pin. agent-plugins/ouroboros moves to the v0.55.3 tag peel. Change-Id: I5ac2e15a511b418dc5fa5bb5cbad3f2b6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigraph): 0.9.0-unstable-2026-08-05 -> 0.11.0 Upstream: https://github.com/ModernRelay/omnigraph/compare/12a8596626c80a7dceed0fd72182d421052ff8d1...v0.11.0 The unstable pin existed only because upstream published no releases; it now does, and v0.11.0 contains the old pin. rev stays a commit sha (the v0.11.0 tag peel) because OMNIGRAPH_SOURCE_VERSION is read from src.rev and upstream stamps it with a sha. update.sh now tracks the latest stable vX.Y.Z release instead of main. The lance-linalg AVX-512 VNNI postPatch moves to lance-linalg-11.0.0; the three deleted lines are still present verbatim there. Cluster config migrated to the v0.11.0 policy schema (strict since v0.9.0): - server.policy.yaml drops `kind`; a bundle's kind follows its `applies_to` in cluster.yaml, which already scopes it to `cluster`. - dev.policy.yaml drops the `stream_ingest`/`stream_manage` rules and the `cluster` group: upstream removed the RFC-026 streaming-ingest path (e1cd395) before v0.9.0, loads go through `change`, which operators already hold, and cluster apply no longer evaluates policy. - the omnigraph-cluster wrapper passes `--as` to `apply`/`approve` only; `cluster stream` no longer exists. Deploy note: the old pin wrote internal manifest schema v19, an abandoned format that 0.11 refuses and that `omnigraph upgrade` cannot migrate. magnetite's storageUri therefore moves to a parallel root (clusters/dev-graph-v9), following upstream's upgrade.md "same graph ID in a parallel cluster root" procedure; the old root is untouched as the export source and rollback copy. Carrying data over is a manual export (old binary) / load (new binary) on magnetite. Change-Id: I4db767af7224204fa83f52a56b7f96e86a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(buzz): 0.5.20 -> 0.5.26 Upstream: https://github.com/block/buzz/compare/desktop-v0.5.20...desktop-v0.5.26 Only the shared source changes (src hash, passthru.rev, vendored cargo hash); buzz-cli, git-credential-nostr and git-sign-nostr inherit it. The line references in their comments are unchanged at the new tag. Change-Id: If97c50c44e8c19db3d109f98c235b15d6a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(no-mistakes): 1.60.2 -> 1.84.0 Upstream: https://github.com/kunchenguid/no-mistakes/compare/v1.60.2...v1.84.0 No release in the range is marked breaking. The package's assumptions hold: internal/buildinfo.Version, empty telemetry host defaults, and the NO_MISTAKES_TELEMETRY / NO_MISTAKES_NO_UPDATE_CHECK variables. Change-Id: Ie2d6877297cee4239c1b0f66f3faf4936a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(treehouse): 2.1.1 -> 3.1.0 Upstream: https://github.com/kunchenguid/treehouse/compare/v2.1.1...v3.1.0 3.0.0 makes `treehouse return` (and `treehouse get` when its subshell leaves the worktree dirty) exit 3 instead of 0; callers need --force or must treat 3 as not-returned. 3.0.1 adopts pre-3.0 pool state automatically. The only consumer, modules/home/ai/firstmate, lists the package without invoking it. The -X main.version ldflag and TREEHOUSE_NO_UPDATE_CHECK still exist. vendorHash is unchanged. Change-Id: I9e8389a12507f0270db99e2fa9f03b616a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(atomic): 0.9.19 -> 0.9.24 Upstream: https://github.com/bastani-inc/atomic/compare/0.9.19...0.9.24 update.sh verified the npm tarball against the registry sha512, regenerated npm-dist-repairs.patch and manifest.json, and learned the new npmDepsHash from the build. 0.9.20 renames TYPESAFE_AI_API_KEY to TYPESAFE_API_KEY and the Jev router models from typesafe-ai/jev* to typesafe/jev-latest; nothing here uses either. 0.9.21-0.9.24 are features and fixes. Change-Id: Ic89cc417078e62bf7f338e24d6bcd3e16a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6 Upstream: https://public.cdn.getdbt.com/fs/versions.json (latest.tag v2.0.6) Repository: https://github.com/dbt-labs/dbt-fusion dbt Fusion is out of preview. Upstream no longer publishes the standalone dbt-lsp artifact (fs/lsp/fs-lsp-v2.0.6-* returns 404; install.sh says to run `dbt lsp` instead), so the package builds one src per platform and no longer installs bin/dbt-lsp. update.sh drops the LSP fetch and rewrites the single per-platform hash. BREAKING CHANGE: pkgs.dbt-fusion no longer provides dbt-lsp; use `dbtf lsp`. Nothing in this repository referenced dbt-lsp. Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a6964 [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is major [4:33:10 PM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analysis of 2275 commits complete: major release [4:33:10 PM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer" [4:33:10 PM] [[secure]] › ℹ The next release version is 1.0.0 [4:33:10 PM] [[secure]] › ℹ Start step "generateNotes" of plugin "@[secure]/release-notes-generator" [4:33:14 PM] [[secure]] › ✔ Completed step "generateNotes" of plugin "@[secure]/release-notes-generator" [4:33:14 PM] [[secure]] › ⚠ Skip step "prepare" of plugin "@[secure]/npm" in dry-run mode [4:33:14 PM] [[secure]] › ⚠ Skip v1.0.0 tag creation in dry-run mode [4:33:14 PM] [[secure]] › ⚠ Skip step "publish" of plugin "@[secure]/npm" in dry-run mode [4:33:14 PM] [[secure]] › ⚠ Skip step "publish" of plugin "@[secure]/github" in dry-run mode [4:33:14 PM] [[secure]] › ⚠ Skip step "success" of plugin "@[secure]/github" in dry-run mode [4:33:14 PM] [[secure]] › ✔ Published release 1.0.0 on default channel [4:33:14 PM] [[secure]] › ℹ Release note for version 1.0.0: # 1.0.0 (https://github.com/cameronraysmith/vanixiets/compare/v0.6.3...v1.0.0) (2026-10-03) * chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6 ([3ad03e9](https://github.com/cameronraysmith/vanixiets/commit/3ad03e9457194869f340fa607bf9b98fa1ff89c5)) ### Bug Fixes * **agents-md:** lint vim rewrap at col 80 ([cb866ad](https://github.com/cameronraysmith/vanixiets/commit/cb866add13d017d240c71fdf5baee91fb09a5a61)) * **agents-md:** nits ([da4b7da](https://github.com/cameronraysmith/vanixiets/commit/da4b7da98f8a5a1e780594aafeb0c075ba5fb1ba)) * **agents:** record every deployed skill in the lockfile ledger ([0d55418](https://github.com/cameronraysmith/vanixiets/commit/0d5541887ae85249b89c7a7d3273ff1c3e66938d)) * **agents:** validate instructions packages, not just skills packages ([a294e05](https://github.com/cameronraysmith/vanixiets/commit/a294e0572edc55ce57c5b9abd69f4ce8fb9615d7)) * **ai:** declare .apm/skills container in plugin manifests ([3443101](https://github.com/cameronraysmith/vanixiets/commit/3443101f4c44f620ede4814497542349998b28e9)) * **apm-skills-install:** relock from an empty apm_modules cache ([83b45e2](https://github.com/cameronraysmith/vanixiets/commit/83b45e2dfcc2433bba713dbffd2572790006bac7)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257) * **apm:** preserve offline cache hits with APM 0.31 ([4244103](https://github.com/cameronraysmith/vanixiets/commit/4244103505fcb44891e50e56ff917845e9abde8e)) * **apps:** add update-golem-cli ([c67213d](https://github.com/cameronraysmith/vanixiets/commit/c67213d13d6ca32fedf56637ab7dec40f9ed2811)) * **apps:** build apm-context-compile locally instead of querying caches ([05069eb](https://github.com/cameronraysmith/vanixiets/commit/05069eb3f2da35fdcf5b1e549f6cff655a5b7b7d)) * **apps:** drop update-beads flake app (beads uses nix-update-script) ([c2bacce](https://github.com/cameronraysmith/vanixiets/commit/c2baccee2a496086e2243cc13004e0617cfca59c)) * **apps:** drop update-dolt flake app (dolt uses nix-update-script) ([90cac5f](https://github.com/cameronraysmith/vanixiets/commit/90cac5fc8035785320e106d839298326e37ce530)) * **apps:** read the served marketplace manifest from apm.yml marketplace.output ([4f387cd](https://github.com/cameronraysmith/vanixiets/commit/4f387cd67fee06e5ca3a7e29f4a5818cde78565e)), closes [.#apm-marketplace-validate](https://github.com/./issues/apm-marketplace-validate) * **apps:** reference seed-age-key through the per-system packages ([970c4ba](https://github.com/cameronraysmith/vanixiets/commit/970c4ba499f0b25dab9e7e8895902124c823120f)) * **argocd-repo-credentials:** roll local-k3d-argo-cd token ([d459a6d](https://github.com/cameronraysmith/vanixiets/commit/d459a6dbf6b899d952c0e152d75ef9f5cfdccb21)) * **atomic:** default new sessions to Astra medium ([541e7d2](https://github.com/cameronraysmith/vanixiets/commit/541e7d2f0969c3e0a44533536551f9b3d3c1e936)) * **atomic:** stop registering the statusline extension with atomic ([894558f](https://github.com/cameronraysmith/vanixiets/commit/894558f0e4f0dc42a6d1344062fc0797edfd2258)) * **atomic:** update to 0.9.17 ([27ad231](https://github.com/cameronraysmith/vanixiets/commit/27ad231101bfdba4d7b11be7d1f71df71eabc6c7)), closes [.#atomic](https://github.com/./issues/atomic) * **atomic:** update to 0.9.18 ([add188e](https://github.com/cameronraysmith/vanixiets/commit/add188edd22874cb35743ed376a4882bc36c2cb0)), closes [.#update-atomic](https://github.com/./issues/update-atomic) [.#atomic](https://github.com/./issues/atomic) * **bootstrap:** enable flakes and support hosts without systemd ([5dc2005](https://github.com/cameronraysmith/vanixiets/commit/5dc2005271d7774cd45729563b48a028a86ba9c5)) * **bootstrap:** trust the admin group on debian and ubuntu ([e029f9d](https://github.com/cameronraysmith/vanixiets/commit/e029f9de3e94aab7eb1c4146179441724e72acb9)) * **caddy:** rewrite Origin to loopback for hermes.zt dashboard WS ([c2f9e95](https://github.com/cameronraysmith/vanixiets/commit/c2f9e959d87ef4b0c3bb81e2f0e4f18e0fa63936)) * **casks:** remove riptide ([f86a2d3](https://github.com/cameronraysmith/vanixiets/commit/f86a2d3a96f55b86af7c38cc9b2df5972960f6f1)) * **catppuccin:** read bottom and starship themes from flake inputs ([e578a63](https://github.com/cameronraysmith/vanixiets/commit/e578a636c00af5bd96807537a695e35a9ddfd867)) * **catppuccin:** set autoEnable=true to make implicit port enrollment explicit ([3f4d4a3](https://github.com/cameronraysmith/vanixiets/commit/3f4d4a3fb13a74f29f147e7871892897e3744391)) * **ccstatusline:** declare settings version 4 for ccstatusline 2.2.29 ([36c23e3](https://github.com/cameronraysmith/vanixiets/commit/36c23e3c30abe786f1707ea40eff303a0c09d05f)) * **checks:** assert nixbot uploads via the uploaders option ([6652839](https://github.com/cameronraysmith/vanixiets/commit/665283994723f16cdd0b40470b716bf829a0cc5e)) * **checks:** defer scheelite from machine checks (uncacheable CUDA closure) ([8717103](https://github.com/cameronraysmith/vanixiets/commit/8717103d52a2df84343e76c571dae6bc7e673c0f)) * **checks:** derive pyrite input pins from their declarations and bump them ([0faa430](https://github.com/cameronraysmith/vanixiets/commit/0faa4300f65d3b2c83d8bd86929454417e1d8e17)), closes [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) * **checks:** drop the volatile pi version pin from the structural oracle ([fd63e9f](https://github.com/cameronraysmith/vanixiets/commit/fd63e9faa49e6284ee6ef9ce445784981bbabe96)) * **checks:** drop tsconfig baseUrl for typescript 7.0.2 ([023d635](https://github.com/cameronraysmith/vanixiets/commit/023d63596bc2bed1d5ec67bf6dd5405b748a1f8e)) * **checks:** expect pi 0.84.2 in pi-agent-environment ([93d9600](https://github.com/cameronraysmith/vanixiets/commit/93d9600667aaf615d86241ec967537d3bf3dd823)) * **checks:** refresh the golden without stale keys; state what the check pins ([b24e5ec](https://github.com/cameronraysmith/vanixiets/commit/b24e5ec80426a83207379dde0a2b079a9111bf0b)) * **checks:** report omnigent obligation failures legibly ([7d341d0](https://github.com/cameronraysmith/vanixiets/commit/7d341d0e418069bc46b61542343db7c1f7c03380)) * **checks:** stop the hook harness reporting crashes as allow ([e07f7f0](https://github.com/cameronraysmith/vanixiets/commit/e07f7f0a1f6852d4848b7a971527658fd4370fa0)) * **checks:** warm the zerotier controller's unfree build in the fleet cache ([c185bbc](https://github.com/cameronraysmith/vanixiets/commit/c185bbc639aaa5928c4682c4fc93b60d9012e7f1)) * **checks:** write clan-inventory-consistency scratch to $TMPDIR not /tmp ([9b0a6b5](https://github.com/cameronraysmith/vanixiets/commit/9b0a6b52041fd6cac3e51f216e6dbcb965281b4d)) * **cinnabar/caddy:** bind ZeroTier mesh addresses via ip_nonlocal_bind ([432efb8](https://github.com/cameronraysmith/vanixiets/commit/432efb840be2383b173bd77558ef2f0928ddbadb)) * **cinnabar/caddy:** rewrite Host header for hermes dashboard reverse-proxy ([72eae12](https://github.com/cameronraysmith/vanixiets/commit/72eae126dd02addaec73dc066a4672f1babd34bf)) * **cinnabar:** migrate zerotier to clanService API + bump clan-core to 004bb87d ([021d4fd](https://github.com/cameronraysmith/vanixiets/commit/021d4fdba4697ab3b6e904249c7741aa35c6317d)) * **ci:** separate KVM-only VM tests from PR checks ([7eb7fb8](https://github.com/cameronraysmith/vanixiets/commit/7eb7fb8c148a16ec718b46c672afd768969aa9b1)) * **clan/hermes-agent:** deliver matrix bootstrap vars via environment ([20d31cb](https://github.com/cameronraysmith/vanixiets/commit/20d31cb3887d37c58ebb60d3e9d77f0eefff0fb2)) * **clan/hermes-agent:** derive stateDir from config.users.users..home ([74d4570](https://github.com/cameronraysmith/vanixiets/commit/74d4570a46ed13ccc2fca8058ef78bff54d52b11)) * **clan/hermes-agent:** restore MATRIX_HOMESERVER/MATRIX_USER_ID env ([a0ac221](https://github.com/cameronraysmith/vanixiets/commit/a0ac221473f924140422477a8d9ecd9592aff40a)) * **claude-code:** 4-* -> 5 ([3de72a9](https://github.com/cameronraysmith/vanixiets/commit/3de72a9e5b4c8f13b6ed93494a4a1d38e47e9c1e)) * **claude-code:** pin editorMode = vim ([c8fcdf7](https://github.com/cameronraysmith/vanixiets/commit/c8fcdf7a5191f20fb457903b032c21345ce07f80)) * **claude:** disable cloudflare and ouroboros plugins ([d8129e6](https://github.com/cameronraysmith/vanixiets/commit/d8129e6da0c0ae645a2748ec2354717970525ddb)) * **cluster:** drive the CI integration run off the local-k3d-ci environment ([08c2e55](https://github.com/cameronraysmith/vanixiets/commit/08c2e55ef76cbfd9547e7d131d877519ec33e115)) * **cognee-cli-wrapper:** python313 -> python3 ([c32482e](https://github.com/cameronraysmith/vanixiets/commit/c32482ec4e98a98462388dffd5f1ceb6834c3488)) * **cognee:** bound DB connection leaks via role-level idle_in_transaction_session_timeout (safety net for the cognee session-lifecycle leak) ([470dd8d](https://github.com/cameronraysmith/vanixiets/commit/470dd8d927f0c5542e53fcc79625ac7d667fd16b)) * **cognee:** loopback TCP + scram so API startup migrations run ([0c539e1](https://github.com/cameronraysmith/vanixiets/commit/0c539e1e85693ebd33da8ea9c624fc48aedec8bf)) * **cognee:** own db-password secret by postgres for ALTER ROLE ([4d03d6e](https://github.com/cameronraysmith/vanixiets/commit/4d03d6ec19391649ec93f7b27657076d19d98f68)) * **cognee:** re-pin cognee-nix to 16167c00 for correct IPv6 --bind ([053d98f](https://github.com/cameronraysmith/vanixiets/commit/053d98f7c3042505c1f97659223e9ccd34a8b256)) * **commands:** drop jj git push --allow-new removed in jj 0.42 ([cdfe0f2](https://github.com/cameronraysmith/vanixiets/commit/cdfe0f248b8c443bce451102838089f33aadf7c6)) * **containers:** expose Darwin variants via legacyPackages to escape strict flake-check forcing ([31adcdc](https://github.com/cameronraysmith/vanixiets/commit/31adcdcc1529d5a5ed4c3c5366544428b03865bd)) * **context:** fire the README habit on claims about a directory, not only edits ([ef48197](https://github.com/cameronraysmith/vanixiets/commit/ef481977a299da41a6ca8bf48c14adcb6d3ab0c4)) * **context:** retire beads references, restore reference-repo lookup policy, repair cross-references ([c80de68](https://github.com/cameronraysmith/vanixiets/commit/c80de68d8e83274029624307f6a864707e4e0de0)) * **darwin/homebrew:** add --force-cleanup for Homebrew >=5.1.15 cleanup guard (nix-darwin[#1787](https://github.com/cameronraysmith/vanixiets/issues/1787)) ([b6964bc](https://github.com/cameronraysmith/vanixiets/commit/b6964bcbb9628bab2519b849abb4e0de645c15c1)) * **darwin:** decouple homebrew self-update from the activation bundle run ([bf60c25](https://github.com/cameronraysmith/vanixiets/commit/bf60c25919789b53599644ffb741b09218d07edc)) * **darwin:** disable allowUnsupportedSystem in nixpkgs.config ([2fd4de7](https://github.com/cameronraysmith/vanixiets/commit/2fd4de73d4feac4f48be342ab8805a0b2f186f88)) * **darwin:** disable scheduled nix store optimise ([16d9eef](https://github.com/cameronraysmith/vanixiets/commit/16d9eef1f9f096d0e9f1da39baf32f3c3f0f6f1b)) * **darwin:** keep DNS encrypted on every network adapter ([bf2424f](https://github.com/cameronraysmith/vanixiets/commit/bf2424f926038f416402c718b7f052c952c613fa)) * **darwin:** stop Sparkle apps installing updates unattended ([832f30d](https://github.com/cameronraysmith/vanixiets/commit/832f30d2bb6ddf39efddd3d0ea0952d8ba9fc0c0)) * **darwin:** stop the DNS resolver check aborting activation ([a767bc2](https://github.com/cameronraysmith/vanixiets/commit/a767bc2419199066430c3e1438409f01b0d02d3a)) * **deps:** pin conventional-changelog preset to the v9 line ([ab6c91e](https://github.com/cameronraysmith/vanixiets/commit/ab6c91e880de2e58895f4710063e71cbb9468666)) * **deps:** update astro ([29b174f](https://github.com/cameronraysmith/vanixiets/commit/29b174f345e5897eddea9b39fae6f01bf4c74ee4)) * **deps:** update astro monorepo ([60734de](https://github.com/cameronraysmith/vanixiets/commit/60734dee18f8016a3367cbbf99bed7221b16d8a6)) * **deps:** update astro monorepo ([6ebd2c6](https://github.com/cameronraysmith/vanixiets/commit/6ebd2c628be8a276a216f01afeb407ecb70bfdde)) * **deps:** update astro monorepo ([540a215](https://github.com/cameronraysmith/vanixiets/commit/540a215257a110c96aa0c9acb5a723d6f8e1b093)) * **deps:** update dependency @astrojs/starlight to v0.38.5 ([a4bc1dd](https://github.com/cameronraysmith/vanixiets/commit/a4bc1dd910614b790136baabdbc48a1790370634)) * **deps:** update dependency @astrojs/starlight to v0.41.10 ([9a7fd54](https://github.com/cameronraysmith/vanixiets/commit/9a7fd54508cfaca41be0558d39156a527d03026e)) * **deps:** update dependency @astrojs/starlight to v0.41.2 ([be57ecb](https://github.com/cameronraysmith/vanixiets/commit/be57ecb75d52873305846b6a834d3ebc499d3fb9)) * **deps:** update dependency @astrojs/starlight to v0.41.3 ([a5f3e20](https://github.com/cameronraysmith/vanixiets/commit/a5f3e208cfefa770d5ade0c3563a2a984ec52800)) * **deps:** update dependency @astrojs/starlight to v0.42.5 ([5d5e492](https://github.com/cameronraysmith/vanixiets/commit/5d5e49299201a1f1e68c83520aa2153030e89784)) * **development-packages:** elixir -> beamPackages ([c765939](https://github.com/cameronraysmith/vanixiets/commit/c76593907f1ab41f21a8bb35b2257ff94b780ffb)) * **development-packges:** use rclone home-manager module ([54aa120](https://github.com/cameronraysmith/vanixiets/commit/54aa1202907c737dcc1ef534fe131a9be772b711)) * **devin:** activate the home profile without secrets at snapshot build and reactivate at session start ([ac14ae3](https://github.com/cameronraysmith/vanixiets/commit/ac14ae301f8af1b34022b83b9ef4cec736346252)) * **devin:** activate without secrets in maintenance as well ([590f751](https://github.com/cameronraysmith/vanixiets/commit/590f75195cc7acbb3926d39397bf860c2c6efc65)) * **devshell:** platform-conditional playwright browsers ([6a47121](https://github.com/cameronraysmith/vanixiets/commit/6a4712105bcb5901cb24ea04a4035a9dc0a42ba6)) * **devshells:** match the project nix client to the fleet default ([4d97b62](https://github.com/cameronraysmith/vanixiets/commit/4d97b621c3d1864be87859160b47cebf63542854)) * **dnscrypt-proxy:** set blackphos userHome to /private/var to match on-disk user ([40593ec](https://github.com/cameronraysmith/vanixiets/commit/40593ece32b37ce95b90f35e35bb51171234b790)) * **docs-deploy:** pass wrangler globals after the subcommand ([3835e40](https://github.com/cameronraysmith/vanixiets/commit/3835e40b58e92f76cf49901616e830f0f670cfcb)) * **docs:** adapt starlight sidebar for v0.39 breaking changes ([5e6fb56](https://github.com/cameronraysmith/vanixiets/commit/5e6fb56997b3d250f4947d6773543fff20a556b6)) * **docs:** give each browser report build its own preview ports ([9caddea](https://github.com/cameronraysmith/vanixiets/commit/9caddeafdb03753fea0bb2aa3d994b91a1b68c4c)) * **docs:** isolated bun linker for local astro-7 dev ([4fec259](https://github.com/cameronraysmith/vanixiets/commit/4fec259e1782c80dc472d05da426f11a2e8d0860)) * **docs:** keep browser evidence valid under CI build contention ([3f8dbba](https://github.com/cameronraysmith/vanixiets/commit/3f8dbbaad23ff799c2b466924b5ba2b5719612a5)) * **docs:** keep runner-control deadlines above browser setup under load ([50ae451](https://github.com/cameronraysmith/vanixiets/commit/50ae45182a4e4d7f8d58d3b30ebf06531efe45a6)) * **docs:** keep the homepage hero within narrow viewports ([88a39fb](https://github.com/cameronraysmith/vanixiets/commit/88a39fbb7c24d2afcf2d13854cb64e04d73ed8a9)) * **docs:** keep WebKit failure screenshots in Darwin build reports ([1c82caa](https://github.com/cameronraysmith/vanixiets/commit/1c82caa79bcc0e2f801bd4c63f1002fdd84251d0)) * **docs:** pin unified() markdown processor for astro 7 ([e47a035](https://github.com/cameronraysmith/vanixiets/commit/e47a03515402828f0cf1796545e63e630e38eac8)) * **docs:** retain browser regression evidence and version observations ([075412d](https://github.com/cameronraysmith/vanixiets/commit/075412d01b14b0ef7178b884270a5ab4aee685cc)) * **docs:** run report verdict CLI through symlinked paths ([6345440](https://github.com/cameronraysmith/vanixiets/commit/6345440fc07af4d1593ce47e0661f6db37532d64)) * **docs:** run tests under node and fix wrangler path for cloudflare 14 ([c668a47](https://github.com/cameronraysmith/vanixiets/commit/c668a474aca64d99a64312bc802447c25ecca1d6)) * **docs:** source darwin playwright webkit from patched flake fork ([f32b987](https://github.com/cameronraysmith/vanixiets/commit/f32b9874bcae5bcca9cf46d79bb5bdebdc655084)) * **effects:** act only on pull requests that are open at the event's head ([ac676a0](https://github.com/cameronraysmith/vanixiets/commit/ac676a011e7211c353c8b1143cee79228b27f24a)), closes [#3245](https://github.com/cameronraysmith/vanixiets/issues/3245) * **effects:** require permission guards for credentialed build-finished events ([c000f0c](https://github.com/cameronraysmith/vanixiets/commit/c000f0c43c27b41a8f6dd1c86edbebd3d2323449)) * **effects:** run nixbot effects only on pushes to main ([640fc17](https://github.com/cameronraysmith/vanixiets/commit/640fc173dd242c6b1aac604d6b5cea9bd9c1fac8)) * **flake:** drop unused input pins ([dd864cd](https://github.com/cameronraysmith/vanixiets/commit/dd864cdd12f6c130850d08483e540f683ef0bba0)) * **flake:** track niri-flake and zen-browser upstream instead of rev pins ([bd915fd](https://github.com/cameronraysmith/vanixiets/commit/bd915fd3997eed0406f8dda4385d4aecc1721e98)), closes [#3101](https://github.com/cameronraysmith/vanixiets/issues/3101) [#3102](https://github.com/cameronraysmith/vanixiets/issues/3102) [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169) [#3232](https://github.com/cameronraysmith/vanixiets/issues/3232) [#3261](https://github.com/cameronraysmith/vanixiets/issues/3261) * **flake:** track playwright-cli's flake upstream instead of a rev pin ([81224d2](https://github.com/cameronraysmith/vanixiets/commit/81224d254ba7ee571a4299b021c7eec338b0bc48)), closes [#3268](https://github.com/cameronraysmith/vanixiets/issues/3268) * **fonts:** correct Monaspace Nerd Font family name ([b1d14bf](https://github.com/cameronraysmith/vanixiets/commit/b1d14bfb76b0ce4e87c7c30216aa26710e1fd63e)) * **fonts:** use Mono Nerd Font cut for terminal grid ([598724e](https://github.com/cameronraysmith/vanixiets/commit/598724e45673c2db2a065ae857779787985f2e66)) * **fzf:** disable Ctrl-R history widget so atuin owns it ([876a25d](https://github.com/cameronraysmith/vanixiets/commit/876a25d209233e3e6f874f0f07c2b2d853ab2598)) * **gitea-mq:** match the required-check fallback to the authoritative ruleset ([00a7c20](https://github.com/cameronraysmith/vanixiets/commit/00a7c20ce5ebe353e891d5ea4565e41e531ee7a7)) * **gitignore:** anchor the archive pattern to the repository root ([9805d59](https://github.com/cameronraysmith/vanixiets/commit/9805d595f0a7600edd1c3f73aa31824c47a280c6)) * **gpg:** disable the darwin gpg-agent launchd service ([594b32f](https://github.com/cameronraysmith/vanixiets/commit/594b32f19393f927cede2df3a93fa381a9e7275f)) * **herdr:** restore the default pane-swap keybindings ([832f887](https://github.com/cameronraysmith/vanixiets/commit/832f887a77c746e323c4e4271b41f115fb50ac56)) * **hermes-agent:** break the config.yaml corruption loop with moshi-hook ([872679a](https://github.com/cameronraysmith/vanixiets/commit/872679a534bf477534ce0cc28cafece912f1f942)) * **hermes-agent:** set codex default ([c63754c](https://github.com/cameronraysmith/vanixiets/commit/c63754ce5e455b2744f96a488ea262be2c2a600e)) * **hermes-agent:** update configuration ([67cd7cc](https://github.com/cameronraysmith/vanixiets/commit/67cd7ccadb097ec6c0e4e745e218a8892608a136)) * **hermes:** bind dashboard to loopback for v0.17.0 ([#50551](https://github.com/cameronraysmith/vanixiets/issues/50551)) ([f264143](https://github.com/cameronraysmith/vanixiets/commit/f264143d1a1bb6a2617f435730806326815b080b)) * **home,clan/hermes-agent:** switch skills delivery to ~/.hermes/skills/ ([b169962](https://github.com/cameronraysmith/vanixiets/commit/b16996296f9c184b76e68d315beac974542e7059)) * **home/ai/claude-code:** drop unsupported "mcp__*" allow rule; MCP governed by defaultMode = "auto" ([5e231b1](https://github.com/cameronraysmith/vanixiets/commit/5e231b15a7bc813afcf51da0cd07243ffba705c8)) * **home/ai/claude-code:** use upstream marketplace name 'dagster' so dagster-expert plugin enables ([dc88ba4](https://github.com/cameronraysmith/vanixiets/commit/dc88ba49263f4ddf255f3a8f6f046fa4ef74b199)) * **home/ai/openspec:** anglicize vendored superpowers-bridge schema bundle ([c471dee](https://github.com/cameronraysmith/vanixiets/commit/c471dee7deab121f9f52da190c45e08e4515e772)) * **home/checks:** bind activationPackage directly to recover cache linkage ([f1ad224](https://github.com/cameronraysmith/vanixiets/commit/f1ad22402f58f7b3f5777f164981b6134639f094)) * **home/claude-code:** correct home.file override path to upstream's absolute key ([d6e727e](https://github.com/cameronraysmith/vanixiets/commit/d6e727e1ac9af598baa3a8994485780291da7d4f)) * **home/claude-code:** force-overwrite .claude/settings.json (nix-owned) ([b0e01f4](https://github.com/cameronraysmith/vanixiets/commit/b0e01f4b8924299f18d1b66c6086dff60ddb41a6)) * **home/core/ssh:** migrate matchBlocks to programs.ssh.settings ([8f1f691](https://github.com/cameronraysmith/vanixiets/commit/8f1f6917e26475d794beb2c9dff9d2d279c280d6)) * **home/core:** set GIT_OPTIONAL_LOCKS=0 to skip git status index writeback ([db970c9](https://github.com/cameronraysmith/vanixiets/commit/db970c98858c324dd53d013187c7bfeb59c8f87f)) * **home/crs58:** correct stale linear-cli bundled-skills comment (38 -> 1 dir/16 refs) ([930012a](https://github.com/cameronraysmith/vanixiets/commit/930012a6817fda0fe0138e4c4b70cbfe0a7ffb66)) * **home/direnv:** skip hanging direnv-instant tmux test in checkPhase ([730a7ae](https://github.com/cameronraysmith/vanixiets/commit/730a7ae7908ccd33771cf0387dbcfecb1400cc8a)) * **home/neovim:** pin git_config and fish treesitter parsers ([f927884](https://github.com/cameronraysmith/vanixiets/commit/f927884555f652dc6a8b33c789e4b309ca4907ec)) * **home/packages:** wrap gitmux with GIT_INDEX_FILE redirection in jj-colocated repos to avoid .git/index.lock races with jj export ([4c2429a](https://github.com/cameronraysmith/vanixiets/commit/4c2429a3bece06eacde21d3bf0e7b133590288f4)) * **home/starship:** set scan_timeout to 50ms ([5c4071d](https://github.com/cameronraysmith/vanixiets/commit/5c4071dcbc53c645e7b26bf1358ed1d15865b96a)) * **home/tools/agents-md:** correct jj-mode dispatch instruction to canonical wip-on-top recipe with --keep-emptied ([b16fe25](https://github.com/cameronraysmith/vanixiets/commit/b16fe25fb0e0364e1b07d6b2a5511fa0df640258)) * **home/tools/commands:** hermes-backup reads zip entries via bsdtar [@archive](https://github.com/archive) operand ([da917ff](https://github.com/cameronraysmith/vanixiets/commit/da917ffd762b89353e25b4076925e4b708d50ff7)) * **home/ubuntu:** use the sandbox's C.UTF-8 locale ([3e1a5fa](https://github.com/cameronraysmith/vanixiets/commit/3e1a5fa07d1f8181889b211c7ed86a345ba7f27d)) * **home/zed:** migrate agent.play_sound_when_agent_done to enum string ([bd4cc1c](https://github.com/cameronraysmith/vanixiets/commit/bd4cc1c6a280818ec5240d990e39582dcb3d4da8)) * **homebrew:** add element, itsycal, jayjay, linear, logi-options+ ([1800c41](https://github.com/cameronraysmith/vanixiets/commit/1800c41cc3650e66fca67c56955b89b1c431e3fe)) * **homebrew:** no-quarantine deprecated ([2325256](https://github.com/cameronraysmith/vanixiets/commit/2325256ee355d572e051901b50cf5c99175b8eb0)) * **homebrew:** update active dock items ([4b4d152](https://github.com/cameronraysmith/vanixiets/commit/4b4d1528570743618ca4c481928bce213f8d737b)) * **home:** let shell and development declare their own upstream imports ([7db2049](https://github.com/cameronraysmith/vanixiets/commit/7db20490e60a77c355c0d631ce4a761b22d777a2)) * **home:** let terminal aggregate declare its own nix-index import ([95d4d06](https://github.com/cameronraysmith/vanixiets/commit/95d4d06d869cf93b5b044bcc15d194984c7de3d6)) * **home:** migrate lazygit diff renderer config to the 0.65 schema ([27b0dad](https://github.com/cameronraysmith/vanixiets/commit/27b0dad1c62f6a7422d52388894f8a373186aded)) * **home:** name the queue each host serves instead of deriving it ([a6a8df6](https://github.com/cameronraysmith/vanixiets/commit/a6a8df65dd97634bf76bcdc8ae2015d39c6e7636)) * **home:** pass the configuration name to nh home switch ([7429300](https://github.com/cameronraysmith/vanixiets/commit/74293008f13ec7f26c9750555483f1449720914c)) * **home:** per-outpost credentials, id addressing, live registry values ([452c3b6](https://github.com/cameronraysmith/vanixiets/commit/452c3b67be0f8713925d33e6f0ef3463a73ef7a1)) * **home:** skip the sops-nix unit restart when no age key is present ([604d824](https://github.com/cameronraysmith/vanixiets/commit/604d82429aed1b75b43f828d0b06b82546d59e5d)) * **home:** state catppuccin auto-enrollment wherever the module is imported ([aea0f39](https://github.com/cameronraysmith/vanixiets/commit/aea0f39a94c1ee7297de112546261d12ca21f659)) * **home:** stop a tokenless darwin worker, and decouple the two hosts ([b81e1ef](https://github.com/cameronraysmith/vanixiets/commit/b81e1efcc28687a8404a34d287df683c8e1a70fd)) * **hooks/gate-dangerous-commands:** drop anchor on -b empty-body regex ([e0bcb53](https://github.com/cameronraysmith/vanixiets/commit/e0bcb53b326da899c55b0a90c63401d5a00ce7fa)) * **hooks:** assert the development join has exactly one child ([703350c](https://github.com/cameronraysmith/vanixiets/commit/703350c6121f0a995fdfbec9c027188a0fcd4ba2)) * **hooks:** don't gate kill word inside quoted search patterns ([108387f](https://github.com/cameronraysmith/vanixiets/commit/108387f46cdd01dc1a10b3e837abe65096f09694)) * **hooks:** gate kill by target hazard, not by the word kill ([dba57d1](https://github.com/cameronraysmith/vanixiets/commit/dba57d1f3eddbea241d368d247aeeb40e13bf46c)) * **hooks:** let permission notifications fire outside beads repositories ([ab47e98](https://github.com/cameronraysmith/vanixiets/commit/ab47e988cb70d181293b8148409d9f6be7e0853d)) * **hooks:** re-gate the destructive git push forms ([ce9c780](https://github.com/cameronraysmith/vanixiets/commit/ce9c7800dec819ad088964d2bd395d6bf8d443cb)) * **hooks:** repair the join detector and the diamond recovery text ([3bf142b](https://github.com/cameronraysmith/vanixiets/commit/3bf142b4ff84f71bdef5a376e8505c596936dc8d)) * **jj-linearize-join:** describe the reconstructed join from its actual parents ([f7d8cdb](https://github.com/cameronraysmith/vanixiets/commit/f7d8cdba0f6a3302ba9099ee2685de336403fde2)) * **jj-linearize-join:** stop the divergence marker reaching revision arguments ([41b3147](https://github.com/cameronraysmith/vanixiets/commit/41b3147d8709cdd710d01c8a7f852220981776df)) * **just:** retry remote check builds and document the ssh limit ([8b6f8d7](https://github.com/cameronraysmith/vanixiets/commit/8b6f8d7c6f710f4d84648d07dcd698660dbe3a75)) * **k3d:** run local integration through the offline CI path ([fb3ac14](https://github.com/cameronraysmith/vanixiets/commit/fb3ac140327aa0fdc20b9fd2756e91ad1975883a)) * **k8s:** follow sops-secrets-operator chart rename helm3 -> helm4 (0.21.2) ([fe1e9bc](https://github.com/cameronraysmith/vanixiets/commit/fe1e9bc79dbb379c9afea139c6f41b2997db5729)), closes [#3133](https://github.com/cameronraysmith/vanixiets/issues/3133) [#239](https://github.com/cameronraysmith/vanixiets/issues/239) * **k8s:** repoint cilium CRD selector past upstream embed.go (v1.20.2) ([f074320](https://github.com/cameronraysmith/vanixiets/commit/f07432065aa42dfac9f769c364939f031ee89b0c)), closes [#3132](https://github.com/cameronraysmith/vanixiets/issues/3132) * **kanidm:** enable online backups and align the branding cli package ([ebb45d8](https://github.com/cameronraysmith/vanixiets/commit/ebb45d81bfbe18b056c3ea8f597e3f2e9c276487)) * **kernel-modules:** move pyrite module boundary to Linux 6.18.52 ([16f068c](https://github.com/cameronraysmith/vanixiets/commit/16f068cdb3473bf4f639f68a8586e6e6d5769408)) * **linear-cli:** dispatch the denoDeps hash probe to the x86_64-linux remote builder ([1f575c6](https://github.com/cameronraysmith/vanixiets/commit/1f575c63d1259aae0c44cc666576f30bdc7b8d25)) * **linear-cli:** remove store references from vendored dependencies ([9518598](https://github.com/cameronraysmith/vanixiets/commit/9518598116f630d201cd0715329dcfff359c4c7f)) * **linear-cli:** update to 2.5.0 ([bd9a7ea](https://github.com/cameronraysmith/vanixiets/commit/bd9a7eaf0a7088c4dfe8da9943e8fca4a1c62410)) * **machines/magnetite:** enforce zfs quota and reservations against pool starvation ([aca5c70](https://github.com/cameronraysmith/vanixiets/commit/aca5c708baf1cc0b30d541fc7e88f38687d482fe)) * **machines/magnetite:** tighten nix gc and build-sandbox reaping for the build host ([e456caf](https://github.com/cameronraysmith/vanixiets/commit/e456caf62ffc7fe951f69db73d11c41374d6fb8e)) * **magnetite/kanidm:** add kanidm.service to oauth2-synapse restartUnits to re-run provision on rotation ([093549a](https://github.com/cameronraysmith/vanixiets/commit/093549a700b0980bab5d1bf45c58e1058c1f0b1b)) * **magnetite/kanidm:** manage matrix_users membership operationally to satisfy referential-integrity assertion ([9d5be21](https://github.com/cameronraysmith/vanixiets/commit/9d5be2120798fba11953e4f2b924741482e8d7db)) * **magnetite/kanidm:** reassign kanidm-oauth2-synapse secret ownership to kanidm:kanidm for provisioning access ([2fe9b91](https://github.com/cameronraysmith/vanixiets/commit/2fe9b914c0bcdfde2bc9d870cabe417d24db9100)) * **magnetite/kanidm:** replace trust_x_forward_for with http_client_address_info (V2 schema) ([3cd6dca](https://github.com/cameronraysmith/vanixiets/commit/3cd6dcae44933429d9005a41780feb3198f92d76)) * **magnetite/kanidm:** switch to enableACME + filesystem cert delivery ([c79f4bf](https://github.com/cameronraysmith/vanixiets/commit/c79f4bf4054c09120fe2bc54c2f39eb5f6785f2a)) * **magnetite/matrix:** expose federation OpenID userinfo endpoint for lk-jwt-service ([3966c86](https://github.com/cameronraysmith/vanixiets/commit/3966c86eb8e3fcdf2bd62df8d301f6535a6a8740)) * **magnetite/matrix:** grant nginx read access to acme cert via turnserver group membership ([6d68921](https://github.com/cameronraysmith/vanixiets/commit/6d68921f7e82ba293ad99a2827832bb93d9dd01b)) * **magnetite/matrix:** wire lk-jwt-service.livekitUrl and nginx /livekit/sfu proxy (nix-dk1) ([7d9d53b](https://github.com/cameronraysmith/vanixiets/commit/7d9d53b73e7d24c66959fb8cdceb4cf8032d17ab)) * **magnetite:** assert com.sun:auto-snapshot=false on root/nix at boot ([220b8a6](https://github.com/cameronraysmith/vanixiets/commit/220b8a6ba644fbc85c5e73c59057a6ee9f6dc26a)) * **magnetite:** confine the builder account's key to the nix protocol ([d3b3b64](https://github.com/cameronraysmith/vanixiets/commit/d3b3b646d383b164647fe3c7d25ddd3a489544e7)) * **magnetite:** drop dhparam options removed in nixpkgs 26.11 ([17c8b73](https://github.com/cameronraysmith/vanixiets/commit/17c8b735b1492e2c698c4c3d4975306eb401066c)) * **magnetite:** drop stale omnigraph systemPackages entry ([bc06590](https://github.com/cameronraysmith/vanixiets/commit/bc065901069d3b0b202b3f6194de51d9443d6f59)) * **magnetite:** raise sshd MaxStartups for the remote check lane ([45370c6](https://github.com/cameronraysmith/vanixiets/commit/45370c67cfa50b656b93b5bbf3e83b2adb1e60a1)) * **magnetite:** trust the builder account so distributed builds accept pushed paths ([b1d34d2](https://github.com/cameronraysmith/vanixiets/commit/b1d34d293c4a3bf0928e3a0b4323403c1b3ef7a8)) * **moshi:** reconcile hooks after managedConfigs ([3cc1559](https://github.com/cameronraysmith/vanixiets/commit/3cc155943c83230fd491643d51c36e66aaadc8e3)) * **neovim:** drop pplatex from lazyvim extraPackages ([2a5b261](https://github.com/cameronraysmith/vanixiets/commit/2a5b261f9b154cf698d238696fa732d406ff737d)) * **neovim:** mini_surround -> mini-surround ([18f7580](https://github.com/cameronraysmith/vanixiets/commit/18f75809f5bd2cff0c43d5e24d049a8a1968b71e)) * **neovim:** snacks_picker -> snacks-picker ([9a6550d](https://github.com/cameronraysmith/vanixiets/commit/9a6550dc9035e09c81997b4fbdcb30c756002261)) * **network:** clamp TCP MSS on zerotier for all NixOS hosts ([5725837](https://github.com/cameronraysmith/vanixiets/commit/5725837051d12e9f5f79f25b2e3f8faa60843b8c)) * **network:** make ZeroTier MSS rules lifecycle-safe ([2931154](https://github.com/cameronraysmith/vanixiets/commit/2931154b1f4bbf00bb5cfca24b69327a2b61f194)) * **nix-fast-build:** do not propagate python into consumers ([b200160](https://github.com/cameronraysmith/vanixiets/commit/b2001606ea6ade52f8a2e79285b3a543e6a57f32)) * **nix:** bound stalled substituter downloads to 60s ([03e7785](https://github.com/cameronraysmith/vanixiets/commit/03e7785965941d67b20b9f4cdaf9fe85e258fe5f)) * **nix:** declare KVM availability per host ([58765f2](https://github.com/cameronraysmith/vanixiets/commit/58765f23589773f56592493284715f5c90879ca2)) * **nix:** default fleet to Nix 2.35 for parallel cache queries ([aece57e](https://github.com/cameronraysmith/vanixiets/commit/aece57edc2865da308f37f58ffb8874420e75e58)) * **nixidy-push:** default to a sibling checkout and clone it when absent ([39216f1](https://github.com/cameronraysmith/vanixiets/commit/39216f1a0c4b383a9a2f8d972a823d2e1071f78b)) * **nixidy:** select the manifest repo by environment instead of getEnv ([dcc5acd](https://github.com/cameronraysmith/vanixiets/commit/dcc5acdae68cdf74e019005cf97fa0e1ad0f176f)) * **nixos/buildbot:** reap buildbot-nix gcroots that upstream's glob never matches ([0a62058](https://github.com/cameronraysmith/vanixiets/commit/0a62058b5803760ea239d8ce8614a11425883873)) * **nixpkgs:** expose flake packages only for supported systems ([cef64cc](https://github.com/cameronraysmith/vanixiets/commit/cef64cc79a300a0b52c294cef80da39df3ced625)) * **nixpkgs:** patch apm for SKILL_BUNDLE downloads ([855eba8](https://github.com/cameronraysmith/vanixiets/commit/855eba8a53dca01a08b1f44a748e78c4b2256303)), closes [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack) * **nix:** replace retired CUDA binary cache ([69c0dff](https://github.com/cameronraysmith/vanixiets/commit/69c0dff7655a689e6e5b237742674e492a028e3c)) * **omnigent:** advertise registered ACP harness readiness ([421dcf2](https://github.com/cameronraysmith/vanixiets/commit/421dcf23c9c0a7edb0e7555544414c1068a690b8)) * **omnigent:** auto-approve worker OMP ACP tools ([32d5ffa](https://github.com/cameronraysmith/vanixiets/commit/32d5ffa221cbd8d949077e19d401718f596aa6fd)) * **omnigent:** avoid evaluator stack overflow in home guard ([a93430c](https://github.com/cameronraysmith/vanixiets/commit/a93430c2aef90f94d6eb1a88ae54cfcb82e8099c)) * **omnigent:** bind Darwin credential receipts to boot session ([2e4f3cc](https://github.com/cameronraysmith/vanixiets/commit/2e4f3cc71e84bd21cf7db5e5fd3529c67dc4d7bc)) * **omnigent:** create security sessions for Keychain workers ([d387509](https://github.com/cameronraysmith/vanixiets/commit/d3875091a466eebc054b7cca68d9266c07a4500a)) * **omnigent:** emit one script per worker credential generator ([d3e759c](https://github.com/cameronraysmith/vanixiets/commit/d3e759cf0bbc32fd8a73a0f269156c55ba57c874)) * **omnigent:** keep sops-rendered worker credentials out of home directories ([7984efc](https://github.com/cameronraysmith/vanixiets/commit/7984efc002d103d40853ebbcf5f8a4b60aea15c0)) * **omnigent:** omit platform-inapplicable worker checks ([2dfb253](https://github.com/cameronraysmith/vanixiets/commit/2dfb25332a523a29e18741f4a7a92fe016ea2be9)) * **omnigent:** relax openai cap for nixpkgs openai 2.53 ([83fff85](https://github.com/cameronraysmith/vanixiets/commit/83fff85e506fdd9f6e5beb9e5465e09910d44ce9)) * **omnigent:** resolve Linux worker groups by gid as well as name ([1bbac11](https://github.com/cameronraysmith/vanixiets/commit/1bbac11649a48fd1b1ea81c5fae961dd5ff2675e)) * **omnigent:** retire remaining legacy host services ([bebe0bc](https://github.com/cameronraysmith/vanixiets/commit/bebe0bc0beecd14cde8a5370ec4e8a20a04ddb43)) * **omnigraph:** assert apply convergence, bound restarts, add operator cluster cli ([0c11011](https://github.com/cameronraysmith/vanixiets/commit/0c110113e82851182fb8dc64351d330dac3a7fb5)) * **omnigraph:** fail startup fast and bootstrap new storage roots once ([3fb87c3](https://github.com/cameronraysmith/vanixiets/commit/3fb87c3881da98fe3f2b18b60ffeeccd9953f25a)), closes [#3257](https://github.com/cameronraysmith/vanixiets/issues/3257) * **omnigraph:** gate server start on readiness probe ([0904cf7](https://github.com/cameronraysmith/vanixiets/commit/0904cf74a2522ef957c33682f83b7ec7b8322eb6)) * **omnigraph:** pass --as only to actor-bound cluster subcommands ([faa2423](https://github.com/cameronraysmith/vanixiets/commit/faa24235406d455f0adde57b41920457b33195db)) * **omp:** adjust default model roles ([7c922cf](https://github.com/cameronraysmith/vanixiets/commit/7c922cf1d7719b0fe6772dd0481d7225bc6662d8)) * **openspec:** correct schema bundle provenance and drop the dead refresh recipe ([bdb104b](https://github.com/cameronraysmith/vanixiets/commit/bdb104b2946dae591111683e116072d10c4cdfe3)) * **openspec:** correct the cognee-memory-layer project id to its slugId ([73a5d0b](https://github.com/cameronraysmith/vanixiets/commit/73a5d0b6eed0a212b2daef38e00c3059fbfd5e7c)) * **openspec:** correct the fork and schemaDirs claims in the marketplace design ([2e7628d](https://github.com/cameronraysmith/vanixiets/commit/2e7628dba612fcbddae18464d1b4285de7199189)) * **openspec:** deliver schema directories as single symlinks ([801a73d](https://github.com/cameronraysmith/vanixiets/commit/801a73d931f0b6c09ee31a12233c591e81de4be4)) * **openspec:** make nixbot's world-assumptions delta a superset ([5fa7090](https://github.com/cameronraysmith/vanixiets/commit/5fa709073f2d450ecaae439f0208e1f69bbfaa3c)) * **openspec:** make the pre-install secrets gate fail closed ([54931cf](https://github.com/cameronraysmith/vanixiets/commit/54931cf3195c172f80678dba347c429b09e2453d)) * **openspec:** name the git-addressable projection path and correct archive ordering ([8687815](https://github.com/cameronraysmith/vanixiets/commit/86878157103fd2ca1d7d3aa6f7d33589418bf71a)) * **openspec:** point the irreversibility warning at task 7.12, not 7.9 ([b6ad271](https://github.com/cameronraysmith/vanixiets/commit/b6ad27185f6ec626cb1231b25d8a3c3a8a0a87c1)) * **openspec:** record the linear registry id as a slugId, not a defect ([41a1f7d](https://github.com/cameronraysmith/vanixiets/commit/41a1f7d105e9715531db1fea32ea9170cca9074d)) * **overlays/aeneas:** rebuild darwin charon from charon-unwrapped ([eabf3a9](https://github.com/cameronraysmith/vanixiets/commit/eabf3a9d14be3f666d00031565c1aef16ca9d069)) * **overlays:** use stdenv.hostPlatform predicates in stable fallbacks ([290017b](https://github.com/cameronraysmith/vanixiets/commit/290017b1d136e769dd50be06df52dce6bae41c81)) * **packages:** correct the llm-agents provenance comment ([f83341f](https://github.com/cameronraysmith/vanixiets/commit/f83341f661d6bc41442baeb625b765582b434c68)) * **pi-agent-extensions:** guard the direnv reload timer against a stale ctx ([7a9cfd1](https://github.com/cameronraysmith/vanixiets/commit/7a9cfd1f29b1976a7c43b98dc2a760ac29de0ee4)) * **pi:** block pi config package mutation ([d8eef7a](https://github.com/cameronraysmith/vanixiets/commit/d8eef7adb85ff4e7f63aec653aa0bb0b900835c0)) * **pi:** declare the compaction extension Pi-only at the package level ([534834c](https://github.com/cameronraysmith/vanixiets/commit/534834c0bce14f77ba88828c2c43e6de2e27c949)) * **pi:** fail closed on unclassified shell mutations ([e117efc](https://github.com/cameronraysmith/vanixiets/commit/e117efc3fc8fd25292dc92982596a3b0ef948575)) * **pi:** honor curl get negation order ([85278c9](https://github.com/cameronraysmith/vanixiets/commit/85278c9dcf876a3460489d671598f9be113641fd)) * **pi:** model jj development join correctly ([4fa2a0f](https://github.com/cameronraysmith/vanixiets/commit/4fa2a0f88ad26d2281c6daaed58362bc4b099352)) * **pi:** preserve recognized shell reads ([d12c8a1](https://github.com/cameronraysmith/vanixiets/commit/d12c8a155ad4c7bb1369db14bc101adc1ea9f962)) * **pi:** regenerate jj command inventory, model informational globals ([42944e1](https://github.com/cameronraysmith/vanixiets/commit/42944e145c49e8c4fbcc2fb445eff1a4818673cc)) * **pi:** treat a curl request body as mutating regardless of -X ([96f8b4b](https://github.com/cameronraysmith/vanixiets/commit/96f8b4be841c9dda2bc0cb453246f914989eadec)) * **pkgs/atomic:** keep the postgres symlink hydration idempotent ([2bf3cd6](https://github.com/cameronraysmith/vanixiets/commit/2bf3cd65888dd3a630184047887d8b6f247f0788)) * **pkgs/xsra:** harden update.sh for nix run .#update-xsra ([376c46b](https://github.com/cameronraysmith/vanixiets/commit/376c46bd6a23a825d070bc01ce392647fe4c215a)), closes [.#update-xsra](https://github.com/./issues/update-xsra) * **pkgs:** build-verify uncomment-bin on every flake system it targets ([59e0124](https://github.com/cameronraysmith/vanixiets/commit/59e0124165015cd5f2e69dd29d3147d89cd7fe54)) * **pkgs:** disable git-repo-manager ([d6861c6](https://github.com/cameronraysmith/vanixiets/commit/d6861c68af77acaee89fb06e9481ba20923a65e5)) * **pkgs:** linear-cli — writable DENO_DIR so deno persists perf caches at runtime ([88dc7cd](https://github.com/cameronraysmith/vanixiets/commit/88dc7cd7547a67c0e03e25261068f339ee762490)) * **playwright-web-flake:** rebase on upstream ([acd019f](https://github.com/cameronraysmith/vanixiets/commit/acd019f6d750c0e8bc3a260366a7dd25433e994f)) * **pyrite:** bind keyboard illumination to the explicit DMS LED device ([eeb0bdf](https://github.com/cameronraysmith/vanixiets/commit/eeb0bdfae206bfde664df7645da08a96f3b53cfb)) * **pyrite:** bulk-disable PCIe d3cold before sleep (confirmed resume fix) ([a227253](https://github.com/cameronraysmith/vanixiets/commit/a22725304fd75f98c27d2ea0b48c571615a1245e)) * **pyrite:** correct the FIDO2 activation comment to the measured account ([937df26](https://github.com/cameronraysmith/vanixiets/commit/937df26a9524e481aac43a66a5d828ec711204e6)) * **pyrite:** correct the FIDO2 activation comments ([1e632ea](https://github.com/cameronraysmith/vanixiets/commit/1e632ea4d13675ff9a03afc83672727987719e32)) * **pyrite:** correct the FIDO2 activation comments to the observed unlock path ([a04fcf7](https://github.com/cameronraysmith/vanixiets/commit/a04fcf7c8746012ee41a78585e7e8f7afaedd665)) * **pyrite:** correct the recorded state-version var to 26.05 ([300a17d](https://github.com/cameronraysmith/vanixiets/commit/300a17d537b3fca42c067e85a39b1f6f51039ac1)) * **pyrite:** deduplicate the i915 kernel parameters ([3e14942](https://github.com/cameronraysmith/vanixiets/commit/3e1494271fc7e9fe6fb7eb723e072a936a089236)) * **pyrite:** disable initrd networking so brcmfmac stays out of stage 1 ([38e6973](https://github.com/cameronraysmith/vanixiets/commit/38e69739c1f0aac803c833a0669b3da0e0cba40e)) * **pyrite:** disable lid as S3 wake source (spurious auto-resume) ([ae60572](https://github.com/cameronraysmith/vanixiets/commit/ae60572fef4cc4772171d705899c1a3d26b3a3bc)) * **pyrite:** disable niri focus ring ([d579e26](https://github.com/cameronraysmith/vanixiets/commit/d579e260192322a4e0d26c2846e896505c14054f)) * **pyrite:** disable NVMe d3cold so suspend can resume, with panic-reboot fallback ([8f8a481](https://github.com/cameronraysmith/vanixiets/commit/8f8a481ab0668fa1c07096e14c6c8d4f23c15a17)) * **pyrite:** drop the defective --phases disko from task 7.3 ([b91d994](https://github.com/cameronraysmith/vanixiets/commit/b91d994b6da6e1d747eeaf4ec01664c48c8ec4fa)) * **pyrite:** integrate the Apple CS8409 initialization module ([460bce1](https://github.com/cameronraysmith/vanixiets/commit/460bce105704c8f3a3984d67f99c5da7d13ea9e1)) * **pyrite:** make firmware-closure decidability command runnable on pinned nixpkgs ([b1c6494](https://github.com/cameronraysmith/vanixiets/commit/b1c64941f637f54ec960835a9ee733c679265f3e)) * **pyrite:** override i915 psr/fbc/dc and disable nvme APST for resume ([1691a88](https://github.com/cameronraysmith/vanixiets/commit/1691a888fb9c386c2b4930e2eed60c4d4b2fc2bf)) * **pyrite:** persist the BCM UART wake omission at boot ([d028a65](https://github.com/cameronraysmith/vanixiets/commit/d028a6597cfd281507ef6b4157bc168a6e8f54df)) * **pyrite:** pin dms-src to the release tag of the packaged shell ([d0d917c](https://github.com/cameronraysmith/vanixiets/commit/d0d917c0655dcabe81703de5de9e99a6cd3bd136)) * **pyrite:** pin niri-flake by revision and derive its check ([952615c](https://github.com/cameronraysmith/vanixiets/commit/952615c075436a082745391d40c53b88f78087f2)), closes [#3169](https://github.com/cameronraysmith/vanixiets/issues/3169) * **pyrite:** point dms-greeter at its own package ([9e40eb3](https://github.com/cameronraysmith/vanixiets/commit/9e40eb30014e876ceaa87805d5325b9139477132)) * **pyrite:** regenerate the zfs passphrase var under the current generator ([6b51455](https://github.com/cameronraysmith/vanixiets/commit/6b51455729515d5ee8c511278d518750a5d1610d)) * **pyrite:** replace task 7.4's tautological zpool import check ([444fb38](https://github.com/cameronraysmith/vanixiets/commit/444fb388126892cc2ae6066de0eaae06db3ec973)) * **pyrite:** require the LTS ISO boot entry, the only one carrying zfs ([2cb7258](https://github.com/cameronraysmith/vanixiets/commit/2cb7258326fae33e9161e715dc0ae151e6bfd823)) * **pyrite:** set system timezone to America/New_York ([1aa80c6](https://github.com/cameronraysmith/vanixiets/commit/1aa80c6d31d7dc82160a3de44f8c5b0c84050652)) * **pyrite:** state the lid-handler comment as a decision, not a broken path ([602c621](https://github.com/cameronraysmith/vanixiets/commit/602c62138ae82e7970ed5e78d5e2c37b55cbdea0)) * **pyrite:** stop GNOME suspending on the power key ([31c2b60](https://github.com/cameronraysmith/vanixiets/commit/31c2b605ab702a5a56efb0eb5663b736a02240ce)) * **pyrite:** stop lid close from triggering broken suspend ([8df57f8](https://github.com/cameronraysmith/vanixiets/commit/8df57f8dccc4e132c43fa7bbf6ba99a6a8beb0d2)) * **python-lancedb:** package 0.36.0 to replace failing nixpkgs 0.32.0 ([b450633](https://github.com/cameronraysmith/vanixiets/commit/b4506337b3a82e74dde2117fb954c5c76aab5f72)) * **python-overrides:** remove pygame ([740edaa](https://github.com/cameronraysmith/vanixiets/commit/740edaa330c4d1bfcb16605dfb412608a0fe46bf)) * **quarto-bin:** declare openssl for Linux autoPatchelf (typst-gather) ([44ef515](https://github.com/cameronraysmith/vanixiets/commit/44ef5155d6e81f52d8fb6ab30c74f9899740c62f)) * **radicle:** correct cinnabar seed pairs and bump radicle-desktop ([bcfc663](https://github.com/cameronraysmith/vanixiets/commit/bcfc66325e7c83fb80cc39fbf9baec8dd856ee05)) * **renovate:** group astro with starlight, and regenerate the tree ([d1efe6c](https://github.com/cameronraysmith/vanixiets/commit/d1efe6c8e85b06b82cdfdebc8482d60acf795264)), closes [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913) [#2881](https://github.com/cameronraysmith/vanixiets/issues/2881) [#2913](https://github.com/cameronraysmith/vanixiets/issues/2913) * **renovate:** track every github flake input ref, not only playwright ([cdcd4c3](https://github.com/cameronraysmith/vanixiets/commit/cdcd4c336700adfa3b5f01b4fa002e656f342680)) * **secrets:** add codeberg ([15f3bf8](https://github.com/cameronraysmith/vanixiets/commit/15f3bf8f12fbe77804b2939dce242ffe6b583505)) * **secrets:** add nostr id ([2f2e686](https://github.com/cameronraysmith/vanixiets/commit/2f2e68651101629fcbbdd997458015db0df80071)) * **secrets:** cover .enc files in the update-all-keys recipe ([e986485](https://github.com/cameronraysmith/vanixiets/commit/e9864855081f6d54d22b9d2cc131f43740017028)) * **secrets:** enroll janettesmith signing key ([0aa505a](https://github.com/cameronraysmith/vanixiets/commit/0aa505afeb7348dfe2ce7980e101b01cb218a3f9)) * **shell-aliases:** add ca = "claude attach" ([e8a23e3](https://github.com/cameronraysmith/vanixiets/commit/e8a23e3dd7f5ba7aa2ffab44e3a9bde7ed371b75)) * **skills/agentic-planning:** runnable-command and external-tool-contract fixes ([dee3381](https://github.com/cameronraysmith/vanixiets/commit/dee33819f667de85cc3c4e01f742c9145385b5f5)) * **skills/jj-version-control:** correct route-and-extend recipe to canonical wip-on-top structure with --keep-emptied, remove single-commit-join misapplication ([34d1bbf](https://github.com/cameronraysmith/vanixiets/commit/34d1bbf474113eff929d2537523ffd839cb93eb4)) * **skills/jj:** correct squash flag guidance against jj 0.43.0 ([4a5d9f7](https://github.com/cameronraysmith/vanixiets/commit/4a5d9f72291f9305cf3eaa078607e135a07fdc61)) * **skills/jj:** correct the conflict() revset to conflicts() ([8b8f174](https://github.com/cameronraysmith/vanixiets/commit/8b8f1745cc8c553a9cb94bca04f3536106398cbc)) * **skills/jj:** make the rebase pair canonical for join add and remove ([fb11d5d](https://github.com/cameronraysmith/vanixiets/commit/fb11d5de2a5118586587ed4a0d4db089162615d9)) * **skills/jj:** replace the all: revset modifier removed in jj 0.38.0 ([b20100f](https://github.com/cameronraysmith/vanixiets/commit/b20100faad1fae5cf952b98a0cfe31c64fc6b727)) * **skills/meta-session-resume:** allow automatic invocation ([6bd801b](https://github.com/cameronraysmith/vanixiets/commit/6bd801b953356e2238502c71995895fc868f7099)) * **skills/openspec-linear-sync:** generalize operator-specific dependency note; record coupling in nix layer ([b3dc0b3](https://github.com/cameronraysmith/vanixiets/commit/b3dc0b3bc9fe5104044dabf30e023a78711d8fba)) * **skills:** align openspec-linear-sync consumer references to the monorepo registry + frontmatter ledger ([9f9ce11](https://github.com/cameronraysmith/vanixiets/commit/9f9ce11e3a612584473565316bc9e6a261e736d1)) * **skills:** code-comment minimization directive (skills + agents-md body) ([e662859](https://github.com/cameronraysmith/vanixiets/commit/e662859795e75707262a51ec7b01dbda4aea86af)) * **skills:** correct dependency-source-acquisition escalation guidance ([f0c1448](https://github.com/cameronraysmith/vanixiets/commit/f0c1448daa9e2b05bef08b737368a70654059625)) * **skills:** make checkpoint metadata valid YAML ([2d8d18a](https://github.com/cameronraysmith/vanixiets/commit/2d8d18a82c826cafe92eb287997ea83592ead5ff)) * **skills:** make dependency-source-acquisition frontmatter strict-YAML parseable ([4f57636](https://github.com/cameronraysmith/vanixiets/commit/4f57636ff439f2be42014de71b693f4d4dd11fc4)) * **skills:** preserve executable modes for Codex ([3e87528](https://github.com/cameronraysmith/vanixiets/commit/3e87528f72a713678bbb89705f8c203125948295)) * **skills:** quote portable argument hints ([df464a1](https://github.com/cameronraysmith/vanixiets/commit/df464a1eea0e0cfabdb02bc7ee31b0a3a6215c31)) * **skills:** replace the all: revset modifier outside the jj corpus ([46ff49d](https://github.com/cameronraysmith/vanixiets/commit/46ff49d861e05863fd4b1cfb048c3ec282e07735)) * **skills:** restore reconciliation duty content to verbatim canonical source ([9d879e8](https://github.com/cameronraysmith/vanixiets/commit/9d879e88811915b788463d4355dcc12a439c2390)) * **skills:** restore three companion rules to verbatim canonical source ([63cc1b4](https://github.com/cameronraysmith/vanixiets/commit/63cc1b4c473035946b442d8aacc45e40fc69b2d4)) * **skills:** restore turn-ordering mitigations 3-5 to verbatim canonical source ([6943aa7](https://github.com/cameronraysmith/vanixiets/commit/6943aa70fc89f5c95209fe6e268aafff5ad9bf69)) * **skills:** shorten Nucleus skill description ([2ce927a](https://github.com/cameronraysmith/vanixiets/commit/2ce927afe88cccb6d0a4cab9cdc96503514f192d)) * **skills:** stop routing third-party repos into the maintained tree ([72f3f1c](https://github.com/cameronraysmith/vanixiets/commit/72f3f1c1a72dda8056450e819c5b29201cd8ca0e)) * **stack-land:** accept non-blocking check states ([47ca9d8](https://github.com/cameronraysmith/vanixiets/commit/47ca9d8dec2cf10a985e8e6587e10a87c3df741b)) * **stibnite:** declare trusted users ([1ac1551](https://github.com/cameronraysmith/vanixiets/commit/1ac1551ed72403274e9e548198a4c599f6469228)) * **stibnite:** pin nix conf hash ([ca89c14](https://github.com/cameronraysmith/vanixiets/commit/ca89c14340d164664d1043fc9e07c50b2cef9bf3)) * **stibnite:** pin nixbld gid 350 ([37f3d07](https://github.com/cameronraysmith/vanixiets/commit/37f3d077b454904b4c466b5d997603df1aff1e14)) * **stibnite:** restore kvm on the rosetta builder, advertised for TCG ([a59cd31](https://github.com/cameronraysmith/vanixiets/commit/a59cd31c9f162bd02ba675f3fa472173c38dbbc0)) * **stibnite:** scope the rosetta builder kvm claim to aarch64-linux ([18597d6](https://github.com/cameronraysmith/vanixiets/commit/18597d6990db9ad02ada7bd225fe2d0e220b9a93)) * **terranix:** track google provider 8.x ([12a869d](https://github.com/cameronraysmith/vanixiets/commit/12a869dee328463c6ea557561c4c520d396d8f50)) * **texlive:** texlive.combine -> texliveSmall.withPackages ([c393eb3](https://github.com/cameronraysmith/vanixiets/commit/c393eb35645aee10b5e1d946a84a35707093af8b)) * **tmux:** enable focus-events for terminal focus tracking ([3a16ef3](https://github.com/cameronraysmith/vanixiets/commit/3a16ef34cbf540991e44f0b4347e90d35181b571)) * **updaters:** resolve package paths from repository root ([7f91baf](https://github.com/cameronraysmith/vanixiets/commit/7f91bafb3579ef00484d0961e7baa23507b1c337)) * **wezterm:** stop masking Shift+Enter for omp kitty protocol ([623ec73](https://github.com/cameronraysmith/vanixiets/commit/623ec732430b9ea37bf3dd361d3a86f0486456e8)) * **wezterm:** use bundled default font stack, size 12 ([302bebb](https://github.com/cameronraysmith/vanixiets/commit/302bebb163c4db7939803ce4ff3fc382d5942ed4)) * **workflows:** accept Atomic's real model-catalog shape in stand-up-gitea-mq preflight ([f7a2e73](https://github.com/cameronraysmith/vanixiets/commit/f7a2e73a96dd018bbbfc970e56d836c823b94e05)) * **workflows:** accept both DNS record name forms and contain plan state ([ff92e6f](https://github.com/cameronraysmith/vanixiets/commit/ff92e6fd4c42a2cbd16200a5a07acec1a56e7f3f)) * **workflows:** activate Linux hosts from the locally built closure ([a39f15a](https://github.com/cameronraysmith/vanixiets/commit/a39f15a2d8fae8a6582e531dacfe207ed8a44ca8)) * **workflows:** bridge native structured-output exhaustion and confine App tokens ([d59a90a](https://github.com/cameronraysmith/vanixiets/commit/d59a90ad5818f012730f7502b10f2d208dc2c42c)) * **workflows:** close stand-up-gitea-mq review findings before launch ([55f496f](https://github.com/cameronraysmith/vanixiets/commit/55f496f5120ee8a818069a01af8dac92309bcd1e)) * **workflows:** defer the forge ExecStartPre comparison until both sides are committed ([656c061](https://github.com/cameronraysmith/vanixiets/commit/656c0618d8c2db9da078e92d34ae02de7a42e3b1)) * **workflows:** harden stand-up-gitea-mq proposal, DNS routing, and report paths ([3a66612](https://github.com/cameronraysmith/vanixiets/commit/3a66612cfdfbbfa4172ecdcfc3d9448614912b73)) * **workflows:** isolate App token minting and bound ruleset draft repair ([b9d04fa](https://github.com/cameronraysmith/vanixiets/commit/b9d04fac2aa14a9d41bcec4b530c70adc2440e1f)) * **workflows:** keep terraform failures diagnosable while withholding plan state ([a0a4d5e](https://github.com/cameronraysmith/vanixiets/commit/a0a4d5eb86659df061f6bd1b542c1c77d3fdd25b)) * **workflows:** let stand-up-gitea-mq preflight tolerate foreign edits in the shared wip ([ecb6afa](https://github.com/cameronraysmith/vanixiets/commit/ecb6afaeaa317d361be136a6ef02b62b2daefc3f)) * **workflows:** make stand-up-gitea-mq runs viable and resumable ([3fdb937](https://github.com/cameronraysmith/vanixiets/commit/3fdb93773e0ee4ecf79d751955bac223598ba37e)) * **workflows:** never regenerate an existing credential, and scope the clan backstop ([d02919e](https://github.com/cameronraysmith/vanixiets/commit/d02919e70e289d3315d96226c85354cc3654487d)) * **workflows:** pair chain and integrated preservation baselines ([065484e](https://github.com/cameronraysmith/vanixiets/commit/065484e22a820e1218fec2b73699a384ee03ee84)) * **workflows:** permit derived github.user in Janette identity gate ([6f7dfb2](https://github.com/cameronraysmith/vanixiets/commit/6f7dfb2569763201499a1ccf2bc7ea10afbd395f)) * **workflows:** probe clan availability with a flag the installed CLI accepts ([b203bb3](https://github.com/cameronraysmith/vanixiets/commit/b203bb3a5747eabd70b9fd234d030155bde878e2)) * **workflows:** project Janette and Darwin worker homes in preservation gates ([de20266](https://github.com/cameronraysmith/vanixiets/commit/de20266153fa1445f877d1b0d13022e11f48f55c)) * **workflows:** project observations before they reach a checkpoint ([51090f2](https://github.com/cameronraysmith/vanixiets/commit/51090f29be1b624de8220b43e0a59e69cb64301c)) * **workflows:** prove the pre-S1 forge baseline and revalidate after change edits ([734b639](https://github.com/cameronraysmith/vanixiets/commit/734b639aae5463ff375bac2bfb06fcac419cb29c)) * **workflows:** read Atomic current model through its actual API ([6adfd41](https://github.com/cameronraysmith/vanixiets/commit/6adfd410a399337087227a7045b9e427124a312a)) * **workflows:** require only subscribable events in the app contract ([4e4047f](https://github.com/cameronraysmith/vanixiets/commit/4e4047f2a5a1305c248a8d8415c4999a1ace9c70)) * **workflows:** resolve the terraform source at use time and keep evidence outside the repo ([b281027](https://github.com/cameronraysmith/vanixiets/commit/b281027baa6d0fcf4f0baa022426e3056bfb57e1)) * **workflows:** respect disabled Home Manager file sources ([2cdc1e7](https://github.com/cameronraysmith/vanixiets/commit/2cdc1e74a7a03099235dbb4c1d7d70368eb8a303)) * **workflows:** scope credential-listing parsing to this workflow's own vars ([100967e](https://github.com/cameronraysmith/vanixiets/commit/100967ed545277f16e344a1c8c3dd76a745476ac)) * **workflows:** scope stand-up-gitea-mq drift guards to the workflow's own paths ([a9ce405](https://github.com/cameronraysmith/vanixiets/commit/a9ce405605a32f0941409ac2eb363955bb803bb6)) * **workflows:** tolerate foreign divergence in the shared working copy ([8df333c](https://github.com/cameronraysmith/vanixiets/commit/8df333c806a38b263f4634341981fd75821e8d1b)) * **workflows:** treat an already-applied dns record as success ([928e1f9](https://github.com/cameronraysmith/vanixiets/commit/928e1f9d994239c4b5f43f3699ddebb8680a5cc2)) * **workflows:** verify dns and service reachability against public resolvers ([422e6dc](https://github.com/cameronraysmith/vanixiets/commit/422e6dc044c169b10f13ceda0df679f9958a70fe)) * **workflows:** verify pinned worker model against the catalog ([61401b2](https://github.com/cameronraysmith/vanixiets/commit/61401b2b05b07e0d0045b27917a05ae27fd871d8)) * **zerotier:** migrate stibnite machine ID and IP ([ba2cbaa](https://github.com/cameronraysmith/vanixiets/commit/ba2cbaab7a4c6407022db51019b05374be080f09)) ### Features * aeneas + charon + elan for stibnite host; drop home-manager lean4 ([d308362](https://github.com/cameronraysmith/vanixiets/commit/d3083620864d357488577990b65bbc726b2d43a6)) * **agent-skills:** proxy mergify stack skill ([1b0c76d](https://github.com/cameronraysmith/vanixiets/commit/1b0c76d064316cfee52d2dcdcc13bb12cfad3532)) * **agents-md:** adopt communication rules and long-running command capture ([7e68e32](https://github.com/cameronraysmith/vanixiets/commit/7e68e3262869e54568495903886e14c4e0f6a0d8)) * **agents-md:** slim claude.md orchestrator-mode stub ([54f2362](https://github.com/cameronraysmith/vanixiets/commit/54f2362eb586d99ac59c32b25c0ae901b7317d27)) * **agents:** add the vanixiets context tier ([fdeb11c](https://github.com/cameronraysmith/vanixiets/commit/fdeb11c924c1c279fce299f78932f683e83b6309)) * **agents:** compose the agent context on devShell entry ([716713a](https://github.com/cameronraysmith/vanixiets/commit/716713adf23366ba618576b5e317c083182ee816)) * **agents:** compose the repository context file from the fragments ([0cca178](https://github.com/cameronraysmith/vanixiets/commit/0cca17899534b4c83b1b7e7df5bff8c561c642cd)) * **agents:** extract fleet and repository-class context into apm packages ([70fa35c](https://github.com/cameronraysmith/vanixiets/commit/70fa35cedeb26aeaf02ef89c3ca6f86ca89372c0)) * **agents:** materialize marketplace skills into git-ignored .agents/ ([953b0ff](https://github.com/cameronraysmith/vanixiets/commit/953b0ff9c19236fc6ad8b1be4820768b7ca1d5ad)) * **agents:** refresh the openwiki wiki from a just recipe ([8935581](https://github.com/cameronraysmith/vanixiets/commit/8935581ed850a13ff33426b100fbf0d3a519daa9)) * **agents:** relock to deliver the mergify-stack skill ([fcf0253](https://github.com/cameronraysmith/vanixiets/commit/fcf0253f52365b6065e8ffb3c4258d81f201e695)) * **ai:** add tuicr code review TUI to the home-manager ai aggregate ([0f5980a](https://github.com/cameronraysmith/vanixiets/commit/0f5980a2c85e1647d2228313e47a6e491d65afd4)) * **ai:** allocate Opus 5.5 across claude-code and omp ([63b7b43](https://github.com/cameronraysmith/vanixiets/commit/63b7b43da364d995bc259f517f301be708e4f2ec)) * **ai:** compose Playwright skills through shared APM capabilities ([66a3036](https://github.com/cameronraysmith/vanixiets/commit/66a30360362d903ec3119b3fc733ace8b06b7522)) * **ai:** enable pi-vim modal editing for pi only ([848909e](https://github.com/cameronraysmith/vanixiets/commit/848909e5494e541a64f01da891ffbf2057cf8f17)) * **apm-skills-marketplace:** /opsx:* → openspec-* skill-form ripple (router + bridge docs); config.yaml default schema=superpowers-bridge ([58d246a](https://github.com/cameronraysmith/vanixiets/commit/58d246abb48814cfd1189a6562b708af6da1cb10)) * **apm-skills-marketplace:** experiment with MARKETPLACE_PLUGIN + .apm/skills + producer pack + dual-manifest ([17a30df](https://github.com/cameronraysmith/vanixiets/commit/17a30df4673bbc059134eaabe5343a633f6fa3d8)) * **apm-skills-marketplace:** generalize apm-skills-compose over 17 packages + superpowers; neutralize formal-spec [@alias](https://github.com/alias) devDep blocking apm install ([da6263e](https://github.com/cameronraysmith/vanixiets/commit/da6263eb68796f3b1d99f317df6adb095e99303d)) * **apm-skills-marketplace:** manifests — dep edges, producer marketplace, taxonomy ([0c8a430](https://github.com/cameronraysmith/vanixiets/commit/0c8a43047a03c374381b57f08bfa649d3f028770)) * **apm-skills-marketplace:** OpenSpec delivery=skills; drop /opsx:* commands + assets/commands; Migration-Plan coherence ([f1b64ad](https://github.com/cameronraysmith/vanixiets/commit/f1b64ad3b45b84f187ef55a32b5c1f46b9bd0b43)) * **apm-skills-marketplace:** parameterize apm-skills-compose via typed aiSkills options ([0efe448](https://github.com/cameronraysmith/vanixiets/commit/0efe4489f4c957a19028cd5a548582d755fb6595)) * **apm-skills-marketplace:** regenerate vendored OpenSpec skills at 1.5.0 (delivery=skills) ([94efe73](https://github.com/cameronraysmith/vanixiets/commit/94efe73fe1b6afa181accbfa35e19a9a71577fc8)) * **apm-skills-marketplace:** restructure 104 skills into 17 apm packages ([b13d561](https://github.com/cameronraysmith/vanixiets/commit/b13d5614a5baddd84eda5bd713a9cf4268414631)) * **apm-skills-marketplace:** spike hermetic apm+nix compose ([411d2df](https://github.com/cameronraysmith/vanixiets/commit/411d2dfd9c138493e880f1541155156edaa70b7d)) * **apm-skills-marketplace:** superpowers as a regular remote apm dep resolved offline via git-cache pre-warm; drop superpowers-src ([11b1f3c](https://github.com/cameronraysmith/vanixiets/commit/11b1f3c77df052e95f61bb94ca6a7d46e67041be)) * **apm-skills-marketplace:** vendor the 11 OpenSpec skills into planning-and-development; drop extraSkillDirs; retarget refresh app per-skill ([012b014](https://github.com/cameronraysmith/vanixiets/commit/012b014bd5c0b9e0aa83997b316dd77908a68136)) * **apps/update:** add update-beads parity entry ([6c58cd7](https://github.com/cameronraysmith/vanixiets/commit/6c58cd796a0ce0cb5fc84849260216b7973b444a)) * **apps/update:** add update-dolt parity entry ([c9782b7](https://github.com/cameronraysmith/vanixiets/commit/c9782b770e59cffed31ffd6988ec57c5685e2a24)) * **apps:** add cognee-agentskills cognee dataset refresh flake app ([f749714](https://github.com/cameronraysmith/vanixiets/commit/f749714661ca379e83bd652920ed8bea7ce554b0)) * **apps:** add openspec-refresh-vendored-artifacts flake app ([c473372](https://github.com/cameronraysmith/vanixiets/commit/c4733727e82da6f395b0ba575bbc0baec508c33e)) * **apps:** apm-marketplace consumer-path validation flake-app ([30d6571](https://github.com/cameronraysmith/vanixiets/commit/30d65718687c779f3a7769fbbecb5e0ad7637a21)) * **apps:** bootstrap a home profile from a remote flake ref ([4a3afb0](https://github.com/cameronraysmith/vanixiets/commit/4a3afb08f58634be6e1cfa0c3742ebe8691b877c)) * **apps:** expose the atomic update script as a flake app ([6c84d6d](https://github.com/cameronraysmith/vanixiets/commit/6c84d6dfeec800ffcafb1cd6058a4ac097247e75)) * **apps:** expose update-buzz-source ([04a2522](https://github.com/cameronraysmith/vanixiets/commit/04a25223f0814788a81b41c655031afe6751d970)) * **atomic:** declare pi-only extension scope for inherited extensions ([9bebce6](https://github.com/cameronraysmith/vanixiets/commit/9bebce6ca2946f508c9595426ac3e3bb5c14446c)) * **atomic:** manage settings.json with a merging activation ([eb13f0a](https://github.com/cameronraysmith/vanixiets/commit/eb13f0aa7ee0f3f0fac4ba9d5c162ea569b0e910)) * **atomic:** use Opus 5.5 instead of Opus 5 ([43906c2](https://github.com/cameronraysmith/vanixiets/commit/43906c25f9f609394331da181185dec388f2e14d)) * **bootstrap:** add uninstall-nix target ([d195bb6](https://github.com/cameronraysmith/vanixiets/commit/d195bb61f7e73d849de60965e5798c6678cd7702)) * **brand:** add modules/brand with flake.brand.logo asset for downstream NixOS modules ([3d6f727](https://github.com/cameronraysmith/vanixiets/commit/3d6f7272b44891dd78c67bc0507f35a2927aab33)) * **buildbot:** add Restart=always to buildbot-master and buildbot-worker ([3e25edd](https://github.com/cameronraysmith/vanixiets/commit/3e25edddce027548a7117ec76bb78252624fa8ec)) * **buildbot:** install buildbot-effects cli system-wide ([5b3e823](https://github.com/cameronraysmith/vanixiets/commit/5b3e823e8cf183422638bdb07509261d2ac144d3)) * **buildbot:** stop admitting sciexp/ironstar ([e8921a2](https://github.com/cameronraysmith/vanixiets/commit/e8921a24868caa70ac4810baccee9350bd819a07)) * **buildbot:** stop serving vanixiets, keep serving ironstar ([aeea35a](https://github.com/cameronraysmith/vanixiets/commit/aeea35abc90a4f9f04b554cf37ecbe199a07a766)) * **ccstatusline:** add layout variant toggle with simplified 1-line experiment ([7d5ba1d](https://github.com/cameronraysmith/vanixiets/commit/7d5ba1d70047cf0301a54669c125c9e752a9b2ec)) * **ccstatusline:** drop model segment from simplified variant ([8bbf7c3](https://github.com/cameronraysmith/vanixiets/commit/8bbf7c38068738c41f1ebd169d40a26a3120a9a2)) * **ccstatusline:** replace git-worktree+git-branch with short HEAD sha in simplified variant ([5c10d3e](https://github.com/cameronraysmith/vanixiets/commit/5c10d3ee5e06150adf63fb5216e3ee4415a443cf)) * **ccstatusline:** switch cwd to fishStyle in both layout variants ([c4608b2](https://github.com/cameronraysmith/vanixiets/commit/c4608b2afeaeb7145e91c7efb33c9a653a697501)) * **checks/machines:** include scheelite in nixos-* check coverage ([8ddff0b](https://github.com/cameronraysmith/vanixiets/commit/8ddff0b88683d60831ff93f2063d18ed6fb9fd91)) * **checks/machines:** programmatic per-system derivation, add darwin builds ([47d6cab](https://github.com/cameronraysmith/vanixiets/commit/47d6cab5d739c247e10c71e9d15475d120b5ccca)) * **checks:** add per-package and per-package-test re-exports ([f055844](https://github.com/cameronraysmith/vanixiets/commit/f0558448bd7916f4641ff282097e00a95d2735c6)) * **checks:** evaluate and build every flake app per system ([943482b](https://github.com/cameronraysmith/vanixiets/commit/943482bcbc7246af3feaf3d892e9bfe19bc49b46)) * **checks:** pin home.packages names per user ([26205b6](https://github.com/cameronraysmith/vanixiets/commit/26205b609497d4cd196b65213388ab7709279285)) * **checks:** regulate cilium, gateway-api, and k3s version coupling ([8217010](https://github.com/cameronraysmith/vanixiets/commit/821701072c56f0b95ca3595abf42b53b88be74e4)) * **checks:** validate the renovate config and expose renovate in the devshell ([0687da5](https://github.com/cameronraysmith/vanixiets/commit/0687da50613191567e683709e951aa1c36767dbf)), closes [hi#fidelity](https://github.com/hi/issues/fidelity) * **chrome-devtools-axi:** package 0.1.29 as a by-name derivation ([4aff2f5](https://github.com/cameronraysmith/vanixiets/commit/4aff2f5885f8dfc257f3d892c20644618dc7efce)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi) * **cinnabar/caddy:** add hermes.zt reverse-proxy to dashboard ([e99e918](https://github.com/cameronraysmith/vanixiets/commit/e99e91813d806b29200cf79c5cd2434dd95f2a15)) * **cinnabar/hermes-agent:** default to z-ai/glm-5.1 via OpenRouter + mono dashboard theme ([e750589](https://github.com/cameronraysmith/vanixiets/commit/e7505898aaf130b061a6b4e292e52e8795a66371)) * **cinnabar/hermes-agent:** wire matrixHomeserverUrl to colocated tuwunel ([44d6679](https://github.com/cameronraysmith/vanixiets/commit/44d66790a0fbcc6d3cff58ee5719229ddbbdbf6b)) * **cinnabar/inventory:** instantiate hermes-agent clan-service ([59c4b09](https://github.com/cameronraysmith/vanixiets/commit/59c4b0970ccebcd06f56e12b19cb204cdcd2c46b)) * **cinnabar/matrix:** register hermes matrix user ([f408aa1](https://github.com/cameronraysmith/vanixiets/commit/f408aa1aaa46c0769a0ad6efdb20668b42131bf2)) * **cinnabar/zt-dns:** add hermes.zt DNS records (IPv6 + IPv4) ([7ce6a0b](https://github.com/cameronraysmith/vanixiets/commit/7ce6a0b202ecf8d1638991af0f506b26ee8191bb)) * **clan-service:** scaffold hermes-agent wrapper module ([667e667](https://github.com/cameronraysmith/vanixiets/commit/667e6673b588fb902740ff31f75c17845bdac814)) * **clan/hermes-agent:** add 'matrix' to extraDependencyGroups for mautrix-python ([5ad73a3](https://github.com/cameronraysmith/vanixiets/commit/5ad73a3eaa8c180e2d354869e2b109d355036419)) * **clan/hermes-agent:** configure OpenRouter→openai/gpt-5.5 fallback ([bd4ca2e](https://github.com/cameronraysmith/vanixiets/commit/bd4ca2e9b8b4ec2329168bbfbc0c65ecf7263c56)) * **clan/hermes-agent:** enable holographic local memory provider ([a976d56](https://github.com/cameronraysmith/vanixiets/commit/a976d56e78b65a99c5b7daa57d32685fe79c4f62)) * **clan/hermes-agent:** expose CLI via addToSystemPackages ([a6e2f8a](https://github.com/cameronraysmith/vanixiets/commit/a6e2f8a7075ff061a968aab46d6ea897f8a219b5)) * **clan/hermes-agent:** expose homeRoom option and set "cron" room as matrix home channel ([bd80fdc](https://github.com/cameronraysmith/vanixiets/commit/bd80fdc90dd88c4d60474d20b2aaa59b90567a6f)) * **clan/hermes-agent:** expose matrixHomeserverUrl setting with loopback default ([a8c8f66](https://github.com/cameronraysmith/vanixiets/commit/a8c8f661315f68de9fa9b9705335fdef465f1f71)) * **clan/hermes-agent:** flip operationally-critical defaults for headless gateway ([8a227bb](https://github.com/cameronraysmith/vanixiets/commit/8a227bb8eb745904b0078af7b18a20b8ebdda3e1)) * **clan/hermes-agent:** wire channelsAllowlist into matrix settings deep-merge ([e0bc00f](https://github.com/cameronraysmith/vanixiets/commit/e0bc00f04956123289850ccc1f77d5263a03ccef)) * **clan/hermes-agent:** wire skills.external_dirs to ~/.hermes/external-skills ([3b30884](https://github.com/cameronraysmith/vanixiets/commit/3b30884567fdf0f65fbbdb3426c62790c0bb5ce0)) * **clan:** replace per-machine builder modules with a nix-builders service ([1f817ce](https://github.com/cameronraysmith/vanixiets/commit/1f817ce55e449026c169c51d0db567d1c335fb93)) * **claude-code/hooks:** register worktree-gate and diamond-verify hooks ([9a52a75](https://github.com/cameronraysmith/vanixiets/commit/9a52a75b3ed425ea9c74bee0e73a5298a0ab9bde)) * **claude-code:** default to auto permission mode, skip confirmation prompt ([06ddd81](https://github.com/cameronraysmith/vanixiets/commit/06ddd81b6525337d32ab143fcab997c0b5665213)) * **claude-code:** default to Opus 5.5 instead of Fable ([77ce242](https://github.com/cameronraysmith/vanixiets/commit/77ce2424d98d0134cba87f84f13d5b0badfcb9c9)) * **claude-code:** disable linear MCP plugin in favor of linear-cli ([009fad5](https://github.com/cameronraysmith/vanixiets/commit/009fad5e7815ebd5a8e2937e363a7d218afbe1dc)) * **claude-code:** make ccds an explicit --permission-mode auto alias ([290281c](https://github.com/cameronraysmith/vanixiets/commit/290281c8f0ec983a43383f3063f448c6ae059707)) * **claude-code:** pin and enable cognee-memory marketplace plugin ([4ea02eb](https://github.com/cameronraysmith/vanixiets/commit/4ea02eb495719e6a4ad48ad03e9dc8f89c36a324)) * **cli:** share portable capabilities with Omnigent workers ([87a35ff](https://github.com/cameronraysmith/vanixiets/commit/87a35ff98476aeedb5b2d8a99f97380f70dce547)) * **codex/mutable-settings:** mirror claude-code's mutable-config pattern ([610ffb2](https://github.com/cameronraysmith/vanixiets/commit/610ffb20deb94c6537a6a49ebfd486db9de4c017)) * **cognee/cli:** deliver quiet cognee SaaS wrapper + raw cognee-cli escape hatch ([e2e2b38](https://github.com/cameronraysmith/vanixiets/commit/e2e2b380404fc9368693ffaf97a012e87f0eeef9)) * **cognee/client:** drop MCP client, deliver plugin env + per-host X-Api-Key ([cf28aa7](https://github.com/cameronraysmith/vanixiets/commit/cf28aa7c476bcb054d8044cfc0e8c8415c29f7a5)) * **cognee:** add cognee-nix flake input and overlay ([87ba823](https://github.com/cameronraysmith/vanixiets/commit/87ba8231088a98a3c3ff504c63269072ef2b10ec)) * **cognee:** add global cognee-cli wrapper baking mesh api-url + per-host key ([6d10d30](https://github.com/cameronraysmith/vanixiets/commit/6d10d30418ae6806b494d48ef402d6fa7cc7f4e8)) * **cognee:** attach to magnetite and add ZFS dataset ([a287e25](https://github.com/cameronraysmith/vanixiets/commit/a287e254b3657758bea18985b3943d06bac59f52)) * **cognee:** bespoke ports 9270/9271, loopback API, enable server-side http MCP ([34db6cd](https://github.com/cameronraysmith/vanixiets/commit/34db6cd558a9fa7f9939ebee4218bb7282c78033)) * **cognee:** bind REST to ZeroTier, require auth, drop MCP, gate binds ([d6486a4](https://github.com/cameronraysmith/vanixiets/commit/d6486a41071ae5f07de2516c20b435a9a7eb8f3c)) * **cognee:** deliver stibnite per-host X-Api-Key via sops home-manager secret ([b8ba588](https://github.com/cameronraysmith/vanixiets/commit/b8ba5881e6336a840587e20585bcbf555c63ae4b)) * **cognee:** enable frontend on loopback + runtime backend env behind sso-gateway ([c107a8c](https://github.com/cameronraysmith/vanixiets/commit/c107a8cd15a3a446138e7804fa87176d8fa720c8)) * **cognee:** local http MCP client config (~/.mcp/cognee.json) ([44a0d17](https://github.com/cameronraysmith/vanixiets/commit/44a0d174cb6fd7ce596e4f7a47e43c3833522b57)) * **cognee:** magnetite service module with clan-vars secrets and resource caps ([d7d7de5](https://github.com/cameronraysmith/vanixiets/commit/d7d7de5cbb1b97dcc03a2a592e1dea00ba452388)) * **cognee:** seed flake.lib.hosts registry + derived flake.lib.cognee source of truth ([30b8b7b](https://github.com/cameronraysmith/vanixiets/commit/30b8b7b9e3dd2b75b7e0c29e2cba47f2b051e49a)) * **commands/dev:** add claude-sessions-live for live session enumeration ([12a605e](https://github.com/cameronraysmith/vanixiets/commit/12a605e8e78e570f9f528f943e1974ca545090be)) * **commands:** add ts-restore ([c16b2b3](https://github.com/cameronraysmith/vanixiets/commit/c16b2b33a64299ca6a2695d32976e37d47a851fa)) * **context:** add operating-principles section, factor task-scoped prose out of agents-md body ([e388625](https://github.com/cameronraysmith/vanixiets/commit/e3886254175131a63500b513f53669b98d251e0f)) * **context:** integrate the discharge obligation into agent context ([424efcc](https://github.com/cameronraysmith/vanixiets/commit/424efcce45dc3f20b8e2f3c9a204132fd01ee7d0)) * **darwin:** declare per-host sshd posture as an operator claim ([323adbb](https://github.com/cameronraysmith/vanixiets/commit/323adbba6c010be579d56e963155e1dcfb7aec3c)) * **darwin:** declare sshd server enablement for stibnite ([25d10e7](https://github.com/cameronraysmith/vanixiets/commit/25d10e7cc6efcf78b8f89ce9557778345df6c5ad)) * **darwin:** enable encrypted DNS on argentum and rosegold ([a0bdafd](https://github.com/cameronraysmith/vanixiets/commit/a0bdafda3e383af90fb9727f08b7e5864577a69e)) * **development-packages:** add apm ([6a1e807](https://github.com/cameronraysmith/vanixiets/commit/6a1e807b5c5edb9c6dbbe8f85cff42dbd2dd772d)) * **development-packages:** add ghq ([891c9a8](https://github.com/cameronraysmith/vanixiets/commit/891c9a8de8e321f20e7310b5c65df5cb2acd0c69)) * **development-packages:** add linear-cli to dev packages ([0c0fe8d](https://github.com/cameronraysmith/vanixiets/commit/0c0fe8d797cb2674c157a592d67a3bdd34623b25)) * **development-packages:** add openspec to dev packages ([962beb2](https://github.com/cameronraysmith/vanixiets/commit/962beb2e4a32141cccd17121db6da405ee77557f)) * **development-packages:** add ttyd ([0c4f193](https://github.com/cameronraysmith/vanixiets/commit/0c4f1937fad0c4fa7a9e0912bd35fb023f18d0ed)) * **development-packages:** install git-repo-manager (grm) ([2403cb5](https://github.com/cameronraysmith/vanixiets/commit/2403cb5c273b1e1bfb03808cedfd179e830cf9fa)) * **devin:** add git-backed devin environment blueprint ([cc73ba0](https://github.com/cameronraysmith/vanixiets/commit/cc73ba01a02e65cb2b8e194beb97f0a64aff5b6d)) * **devin:** enable Outposts workers on stibnite and magnetite ([059c731](https://github.com/cameronraysmith/vanixiets/commit/059c731d3a443b22f3c002393c3c4d0ce498fbbb)) * **devin:** install the interactive CLI for the crs58 home ([92c0a56](https://github.com/cameronraysmith/vanixiets/commit/92c0a56b93d7d9b6ea36f3672fa4291247efe9b5)) * **devshells:** add the kanidm 1.11 client for identity administration ([0f88ff8](https://github.com/cameronraysmith/vanixiets/commit/0f88ff8277f3874262c968681ed429d15f87a530)) * **devshell:** supply the CLIs the skill corpus shells out to ([ed836e5](https://github.com/cameronraysmith/vanixiets/commit/ed836e5817816151c7e16e94e6b7f6bdd7722a50)) * **docs:** index the module tree and state its local contracts ([b55ce4d](https://github.com/cameronraysmith/vanixiets/commit/b55ce4d17f9d28b12173a5a782f29a6205645a07)) * **docs:** preserve browser evidence behind a required verdict gate ([ab6b06b](https://github.com/cameronraysmith/vanixiets/commit/ab6b06b7a4fa718783d67cd882f1ab522f398df6)) * **docs:** publish validated browser evidence from finished builds ([c7884ce](https://github.com/cameronraysmith/vanixiets/commit/c7884cebd38a386d5fbfba3e60b81c531c39a547)) * **docs:** run firefox and webkit in the hermetic e2e check ([bb59487](https://github.com/cameronraysmith/vanixiets/commit/bb59487cfea5046c43c75da2dea4e378af90d854)) * **duckdb:** 1.5.2 -> 1.5.3 ([03aaa58](https://github.com/cameronraysmith/vanixiets/commit/03aaa58a9f33219bfceef1a77c21c053849d8f01)) * **effects:** add ironstar-effects-secrets clan-vars generator ([b88985c](https://github.com/cameronraysmith/vanixiets/commit/b88985c1eb76b1565529e972a3d3833ebda9d004)) * **effects:** declare secretsMap on the vanixiets effects ([5c9feee](https://github.com/cameronraysmith/vanixiets/commit/5c9feeeeffdf38ad31cc7fe6e7f628b4624a80e5)) * **effects:** provision R2 evidence credentials for the effects runner ([6c669b3](https://github.com/cameronraysmith/vanixiets/commit/6c669b33b8517488902ccc1ad2028d729870cef0)) * **effects:** publish browser evidence on build_finished and main pushes ([aaf54c1](https://github.com/cameronraysmith/vanixiets/commit/aaf54c1bd1c8f24454bad278d51ce8e8100711c0)) * **effects:** publish browser evidence once per settled pull request build, including reused builds ([b5ca2e2](https://github.com/cameronraysmith/vanixiets/commit/b5ca2e2d664afd6ef7491dbcb789ae3b6e8af7e3)), closes [#3304](https://github.com/cameronraysmith/vanixiets/issues/3304) * **effects:** register ironstar-effects-secrets perRepoSecretFiles for github:sciexp/ironstar ([b562f4a](https://github.com/cameronraysmith/vanixiets/commit/b562f4a1bad0e59a8c10c0b2452bcdf8b0b06721)) * **effects:** resolve pull requests at runtime for both build services ([c252727](https://github.com/cameronraysmith/vanixiets/commit/c252727f40754670bbb9598df898e2528f57237c)) * **effects:** support build-finished event registration ([2c18d83](https://github.com/cameronraysmith/vanixiets/commit/2c18d83ceb925d2281655743cb954593f52d742c)) * **evidence-worker:** serve browser evidence read-only from R2 ([372fcd3](https://github.com/cameronraysmith/vanixiets/commit/372fcd352d2bdc4fa1d5f0ebdc1e3e65778f6f72)) * **firstmate:** install chrome-devtools-axi for the agent user ([e545e51](https://github.com/cameronraysmith/vanixiets/commit/e545e516aa0fc75e4a41f9fc180ddcfea2111f14)) * **flake:** add epireyn/niri-flake for typed niri configuration ([cc29b2b](https://github.com/cameronraysmith/vanixiets/commit/cc29b2b35d5e3e1136e90c452557d7ea278d0d2d)) * **flake:** add hermes-agent input with nixpkgs follows ([63c4e02](https://github.com/cameronraysmith/vanixiets/commit/63c4e02a7e0109726ce27c09510c661b637d034c)) * **gh-dash:** bind queue enqueue over the built-in merge ([c8f62e0](https://github.com/cameronraysmith/vanixiets/commit/c8f62e0bd3da1c40b8ddd4f0135f96e775b181a8)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) * **gh-dash:** review the selected PR in tuicr in a new herdr tab ([031b40d](https://github.com/cameronraysmith/vanixiets/commit/031b40d34fff079d5362db34abc5b82d7582ca6e)), closes [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [#dash](https://github.com/cameronraysmith/vanixiets/issues/dash) [owner/repo#N](https://github.com/owner/repo/issues/N) * **gh:** install stacked PR extension declaratively ([8641e50](https://github.com/cameronraysmith/vanixiets/commit/8641e504d4a740ede2154dcc78f95846179253fa)) * **ghq-sync:** register fetched/updated repos with zoxide and add --seed-zoxide ([b005177](https://github.com/cameronraysmith/vanixiets/commit/b00517792a7f72b08364bc30fec20a821933884c)) * **gitea-mq:** add magnetite credentials for the sciexp-gitea-mq app ([ca8f662](https://github.com/cameronraysmith/vanixiets/commit/ca8f6624707972235e8638f9643704fa90ce6505)) * **gitea-mq:** post-g1 ([1fdcdcf](https://github.com/cameronraysmith/vanixiets/commit/1fdcdcf14ddbe6ffdb26915f354bd2efd3c40724)) * **gitea-mq:** raise the batch cap to twenty for flake-update waves ([8e6a334](https://github.com/cameronraysmith/vanixiets/commit/8e6a334ec23fb432e450c59d8b0cdfd41826b21d)) * **gitea-mq:** retarget the stand-up change at queue-only batching ([aedc7dd](https://github.com/cameronraysmith/vanixiets/commit/aedc7dd3aa2e2fe9a04b0af79b369153eec8d5e9)) * **gitea-mq:** s1 ([9d33e2f](https://github.com/cameronraysmith/vanixiets/commit/9d33e2f6bbfa69d5f5d8cd4ae349a97470b6ee52)) * **gitea-mq:** s2 ([b677011](https://github.com/cameronraysmith/vanixiets/commit/b677011b131b59bdbde9de49c8ef0504549a9dd6)) * **gitea:** tune start-limit to survive postgres recovery window ([d4d1076](https://github.com/cameronraysmith/vanixiets/commit/d4d10764d6a7cab30d49795c82a2c9c9662d30c5)) * **hermes-agent:** add clan-vars generators for OPENROUTER_API_KEY and MATRIX_PASSWORD ([575b659](https://github.com/cameronraysmith/vanixiets/commit/575b659a97175a0450a97ea01253206b3a15cee4)) * **hermes-agent:** add defensive kernel-hardening directives; document upstream-default rationale ([5e82244](https://github.com/cameronraysmith/vanixiets/commit/5e8224469d2502f045db9d2c0103141c2fe42828)) * **hermes-agent:** add sibling hermes-agent-dashboard systemd unit ([7541a0f](https://github.com/cameronraysmith/vanixiets/commit/7541a0f1178d0a861af1c5ec6863d3b12b0ed3a6)) * **hermes-agent:** upgrade to upstream v2026.6.5, drop 27716 locale fork ([473f884](https://github.com/cameronraysmith/vanixiets/commit/473f8840f871a6e8877a8efa6c9f04055010eed1)), closes [#38383](https://github.com/cameronraysmith/vanixiets/issues/38383) [#27716](https://github.com/cameronraysmith/vanixiets/issues/27716) * **hermes-agent:** wire clan-vars-to-environmentFiles adapter ([1d04a82](https://github.com/cameronraysmith/vanixiets/commit/1d04a826859f1bf2fcda20b57ffef4e5ab6f9b04)) * **hermes:** enable voice extra (local STT) + ffmpeg/portaudio native deps ([0696936](https://github.com/cameronraysmith/vanixiets/commit/069693651c75d5472a78b94ad1851a747bd7a1cc)) * **hermes:** provision firecrawl + fal gateway client deps in the sealed venv ([238085f](https://github.com/cameronraysmith/vanixiets/commit/238085f612f4cf5ae9f70ce506a8e916bd459db4)) * **home,devshell:** expose uncomment via home packages and default devShell ([97cf62a](https://github.com/cameronraysmith/vanixiets/commit/97cf62a80c97cc3c71bd1db2e2ec87d117831d50)) * **home/agents-md:** materialize ~/.hermes/SOUL.md for hermes persona injection ([b58bd9d](https://github.com/cameronraysmith/vanixiets/commit/b58bd9d3e8ff546732739bd19e362629c9f5a137)) * **home/ai/claude-code:** disable git instructions ([5e2cebe](https://github.com/cameronraysmith/vanixiets/commit/5e2cebebc5d5cf1e41af4c5139a117b6e7644b3e)) * **home/ai/claude-code:** enable Linear official plugin ([c5e39d8](https://github.com/cameronraysmith/vanixiets/commit/c5e39d87b95bcb21b1c4cdabff0dd245da48104c)) * **home/ai/claude-code:** pin dagster-skills marketplace and enable dagster-expert ([93c2300](https://github.com/cameronraysmith/vanixiets/commit/93c2300b72702529b7d6f1e89594f86ada6afb20)) * **home/ai/claude-code:** wire WorktreeCreate/WorktreeRemove hooks + git-worktree Bash deny + worktree.baseRef ([3ca4b26](https://github.com/cameronraysmith/vanixiets/commit/3ca4b26888140c5892cc99f7f1b545af9e0e09dc)), closes [anthropics/claude-code#32355](https://github.com/anthropics/claude-code/issues/32355) * **home/ai/codex:** route Linear via direct MCP and curated plugin skill, disable apps connector channel ([86a7064](https://github.com/cameronraysmith/vanixiets/commit/86a7064379deb44d36dda3ddde4cff842282eb19)) * **home/ai/openspec:** add opt-in programs.openspec module ([a46fc92](https://github.com/cameronraysmith/vanixiets/commit/a46fc9255df3529a2e4fc020cca7155629d413e3)) * **home/ai/openspec:** regenerate vendored assets with all 11 openspec workflows ([0293fa5](https://github.com/cameronraysmith/vanixiets/commit/0293fa543452a0897efacccc4ecc1baeb4c7163e)) * **home/ai/openspec:** vendor openspec 1.3.1 claude skills + opsx commands + regen script ([7b38157](https://github.com/cameronraysmith/vanixiets/commit/7b381573d34046bb3da9e00c236b1e92b65090c8)) * **home/ai/openspec:** vendor superpowers-bridge schema for user-global openspec delivery ([4054a66](https://github.com/cameronraysmith/vanixiets/commit/4054a669fac039db2f2c3f193f5586419c536181)) * **home/ai/skills:** add knowledge-graph skill for cognee reference-corpus grounding ([910bd79](https://github.com/cameronraysmith/vanixiets/commit/910bd7996a9eef2cefa3d625c0dc3d4f4654c12b)) * **home/ai/skills:** add refinement-driven-development skill ([571474d](https://github.com/cameronraysmith/vanixiets/commit/571474d3100cbe5c7e282baa909e33e8f1cbd68e)) * **home/ai/skills:** exclude pocock tdd skill from delivery ([1a7ed6d](https://github.com/cameronraysmith/vanixiets/commit/1a7ed6da0d53ebb93570a01855ae3e0666e6874a)) * **home/ai/skills:** inject coreSkills into ~/.hermes/external-skills/ ([9f49c08](https://github.com/cameronraysmith/vanixiets/commit/9f49c081f66123af911761b33ff61b7cd109d0b2)) * **home/ai:** add herdr agent multiplexer via prebuilt herdr-bin ([996b3f2](https://github.com/cameronraysmith/vanixiets/commit/996b3f2ffd1fee0422c75129fd14d4f0d2250d49)) * **home/ai:** add hunk diff-review tool with vendored review skill ([6a432c3](https://github.com/cameronraysmith/vanixiets/commit/6a432c365e4b82a5571cd1732eca7fb0c254fadc)) * **home/ai:** add the moshi-hook service module ([42074c9](https://github.com/cameronraysmith/vanixiets/commit/42074c9555fed26de05f49e700e8a5f3e3fb66f7)) * **home/ai:** add worktrunk via upstream HM module over worktrunk-bin ([e210071](https://github.com/cameronraysmith/vanixiets/commit/e210071ab285ddb91f790b294809165a80377840)) * **home/ai:** assign omp model roles by consumer ([4bdc2db](https://github.com/cameronraysmith/vanixiets/commit/4bdc2db531810beed58ef9df3cba6575e719d81a)) * **home/ai:** bind prefix+! to break pane into a new tab ([bbcc33c](https://github.com/cameronraysmith/vanixiets/commit/bbcc33c56d3eca1fcb8cd0666af61dfb60f48726)) * **home/ai:** declare atomic model roles in settings.json ([d99a789](https://github.com/cameronraysmith/vanixiets/commit/d99a78919e6a7d2f1bdf988169cdc17958437686)) * **home/ai:** enable ouroboros claude code plugin with version-coupled mcp registration ([f59822f](https://github.com/cameronraysmith/vanixiets/commit/f59822f5619cd517a563648b12d62c69810a1d04)) * **home/ai:** install the atomic coding agent ([2d41664](https://github.com/cameronraysmith/vanixiets/commit/2d4166406b406b34c2a070e948f93d048791dadd)) * **home/ai:** migrate claude code plugin marketplaces to store-pinned directory sources ([4ca2f1c](https://github.com/cameronraysmith/vanixiets/commit/4ca2f1c8a7d31727a9d9a889551afc3548294137)) * **home/ai:** move omp memory from hindsight to the local mnemopi store ([e8ce188](https://github.com/cameronraysmith/vanixiets/commit/e8ce18857a37efa9b2e40f4ba304d19ecd0d1f1a)), closes [.#mnemopi-memory-validate](https://github.com/./issues/mnemopi-memory-validate) * **home/ai:** split claude-code across an orchestrator and worker model ([c496ca3](https://github.com/cameronraysmith/vanixiets/commit/c496ca3cc30393519ab68d4af375c1c1a6c1cabc)) * **home/ai:** vendor herdr control skill from ogulcancelik/herdr@v0.7.1 ([c10cc42](https://github.com/cameronraysmith/vanixiets/commit/c10cc42a670afb70f6f94ef448dc741e00f4156f)) * **home/claude-code:** disable bg-isolation worktree guard fleet-wide ([13a770a](https://github.com/cameronraysmith/vanixiets/commit/13a770a1a21adec8e74cae9ed03676ad120430c4)) * **home/core:** colorize man pages via bat MANPAGER cross-shell ([d282f47](https://github.com/cameronraysmith/vanixiets/commit/d282f473c40b83f9a7dc871d82a5f79c992382d3)) * **home/crs58:** adopt schpet linear-cli credentials.toml config ([aeeb2f5](https://github.com/cameronraysmith/vanixiets/commit/aeeb2f5a325454e221ffa6ccd63bf6c2e60c2061)) * **home/crs58:** declarative linear-cli config via sops template ([f9c1cb0](https://github.com/cameronraysmith/vanixiets/commit/f9c1cb00b9cc30f93ed736e1b0c7acbf5b94a529)) * **home/crs58:** declaratively pin openspec global config (custom profile, 11 workflows) ([b10d58d](https://github.com/cameronraysmith/vanixiets/commit/b10d58d766d9c0a52b2c928aa7721afe7adf441e)) * **home/crs58:** declare buzz-nsec sops secret ([342f7e6](https://github.com/cameronraysmith/vanixiets/commit/342f7e6cd1835f47f07a0694c7212a811c4d34d4)) * **home/crs58:** inject linear-cli bundled skills via aiSkills.extraSkillDirs ([e8a3279](https://github.com/cameronraysmith/vanixiets/commit/e8a3279cf57509c365a462ea08b05d8d7150912c)) * **home/crs58:** inject openspec skills + opsx commands at user level ([3eb3040](https://github.com/cameronraysmith/vanixiets/commit/3eb3040c0b2f0e2038ed40e3b5a65786595e3b3b)) * **home/crs58:** route buzz credentials through the nix-built helper ([f33a945](https://github.com/cameronraysmith/vanixiets/commit/f33a9456d22f0bbf424c24ac969087532a220218)) * **home/crs58:** route buzz git credentials through git-credential-nostr ([d07fd77](https://github.com/cameronraysmith/vanixiets/commit/d07fd7758b50845673e99a35575226116331d777)) * **home/packages:** add datafusion-cli alongside the duckdb CLI ([9ec9364](https://github.com/cameronraysmith/vanixiets/commit/9ec93640b07229b34d7baa5ae8edda92d0e8ec7c)) * **home/packages:** add forgejo-cli (fj) to development tools ([2ce5425](https://github.com/cameronraysmith/vanixiets/commit/2ce54255b531bad540ba071f9cc075f630ab91cb)) * **home/packages:** install cursor-agent from llm-agents ([807b892](https://github.com/cameronraysmith/vanixiets/commit/807b892411f2133cd39116ba268997ea5d635181)) * **home/shell/fish:** plugin-git parity, superiority plugins, native editor-edit ([12ba639](https://github.com/cameronraysmith/vanixiets/commit/12ba639aa8a2a6386ca2c595209a027df8f3be62)) * **home/terminal:** add carapace cross-shell completer for nix and gap completions ([ff447f8](https://github.com/cameronraysmith/vanixiets/commit/ff447f87ab3ae5932dcee9f39bd77d56b8268be8)) * **home/terminal:** browser-terminal wrapper around ttyd and herdr ([c7d1607](https://github.com/cameronraysmith/vanixiets/commit/c7d160735aa44972ae0bad2a192d0ac08e06679e)) * **home/tools/agents-md:** invert dispatch instruction to mode-conditional three-tier model — diamond default in jj mode, worktrees only on explicit request ([506ef12](https://github.com/cameronraysmith/vanixiets/commit/506ef12971685c7b3cf059b1ceea87bad0aaf0d9)) * **home/tools/agents-md:** reconcile skill routing with beads/session-* deprecation ([02b504c](https://github.com/cameronraysmith/vanixiets/commit/02b504c2b1631e0b5fe5d43dd25cd3041e07bc54)) * **home/tools/agents-md:** surface compositional continuous verification and nix-flake-pr-cycle in development guidelines ([05f0399](https://github.com/cameronraysmith/vanixiets/commit/05f039927769adf39854952231cde455cf2b95f7)) * **home/tools/commands:** add hermes-backup tool for archival tar.zst snapshots ([76b9b8b](https://github.com/cameronraysmith/vanixiets/commit/76b9b8ba049bb0ae6baa8562f0aae30c689ec773)) * **home/tools/commands:** add hermes-restore for converting tar.zst back to hermes-import zip ([88042b2](https://github.com/cameronraysmith/vanixiets/commit/88042b247ce8ff29db663e7ba4f0e977742eec15)) * **home/tools/git:** add commit-checks script for github+gitea ([2e87043](https://github.com/cameronraysmith/vanixiets/commit/2e870432b50c417959877f67de3b46815312fedc)) * **home/tools/git:** wrap commit-checks as home-manager package ([689d85e](https://github.com/cameronraysmith/vanixiets/commit/689d85e4b74d694c79ee971517174753be9a2858)) * **home/tools/hooks/verify-diamond-before-edit:** accept in-chain and splice-stack @ positions; refine SKILL.md doctrine ([01dbf7a](https://github.com/cameronraysmith/vanixiets/commit/01dbf7acfccfd7459e31e7d91916298547a9eab4)) * **home/tools/hooks/verify-diamond-before-edit:** unify case D to mutable diamond interior for jj edit at any internal commit ([c2cd88c](https://github.com/cameronraysmith/vanixiets/commit/c2cd88ca1b44e29f137d12aaf48424cdf8acdc1a)) * **home/tools/hooks:** jj worktree-create/remove + git-worktree gate hooks ([47e0325](https://github.com/cameronraysmith/vanixiets/commit/47e0325ece27e35ecf5e7e1cef2c2e4fc8f4a4be)) * **home/tools:** add buzz CLI wrapper injecting the sops nostr key ([e510ab5](https://github.com/cameronraysmith/vanixiets/commit/e510ab5779da293c51365380f44e7b3cec3965ec)) * **home/tools:** add rclone-saturate cross-cloud copy command ([d503c4f](https://github.com/cameronraysmith/vanixiets/commit/d503c4f85a594d8a9ec4c5b631db11958d2a2b2c)) * **home/ubuntu:** import core and herdr; disable the systemd ssh-agent ([f640e26](https://github.com/cameronraysmith/vanixiets/commit/f640e26a97b0d403afea18442b47b9d35e577e58)) * **home:** add managedConfigs for files applications also write ([3c35e10](https://github.com/cameronraysmith/vanixiets/commit/3c35e10d68bb9b1c3c9e095ea7154791ec79718e)) * **home:** add ubuntu profile for the Devin sandbox ([b575fb0](https://github.com/cameronraysmith/vanixiets/commit/b575fb00dbdb87a2c3472cb2ea3a9839f9f98e55)) * **homebrew:** add buzz ([5f767ff](https://github.com/cameronraysmith/vanixiets/commit/5f767ff3429b5e52129627f2758f6492d274bf67)) * **homebrew:** add chatgpt, factory, and rescuetime ([b39942c](https://github.com/cameronraysmith/vanixiets/commit/b39942ce1a1f5103bbe26a3707bdabbfa0183faf)) * **homebrew:** add flighty ([06c4a84](https://github.com/cameronraysmith/vanixiets/commit/06c4a844871a7d06fb7df21715f52cc83bd5635b)) * **homebrew:** add handy ([1af7be9](https://github.com/cameronraysmith/vanixiets/commit/1af7be9aaaa174bc7f9b52711f7c379575bbeb0c)) * **homebrew:** add pomatez ([f495734](https://github.com/cameronraysmith/vanixiets/commit/f495734711fb95c412f35f475dc5835a033f3f36)) * **homebrew:** add spotify ([211adca](https://github.com/cameronraysmith/vanixiets/commit/211adca02050b9df87e6c471e568526aded34e55)) * **home:** declare Devin CLI configuration and Outposts workers ([e1b7936](https://github.com/cameronraysmith/vanixiets/commit/e1b79368f983a735aabd62b2429ada46e493a1fd)) * **home:** declare herdr onboarding, updates, and session recovery ([bbdeeb2](https://github.com/cameronraysmith/vanixiets/commit/bbdeeb2f40534bc8fd6d0d38bf504049349454ba)) * **home:** gate homeConfigurations emission on a per-user systems list ([0570a42](https://github.com/cameronraysmith/vanixiets/commit/0570a42bfc69e411db38e9bdf1ede9fee9508b4c)) * **home:** install sops secrets without a systemd user manager ([6ffc7bb](https://github.com/cameronraysmith/vanixiets/commit/6ffc7bb7283e3e4a7836606980db7ecdf45386e4)), closes [#2938](https://github.com/cameronraysmith/vanixiets/issues/2938) * **home:** install ubuntu sops secrets at session start from a per-shell hook ([6e70397](https://github.com/cameronraysmith/vanixiets/commit/6e703977f57c0724cc67a77d2bd4e2a37c5111f3)) * **home:** ultracode by default + claude-name-background launcher ([3d1e9ce](https://github.com/cameronraysmith/vanixiets/commit/3d1e9ce3b0ff7fb3ec93d2f7fc2e6c2ac6ac508b)) * **hooks/gate-dangerous-commands:** permit canonical gh pr create -d, NOTICE via ntfy ([d602b2c](https://github.com/cameronraysmith/vanixiets/commit/d602b2cace14217d5680413894df85814ade4dea)) * **hooks/gate-dangerous-commands:** permit non-default push, NOTICE via ntfy ([2a2e598](https://github.com/cameronraysmith/vanixiets/commit/2a2e59827a80d1875d975311040b6523ada8d866)) * **hooks/gate-dangerous-commands:** permit ssh/scp/rsync to .zt hosts, NOTICE via ntfy ([d8e2532](https://github.com/cameronraysmith/vanixiets/commit/d8e253286359d67e66522c6e962928130da8a35b)) * **hooks:** add gate-worktree-surfaces enforcement script ([c476173](https://github.com/cameronraysmith/vanixiets/commit/c47617326abd8fc4ddb2f574f7346ad89e88cf85)) * **hooks:** add verify-diamond-before-edit tier-aware integrity check ([b70fd2d](https://github.com/cameronraysmith/vanixiets/commit/b70fd2dda66aec26577d8bd541ce2f8881170329)) * **hooks:** lift the nix run/shell and git push confirmation gates ([5aadf36](https://github.com/cameronraysmith/vanixiets/commit/5aadf3695ded35807cdb9caf4410a0bdf5a5170f)) * **hooks:** resolve the target repository and downgrade the worktree gates to ask ([3882b97](https://github.com/cameronraysmith/vanixiets/commit/3882b97cdff2791bfbc68f6c496b62df0fc522e5)) * **jj-join-chains:** list development-join chain bookmarks by tip timestamp ([78ae064](https://github.com/cameronraysmith/vanixiets/commit/78ae064c6232c8e61bab7ec83bdbf35c3d30ae37)) * **jj-linearize-join:** add --keep-remaining flag for subset Phase 4 ([9cfeb56](https://github.com/cameronraysmith/vanixiets/commit/9cfeb56cf7680774ce31af152c086b3dfa19125a)) * **jj-linearize-join:** reconstruct development join when --keep-remaining is set ([7216fa6](https://github.com/cameronraysmith/vanixiets/commit/7216fa66c777a00c9e1158ce842fb71f2b233cc1)) * **jj:** add diamond revset ([cb0c340](https://github.com/cameronraysmith/vanixiets/commit/cb0c340a3afb76cb852e9df0ff72d71a6f3b3578)) * **jj:** mark queued pull requests and add a dequeue key ([ab8caaf](https://github.com/cameronraysmith/vanixiets/commit/ab8caafaf0ab506b2b4ac5c900b14495633233d5)) * **jj:** mint gerrit change-id trailers from the jj change id ([4734755](https://github.com/cameronraysmith/vanixiets/commit/4734755c882488fef1b4a4e1b62a6f3d3f8001a4)) * **jj:** show pull request numbers next to bookmarks ([f44fcc1](https://github.com/cameronraysmith/vanixiets/commit/f44fcc151456c20988c5ceb068276ebeffaa8ce9)) * **just:** choose the remote host for check-fast ([3544c4c](https://github.com/cameronraysmith/vanixiets/commit/3544c4c46454265c62ff09b7a91d3591b9b15224)) * **justfile:** summarise renovate dry runs and guard bun updates against renovate holds ([0df9de3](https://github.com/cameronraysmith/vanixiets/commit/0df9de332e2b3896483c5eabaf1a592b4da81f18)) * **just:** let nix-flake-io target a chosen system ([321d6c8](https://github.com/cameronraysmith/vanixiets/commit/321d6c84e314e45802ec69c25ea2850d07c80b14)) * **just:** route check-fast by target system ([4fc789a](https://github.com/cameronraysmith/vanixiets/commit/4fc789aa46382bc2f26860edbb156a08e00b4cbc)) * **k3d:** run cilium with kube-proxy replacement on k3s v1.33.13 ([5066198](https://github.com/cameronraysmith/vanixiets/commit/5066198295ad8c3c843ffe3592bdca4dbf597b8a)) * **kanidm:** bump server to 1.11 and restore the default backup schedule ([fa0ca9c](https://github.com/cameronraysmith/vanixiets/commit/fa0ca9ca7c148fd953dc9685c98cc2029fe4ff33)) * **linear:** register the requirements-engineering project ([84bb7cb](https://github.com/cameronraysmith/vanixiets/commit/84bb7cb9eece6b2059d113562140a8d838a0f746)) * **machines/darwin/stibnite:** inject nix daemon prerequisites for nspawn nixos tests into rosetta-builder guest ([3788a57](https://github.com/cameronraysmith/vanixiets/commit/3788a573ca137adf02f383e28d411600172ab096)) * **machines/darwin/stibnite:** mkForce-replace nix.buildMachines entry to advertise uid-range for rosetta-builder dispatch ([dd16686](https://github.com/cameronraysmith/vanixiets/commit/dd16686c8988aa7e21223e92a7bb2c03b3cfa013)) * **machines/nixos/magnetite:** enable nix daemon prerequisites for nspawn nixos tests ([c0a82ff](https://github.com/cameronraysmith/vanixiets/commit/c0a82ff70b209970e617af7410966718ff06c92c)) * **magnetite-builder:** add shared remote-builder module and enable on stibnite ([fccff9f](https://github.com/cameronraysmith/vanixiets/commit/fccff9f1439c074e8cba4dce45f8e79b3c9620f8)) * **magnetite,pyrite:** enable the evaluation lock and memory guards ([36996d2](https://github.com/cameronraysmith/vanixiets/commit/36996d28f1b4f6dafe8e21752f06e4c4a54804ad)) * **magnetite/kanidm:** declarative site-branding via systemd oneshot (display=" ", logo=flake.brand.logo) ([26d308b](https://github.com/cameronraysmith/vanixiets/commit/26d308b2a2754c8cfcad38f97550d41a81644bc1)) * **magnetite/kanidm:** grant cameron synapse OIDC access via matrix_users membership ([93fc360](https://github.com/cameronraysmith/vanixiets/commit/93fc360b33ab88cb53d06e580fa5a854be3535a2)) * **magnetite/kanidm:** harden admin passwords to 7 words + restartUnits for rotation propagation ([b39a87d](https://github.com/cameronraysmith/vanixiets/commit/b39a87d12228fe26ad91ee8ca2a3ea1993029cb4)) * **magnetite/kanidm:** improve synapse RS /ui/apps tile (Element direct-login + logo) ([c815fa0](https://github.com/cameronraysmith/vanixiets/commit/c815fa004bef89c90e62a21b84c2001d6753c612)) * **magnetite/kanidm:** point /ui/apps tile to Cinny with hs pre-populated + client-agnostic matrix logo ([ab01db6](https://github.com/cameronraysmith/vanixiets/commit/ab01db616994dda0697d99f2975f7cbd358b7c31)) * **magnetite/matrix:** add matrix.scientistexperience.net CNAME to terranix ([e9bd237](https://github.com/cameronraysmith/vanixiets/commit/e9bd2371bdb3d3d78735613464c686cd51cfe3e2)) * **magnetite/matrix:** close synapse password rail (password_config.enabled=false) and remove matrix-password-cameron + register-users wiring ([1c6c7ff](https://github.com/cameronraysmith/vanixiets/commit/1c6c7ffb34b5d1f8795efd3e437787b64bd05001)) * **magnetite/matrix:** pre-deploy hardening + extended CI probes (nix-dk1) ([de0f381](https://github.com/cameronraysmith/vanixiets/commit/de0f3818851af060aeb8d6d2bea9c7041e646812)), closes [hi#entropy](https://github.com/hi/issues/entropy) * **magnetite/matrix:** public Synapse + Element Call/LiveKit/coturn stack (mag-2..mag-13) ([4b0699f](https://github.com/cameronraysmith/vanixiets/commit/4b0699fa3bad97fe8c4f93eb06a4c5bbd0ecf696)) * **magnetite/matrix:** wire synapse OIDC client with kanidm IdP (LoadCredential + allow_existing_users) ([4e2abde](https://github.com/cameronraysmith/vanixiets/commit/4e2abde5bd968a48c6c97c4934506f70e3dd12d8)) * **magnetite:** add kanidm IdP module scaffold with nginx-fronted TLS ([867ef8b](https://github.com/cameronraysmith/vanixiets/commit/867ef8bbacd163759ec8fb50c2bed72725c07958)) * **magnetite:** apply omnigraph policy bundles ([836ebb6](https://github.com/cameronraysmith/vanixiets/commit/836ebb6298d83b1fc33f7e45efff19142133de56)) * **magnetite:** authorize stibnite nix-remote-build key on builder user ([8c8328d](https://github.com/cameronraysmith/vanixiets/commit/8c8328dbce558ff573ece3c7b4640e15c53230fd)) * **magnetite:** clan-vars generators for kanidm admin and synapse oauth2 secrets ([5b0dc95](https://github.com/cameronraysmith/vanixiets/commit/5b0dc95c37a27988b747b8a1f6cf85b807ec6f70)), closes [#7](https://github.com/cameronraysmith/vanixiets/issues/7) * **magnetite:** deploy omnigraph server ([a2f7b86](https://github.com/cameronraysmith/vanixiets/commit/a2f7b8676769fd6d5e5c6963a2ed53280f6b0ce5)) * **magnetite:** disable self-hosted cognee server + SSO gateway (reversible; config retained) ([3783645](https://github.com/cameronraysmith/vanixiets/commit/378364579043559cea184ac937d31e553ad6cd21)) * **magnetite:** disable ZFS auto-snapshot on root/nix dataset ([d5b7bf1](https://github.com/cameronraysmith/vanixiets/commit/d5b7bf117967c151cf5609524f974325cb293206)) * **magnetite:** extend zfs auto-snapshot opt-out to docker and podman ([7051ee9](https://github.com/cameronraysmith/vanixiets/commit/7051ee95a06c6c375b2383698144f3055eab1738)) * **magnetite:** import effects-ironstar-secrets flake module ([0741380](https://github.com/cameronraysmith/vanixiets/commit/07413806b5b9fffb857dfbf0fd84c4ca98315b2d)) * **magnetite:** import kanidm IdP module on magnetite ([7983c22](https://github.com/cameronraysmith/vanixiets/commit/7983c22080fb080fa467c24ece78857f31abff10)) * **magnetite:** import matrix module into flakeModules (mag-14) ([e2c9dde](https://github.com/cameronraysmith/vanixiets/commit/e2c9dde71b573e651e42c04230c103197e12e7bc)) * **magnetite:** import sso-gateway, enable gateway + register cognee consumer ([f07466b](https://github.com/cameronraysmith/vanixiets/commit/f07466bcf0bca64aec66f15518e4f535f28ac674)) * **magnetite:** raise nix min-free/max-free thresholds for build host ([a0d5f64](https://github.com/cameronraysmith/vanixiets/commit/a0d5f64509bc5bc57d841b4e6f3cea8fedaf85d3)) * **magnetite:** size zram to 150% of RAM and raise swappiness to 100 ([ea70970](https://github.com/cameronraysmith/vanixiets/commit/ea70970e0bbf06c19c3e0d5b42ca29404cb81b29)) * **magnetite:** tune ZFS autoSnapshot retention for cloud VPS ([b19f746](https://github.com/cameronraysmith/vanixiets/commit/b19f746a239327a2ed8e54cc08b3a114bcf8a7eb)) * **mergify:** require nixbot's checks instead of buildbot's ([9745589](https://github.com/cameronraysmith/vanixiets/commit/97455891bae09df103cbc7299db8ba8a678e64b0)) * **meta-search-sessions:** search claude, codex, and pi sessions ([0cbb7ff](https://github.com/cameronraysmith/vanixiets/commit/0cbb7ff72bf636164ef377e9a6a64e133e960bb3)) * **modules/system:** add beads-client module gating BEADS_DOLT_SERVER_MODE wrap ([fc0945c](https://github.com/cameronraysmith/vanixiets/commit/fc0945c9023d9b38c3cde3d8fe023cc3d8a46607)) * **moshi:** disable usage collection declaratively ([0d703f6](https://github.com/cameronraysmith/vanixiets/commit/0d703f6d52b5ac34179a9c766e54740034a9ea8a)) * **nix.gc:** switch from weekly to daily cadence ([b1b779f](https://github.com/cameronraysmith/vanixiets/commit/b1b779fe8fe6933083775b3208d7b14c73cba924)) * **nixbot:** add nixbot aspect and compose it onto magnetite ([9919def](https://github.com/cameronraysmith/vanixiets/commit/9919defcd74bd1ce15ea819589f8f8573b6824e8)) * **nixbot:** add nixbot flake input ([bc9fe4c](https://github.com/cameronraysmith/vanixiets/commit/bc9fe4ca782d6a589776ea7a8b0a6a3fca2638c2)) * **nixbot:** admit sciexp/ironstar without effects secrets ([1a8951f](https://github.com/cameronraysmith/vanixiets/commit/1a8951f366098172eecce06799caa6771949620f)) * **nixbot:** admit vanixiets and push its builds to the binary cache ([de3b201](https://github.com/cameronraysmith/vanixiets/commit/de3b201913899ce83827a5fe64ebffe0c24f5557)) * **nixbot:** declare nixbot DNS record ([5afc3cd](https://github.com/cameronraysmith/vanixiets/commit/5afc3cd11a5e60db255f4a7bf765e1cb9bf39b90)) * **nixbot:** dispatch effects on pull requests as buildbot-nix does ([1c260eb](https://github.com/cameronraysmith/vanixiets/commit/1c260eb860d579e37348fb6c7d5d57a220e725c8)) * **nixbot:** enable the GitHub integration on the dedicated application ([6117bde](https://github.com/cameronraysmith/vanixiets/commit/6117bdeb188855c6f6540960f80cec211a6959cb)) * **nixbot:** read ironstar effects secrets from the existing generator ([59e438d](https://github.com/cameronraysmith/vanixiets/commit/59e438d85100ba6e1386f69af45d253206d2782a)) * **nixbot:** read vanixiets effects secrets from the existing generator ([e36b8ba](https://github.com/cameronraysmith/vanixiets/commit/e36b8ba5e2c326e33c534795c9df19c05721e525)) * **nixbot:** scope effect dispatch to default-branch pushes ([cb1fcb2](https://github.com/cameronraysmith/vanixiets/commit/cb1fcb2c918c8bc80f3b6f0f168c5627cd3ba36c)) * **nixos:** add memory-pressure guards and an omnigent slice cap ([6bac132](https://github.com/cameronraysmith/vanixiets/commit/6bac13233ce848d21e9d0ac6c764f1e8b5d11608)) * **nixos:** add reusable sso-gateway module — bespoke oauth2-proxy-kanidm unit + per-service registration + auto-derived kanidm client ([54217b1](https://github.com/cameronraysmith/vanixiets/commit/54217b1f23844f20e8be5e00454390b44cab117e)) * **nixos:** add the dnscrypt-proxy module for NixOS hosts ([7e8d9a5](https://github.com/cameronraysmith/vanixiets/commit/7e8d9a565c7e05904c17ff9116e955a3b13bf501)) * **nixpkgs:** patch nixos-facter for the MacBookPro14,1 SPI touchpad ([6fe80a6](https://github.com/cameronraysmith/vanixiets/commit/6fe80a67415ebf3b1dc80dd9ef928f9dc6049a64)), closes [#672](https://github.com/cameronraysmith/vanixiets/issues/672) [#339](https://github.com/cameronraysmith/vanixiets/issues/339) * **nix:** register pyrite as the fleet's kvm remote builder ([fabd01a](https://github.com/cameronraysmith/vanixiets/commit/fabd01ae87076826e07536b30d5f7691f8c53611)) * **nix:** serialize nix-eval-jobs behind a host-wide evaluation lock ([b5e2b75](https://github.com/cameronraysmith/vanixiets/commit/b5e2b75d9ee0ed37f4e953685f6fb913deb04cd7)) * **omnigent:** acp-runtime-environment ([f8e6555](https://github.com/cameronraysmith/vanixiets/commit/f8e655544f417d688e4af56a687934dfa4f845c1)) * **omnigent:** add dedicated Darwin worker adapter ([6ef13c7](https://github.com/cameronraysmith/vanixiets/commit/6ef13c72e50cb6422efc4a5c98a06388d1c16810)) * **omnigent:** add dedicated-worker login helper ([5437b73](https://github.com/cameronraysmith/vanixiets/commit/5437b73356ebafd2f2a19f34523f8c7a48f276f7)) * **omnigent:** assign Janette the experimental Linux workers ([7592628](https://github.com/cameronraysmith/vanixiets/commit/7592628601edad9404e3131f2846c396fc97214e)) * **omnigent:** darwin-host ([b635aee](https://github.com/cameronraysmith/vanixiets/commit/b635aee887869661eee032a0f2a0b1a4c0157841)) * **omnigent:** declarative-config ([c121743](https://github.com/cameronraysmith/vanixiets/commit/c12174317d15240c568b4b274a480a4f2b9986bd)) * **omnigent:** declare worker credential sources and expected identities ([e97c897](https://github.com/cameronraysmith/vanixiets/commit/e97c897f5cec92d43342d382d90d93a115d88479)) * **omnigent:** deliver worker credentials through Clan vars ([c487904](https://github.com/cameronraysmith/vanixiets/commit/c48790428bfa294bb260d1c8d7bb6cf68e79b4b4)) * **omnigent:** enable dedicated laptop workers ([024b633](https://github.com/cameronraysmith/vanixiets/commit/024b633927890055fdd8c7759194fb4b02d1570d)) * **omnigent:** host-clan ([dd8cd63](https://github.com/cameronraysmith/vanixiets/commit/dd8cd63655ab1929aafaab84e3c7a14594959439)) * **omnigent:** manage private Darwin worker Keychain ([d8aacca](https://github.com/cameronraysmith/vanixiets/commit/d8aaccae17c32370b880dfa8d46f9231cb33b397)) * **omnigent:** mask worker Linear workspaces behind labels ([1c8006d](https://github.com/cameronraysmith/vanixiets/commit/1c8006d1bb178d4942f8d214bab30f7c500ad774)) * **omnigent:** migrate magnetite to personal workers ([a284643](https://github.com/cameronraysmith/vanixiets/commit/a2846434497623a10454170adc708a8c174ba08d)) * **omnigent:** omp-acp-and-tile ([d4157a9](https://github.com/cameronraysmith/vanixiets/commit/d4157a97b75d5121806a87b9ae98d3cd5f729ca7)) * **omnigent:** package ([9663d2c](https://github.com/cameronraysmith/vanixiets/commit/9663d2cb28399b48c07620eb6b1efe44b2ba079e)) * **omnigent:** prepare dedicated worker accounts ([d20ae85](https://github.com/cameronraysmith/vanixiets/commit/d20ae85993bdf24b1685b8df3569879b12f81ff5)) * **omnigent:** pyrite-host ([4114eea](https://github.com/cameronraysmith/vanixiets/commit/4114eea1328634fed48d466852fc7eb62ddce3ea)) * **omnigent:** runtime-environment ([7f64880](https://github.com/cameronraysmith/vanixiets/commit/7f6488001d65e67e2d2c0e1ec43baf01f5a4770d)), closes [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989) [#21654](https://github.com/cameronraysmith/vanixiets/issues/21654) [#22667](https://github.com/cameronraysmith/vanixiets/issues/22667) [#25990](https://github.com/cameronraysmith/vanixiets/issues/25990) [#17989](https://github.com/cameronraysmith/vanixiets/issues/17989) * **omnigent:** runtime-tooling ([7170924](https://github.com/cameronraysmith/vanixiets/commit/7170924d1c9c7d6b519d910d26444ae606bbf1f2)) * **omnigent:** select worker engineering capabilities ([72cd472](https://github.com/cameronraysmith/vanixiets/commit/72cd4728e861418f91613e64972655e4c104fe93)) * **omnigent:** select worker GitHub tokens by resource owner ([61e3b19](https://github.com/cameronraysmith/vanixiets/commit/61e3b198c3b80cba14a5ec29b6f0c10677834308)) * **omnigent:** server ([093f46a](https://github.com/cameronraysmith/vanixiets/commit/093f46a8b7a6a0662db173ba62fa607b77713263)) * **omnigent:** share worker credentials per person across hosts ([f292242](https://github.com/cameronraysmith/vanixiets/commit/f292242f60233d554e5324eb32ec22c7802f3956)) * **omnigent:** supervise dedicated Linux workers ([a12b3c6](https://github.com/cameronraysmith/vanixiets/commit/a12b3c6c503eb215b85a3bfa1685ad5d03a62e8c)) * **omnigent:** upgrade-0-13-0 ([a7c0bd9](https://github.com/cameronraysmith/vanixiets/commit/a7c0bd99d50a31602987af3d39d5b21d8bc8c83f)) * **omnigraph:** add cli to crs58 home packages ([b54c839](https://github.com/cameronraysmith/vanixiets/commit/b54c839b2a12b384608b51fd16f9df98719848af)) * **omnigraph:** add dev graph policy bundle ([8dce2e1](https://github.com/cameronraysmith/vanixiets/commit/8dce2e11dbfef76a8c50bc580d1b1a12a0af2842)) * **omnigraph:** add home-manager client module ([25b7492](https://github.com/cameronraysmith/vanixiets/commit/25b749279c95d7fabe76cbaf4c89ad23c426b39f)) * **omnigraph:** add nixos module ([c8d465b](https://github.com/cameronraysmith/vanixiets/commit/c8d465b30fb6fc02fd1625c35b3082f0d7474d65)) * **omnigraph:** add server policy bundle ([8d986ae](https://github.com/cameronraysmith/vanixiets/commit/8d986aed0072b03ac2bbd4003fdd8db28da6e058)) * **omnigraph:** add update script ([984595d](https://github.com/cameronraysmith/vanixiets/commit/984595d27e968e43949af1b936c1a253348bf82e)) * **omnigraph:** adopt cookbook aliases for crs58 ([c4532f6](https://github.com/cameronraysmith/vanixiets/commit/c4532f6669f2556ee82ec96c54144bfa890813f2)) * **omnigraph:** deliver the upstream omnigraph skill with the client ([d21bddd](https://github.com/cameronraysmith/vanixiets/commit/d21bddd0f7472fe9616b60bd090656d3024fe2a2)) * **omnigraph:** package server and cli from pinned main ([1b87b63](https://github.com/cameronraysmith/vanixiets/commit/1b87b635c96b73e0bd78a34c485fdfdd6ed461cd)) * **omnigraph:** wire update-omnigraph app ([fe9494e](https://github.com/cameronraysmith/vanixiets/commit/fe9494e74104f1be1bcc64b2477caec2d72ee926)) * **omp:** declare the user-level config and advisor roster ([841123e](https://github.com/cameronraysmith/vanixiets/commit/841123e2f9efbb1b7d205db253127b6b8cc74c56)) * **omp:** install the oh-my-pi coding agent ([df7f6f2](https://github.com/cameronraysmith/vanixiets/commit/df7f6f23d69bfcd88eb6f041bb927b03f73da5ff)) * **omp:** plan with Opus 5.5 instead of Fable ([38c8d76](https://github.com/cameronraysmith/vanixiets/commit/38c8d76c3fc281a1e967343a8412c1a410b4f028)) * **omp:** route memory to the hosted Hindsight service ([72d4c90](https://github.com/cameronraysmith/vanixiets/commit/72d4c906f55bdc16a6fd1198c5988a7c0e8d3b06)) * **omp:** set direnv preflight budget for agent bash commands ([106f539](https://github.com/cameronraysmith/vanixiets/commit/106f539447ba48f4855c224198adccf719ac14fc)) * **openclaw:** add enable toggle and self-contain vhost/DNS/registration in the clan-service ([38558b6](https://github.com/cameronraysmith/vanixiets/commit/38558b61b8c0b16eb7b0fb51e8bee9ab132ce13f)) * **openspec/superpowers-bridge:** align governance bundle + version prose to 1.4.1 ([ca6b68e](https://github.com/cameronraysmith/vanixiets/commit/ca6b68e7eddf5080009debf04a10118ffac59ee1)) * **openspec:** add sso-gateway change — reusable shared kanidm OIDC SSO gateway spec ([97910fe](https://github.com/cameronraysmith/vanixiets/commit/97910fecbd7776d15d7dd68382543a9d9c5d4780)) * **openspec:** apm-skills-marketplace change artifacts ([a97da9f](https://github.com/cameronraysmith/vanixiets/commit/a97da9fd5fb5ad0fda9c8a4ce0fad42586872b33)) * **openspec:** archive both changes and sync four capabilities ([170664a](https://github.com/cameronraysmith/vanixiets/commit/170664ab80cf337a60ed06cc3223c0a412c8a55c)) * **openspec:** deliver both schema bundles so pinned changes resolve ([e870f95](https://github.com/cameronraysmith/vanixiets/commit/e870f952fc7ab67a27a55791bc5de51c2e47394f)) * **openspec:** fork superpowers-bridge as a first-party wrspm schema ([1cb1084](https://github.com/cameronraysmith/vanixiets/commit/1cb1084151f0f87b009fc1774d10cb07c76e5d65)) * **openspec:** populate project context, rules, and archive guidance ([caea330](https://github.com/cameronraysmith/vanixiets/commit/caea3304a7f8d727e964eaa956eec8b7b7209362)) * **openspec:** state corpus self-containment in the schema and the requirements skill ([e77b87c](https://github.com/cameronraysmith/vanixiets/commit/e77b87c84da48fb573a90eaa3f18b75bae274086)) * **packages:** add git-repo-manager (grm) rust package ([b254ce2](https://github.com/cameronraysmith/vanixiets/commit/b254ce222baef4078f1ab4058359462274c7b5d2)) * **packages:** add pinned Playwright CLI with matching browsers ([894d1ff](https://github.com/cameronraysmith/vanixiets/commit/894d1ffa68f5a93753eb064093eda7738a76e872)) * **pi:** add pi coding agent home-manager module ([28098f2](https://github.com/cameronraysmith/vanixiets/commit/28098f2d2ebd19afcba80e4d34793d1eec578af9)) * **pi:** compose exact resources and theme ([5550aa4](https://github.com/cameronraysmith/vanixiets/commit/5550aa4b1379162c6bda2cdbbf4885168b5a52ad)) * **pi:** decide edit and write by recoverability rather than severity ([a54760f](https://github.com/cameronraysmith/vanixiets/commit/a54760f271b97453005d5fccf26086cc9d342ac9)) * **pi:** enforce agent safety policy ([bf9e6fe](https://github.com/cameronraysmith/vanixiets/commit/bf9e6fea684dadd051bb71050de80611b3629257)) * **pi:** fold thinking blocks by default in pi and atomic ([bd8d593](https://github.com/cameronraysmith/vanixiets/commit/bd8d593e11760d44822ad8fe2b08665565a1c869)) * **pi:** package selected extensions ([d67c7dd](https://github.com/cameronraysmith/vanixiets/commit/d67c7dd450880819f402db083f92cc9e6cddc5b9)) * **pi:** package the openai server-side compaction extension ([c5cd3fd](https://github.com/cameronraysmith/vanixiets/commit/c5cd3fdebceb72f1a9b5d53ff270b124dbd989e7)) * **pi:** register the server-side compaction extension ([ab9451b](https://github.com/cameronraysmith/vanixiets/commit/ab9451bc91129355f092f621879c3a7e12322085)) * **pkgs/atomic:** switch to the npm distribution from-source build ([4f9848d](https://github.com/cameronraysmith/vanixiets/commit/4f9848d6c72d0911a7a35ed359b70d244d0e3f1c)), closes [.#atomic](https://github.com/./issues/atomic) * **pkgs/beads:** restore at 1.0.4 with darwin cgo and dolt PATH from llm-agents shape ([cd4c68a](https://github.com/cameronraysmith/vanixiets/commit/cd4c68a7685a9700099f4e8012b57a42433f5427)) * **pkgs/buzz:** add buzz-source update script tracking desktop-v tags ([e572e0a](https://github.com/cameronraysmith/vanixiets/commit/e572e0a7ca05d5936498560d359687f43da1be3c)) * **pkgs/buzz:** add pinned buzz-source carrying the shared cargo vendor ([579f2d8](https://github.com/cameronraysmith/vanixiets/commit/579f2d84d6040daf8501c32570260df95b20b4ab)) * **pkgs/buzz:** package buzz-cli ([be3a7f7](https://github.com/cameronraysmith/vanixiets/commit/be3a7f76feacbbe21f0ff7a82d5a109f25a392a1)) * **pkgs/buzz:** package git-credential-nostr with git wrapped onto PATH ([70d3f01](https://github.com/cameronraysmith/vanixiets/commit/70d3f01cc5d65d152c82e8c527aa11bf9bb4f0da)) * **pkgs/buzz:** package git-sign-nostr ([c7a20f4](https://github.com/cameronraysmith/vanixiets/commit/c7a20f4cedbbaa91b33d41daa6ffa586d5e6e2c4)) * **pkgs/dolt:** bump 1.85.0 -> 1.88.1 for beads 1.0.4 driver pin compatibility ([a17ceda](https://github.com/cameronraysmith/vanixiets/commit/a17ceda541d62b6d2fec2e692a91ae056486f936)) * **pkgs/golem-binary:** add flake-aware multi-platform update script ([de966bf](https://github.com/cameronraysmith/vanixiets/commit/de966bfddebd1d318d8279196c6d81e6386cddea)) * **pkgs/golem-binary:** add prebuilt full Golem CLI derivation ([9d373eb](https://github.com/cameronraysmith/vanixiets/commit/9d373eb45555e85095a6da370e6fbcc1c6ce07fc)) * **pkgs:** add dependency-sources by-name package + home install ([7232204](https://github.com/cameronraysmith/vanixiets/commit/7232204793a17fee1884ce011d0c755807ea2cbb)) * **pkgs:** add ghq-sync by-name package + home install ([9ccc956](https://github.com/cameronraysmith/vanixiets/commit/9ccc9568a4b51a0597ac0bdcf073e830e179446e)) * **pkgs:** add ouroboros uvx wrapper package ([0555773](https://github.com/cameronraysmith/vanixiets/commit/0555773e74b4ddff1d76b9821a033bf72c544bd4)) * **pkgs:** add repo-sync by-name package + home install ([41ef988](https://github.com/cameronraysmith/vanixiets/commit/41ef9881936de8255bac3273ee59e98fc73c8dbd)) * **pkgs:** add store-pinned agent plugin marketplace sources ([1eddda5](https://github.com/cameronraysmith/vanixiets/commit/1eddda581699fe6d0ce33b81e508388c659204a1)) * **pkgs:** add the hindsight CLI ([3d482ca](https://github.com/cameronraysmith/vanixiets/commit/3d482caf8b3ecfe0d513eb3cf20304f92f042fdf)) * **pkgs:** add the moshi-hook daemon ([8c17d01](https://github.com/cameronraysmith/vanixiets/commit/8c17d01e5b381e5d99e3dcce7a6a6d8102c6bde8)) * **pkgs:** add uncomment-bin prebuilt release derivation ([49f2eb8](https://github.com/cameronraysmith/vanixiets/commit/49f2eb82fd2da2bca51ab86976e1bbb26494ace0)) * **pkgs:** add worktrunk-bin prebuilt wrapper with update app ([3d6dffe](https://github.com/cameronraysmith/vanixiets/commit/3d6dffe69a1980655ab25d8c23fd5a87b5d10053)) * **pkgs:** package linear-cli — prebuilt on Darwin, deno-run from source on Linux + update app ([e17d844](https://github.com/cameronraysmith/vanixiets/commit/e17d844781c170c998d3b2fe5fb09830c89021ea)) * **pkgs:** package linear-cli (Linear.app CLI) and add to dev packages ([4edfa59](https://github.com/cameronraysmith/vanixiets/commit/4edfa59e034674c8b781538919cb187071fb481e)) * **pkgs:** package mergify CLI as mergify-cli-bin and wire it home ([6b2d411](https://github.com/cameronraysmith/vanixiets/commit/6b2d411311f3e03016457d300322fe86db41f41d)), closes [.#mergify-cli-bin](https://github.com/./issues/mergify-cli-bin) * **pkgs:** package the atomic coding agent from its release tarball ([98adbdf](https://github.com/cameronraysmith/vanixiets/commit/98adbdffd116569a641a83614dcd3f9fb197ff13)), closes [.#atomic](https://github.com/./issues/atomic) * **pkgs:** package the firstmate toolchain and put it on the agent user's PATH ([1c1cd6c](https://github.com/cameronraysmith/vanixiets/commit/1c1cd6c1d13b2c9adeb523186656e8b9fdcac0c1)), closes [#axi](https://github.com/cameronraysmith/vanixiets/issues/axi) * **pkgs:** re-enable local duckdb and python-duckdb with machine-shadowing toggle ([7d85560](https://github.com/cameronraysmith/vanixiets/commit/7d855604f51e23479aeee3b52ccd8f6ec7953222)) * **pkgs:** vendor devin-cli 3000.6.2 with a repo-root updater ([43c5d9f](https://github.com/cameronraysmith/vanixiets/commit/43c5d9fd0ab4412ebb7a052f5585145d39e94cdb)) * **planning-and-development:** add pocock skills as locked apm dependency ([0d25b15](https://github.com/cameronraysmith/vanixiets/commit/0d25b15a08c05f8033e39b7a61096e5036c663fa)) * **playwright:** pin playwright-web-flake to a fork tag at 1.63.0 ([5491998](https://github.com/cameronraysmith/vanixiets/commit/54919980e6152f35faec6a788e3a73c148925ee1)), closes [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097) [#3097](https://github.com/cameronraysmith/vanixiets/issues/3097) * **plugins:** distribute the gh-stack skill as a transitive apm dep ([fd46b90](https://github.com/cameronraysmith/vanixiets/commit/fd46b90feadd308c19c7c6409cb38c3f728698b3)), closes [#stack](https://github.com/cameronraysmith/vanixiets/issues/stack) [github/#stack](https://github.com/cameronraysmith/vanixiets/issues/stack) * **plugins:** distribute unslop skill as transitive apm dep ([1271dda](https://github.com/cameronraysmith/vanixiets/commit/1271dda993c8089ecc5dfad530378d2b8ec4c1ff)) * **plugins:** distribute worktrunk skills as transitive apm dep ([3c22a6f](https://github.com/cameronraysmith/vanixiets/commit/3c22a6ffeafac0500b53a845c6fbaf9f8094cc0e)) * **plugins:** source hickey and lowy from srid/agency ([c0ceba1](https://github.com/cameronraysmith/vanixiets/commit/c0ceba12579f29072b69dce8c4ac3d1aa59d70f2)) * **publish-evidence:** publish each distinct report once and comment only on pull requests that change it ([6d2300f](https://github.com/cameronraysmith/vanixiets/commit/6d2300f40a3dbfc3df98a95c4310d05803c676fb)) * **pyrite:** add DankMaterialShell to niri ([c71e816](https://github.com/cameronraysmith/vanixiets/commit/c71e8161d00358c5e3dbc658b9c6501187ffaaab)) * **pyrite:** add nixos-hardware flake input (nixpkgs.follows) ([0d661b8](https://github.com/cameronraysmith/vanixiets/commit/0d661b86272b72ab71d2c41d232b7187dd16950d)) * **pyrite:** add the encrypted-ZFS disko layout ([28edecd](https://github.com/cameronraysmith/vanixiets/commit/28edecdcce5419f37d04e175746d3459aa4ebf74)) * **pyrite:** add the pyrite age anchor and bridge recipient to .sops.yaml ([c117107](https://github.com/cameronraysmith/vanixiets/commit/c11710706f2a2dda619251c1584f420942a26666)) * **pyrite:** add the pyrite host module (Apple MacBookPro14,1) ([7649907](https://github.com/cameronraysmith/vanixiets/commit/7649907b01470166602e89ebccbd2c5a20e0175c)) * **pyrite:** associate with the fleet SSID via the clan wifi service ([1335125](https://github.com/cameronraysmith/vanixiets/commit/133512502e898065d8b5c9c3e5c0ccdd4fc7663a)) * **pyrite:** defer FIDO2 enrollment to first boot ([dba79c6](https://github.com/cameronraysmith/vanixiets/commit/dba79c6bb7f70c586bb62808f685a9ba20ff0aeb)) * **pyrite:** enable declarative DankBar auto-hide ([69540f0](https://github.com/cameronraysmith/vanixiets/commit/69540f05b3c400dd2bf550ecc8726693b9d903e2)) * **pyrite:** enable the GNOME desktop under GDM ([f204463](https://github.com/cameronraysmith/vanixiets/commit/f2044639e81c18990f20c96976e7e43594ee9c76)) * **pyrite:** install pinned Zen Browser for cameron ([91c0aba](https://github.com/cameronraysmith/vanixiets/commit/91c0aba6f02770ca9b9f466435c81d01fd81d95f)) * **pyrite:** LUKS2-on-mapper disko restructure (Piece 2, eval-only; deploy ONLY via 7.12 reinstall) ([0c14a02](https://github.com/cameronraysmith/vanixiets/commit/0c14a02dce58b51e6c651a94ec8e2d375dbb5b99)) * **pyrite:** never auto-suspend on idle ([208ed13](https://github.com/cameronraysmith/vanixiets/commit/208ed134465768e37eb390fa4e90b635072ceeee)) * **pyrite:** offer niri as a second selectable session ([2a17a7d](https://github.com/cameronraysmith/vanixiets/commit/2a17a7dc1b5b62ee53356192cd8602385f66caea)) * **pyrite:** provision clan vars — sops machine key, openssh/initrd/emergency/tor host keys + cert, zerotier identity+ip, zfs passphrase, wifi fleet creds, cameron user-password recipient ([33b86d0](https://github.com/cameronraysmith/vanixiets/commit/33b86d0c89fa3f9c4fecb05de30912986f819280)) * **pyrite:** put encrypted-root admin tools in the system closure ([21f0999](https://github.com/cameronraysmith/vanixiets/commit/21f09992ecf40559e978199afd8f19e063408213)) * **pyrite:** register the machine across clan inventory, users, and structure checks ([da284a6](https://github.com/cameronraysmith/vanixiets/commit/da284a6fc4e4763aac19bf57027cf7f3ff122119)) * **pyrite:** register the pyrite.zt address record on cinnabar ([88a3d35](https://github.com/cameronraysmith/vanixiets/commit/88a3d35de987914dab3a5786b601fa7b31754745)) * **pyrite:** replace GDM with native DankGreeter ([03c9f5f](https://github.com/cameronraysmith/vanixiets/commit/03c9f5fc24ae346b747bb3aa40171f86f2e79e0d)) * **pyrite:** resolve .zt names through cinnabar's zone server ([48e1705](https://github.com/cameronraysmith/vanixiets/commit/48e17051bcde02708b54ba3d88c2df4cf8bdef10)) * **pyrite:** resolve all DNS through the local dnscrypt-proxy ([e3375ab](https://github.com/cameronraysmith/vanixiets/commit/e3375abbd13b73c96acf01694127810f62f31a8d)) * **pyrite:** set MaxAuthTries to 20, matching the rest of the fleet ([02f2bc4](https://github.com/cameronraysmith/vanixiets/commit/02f2bc4b98580a1ec666e7502aeb67e6bd1eba53)) * **pyrite:** set stateVersion to 26.05 matching the installer ISO release ([84e2241](https://github.com/cameronraysmith/vanixiets/commit/84e2241d71f900b4be765bb9dd67552c6992d03a)) * **pyrite:** set the GNOME idle lock and suspend timeouts ([215cba0](https://github.com/cameronraysmith/vanixiets/commit/215cba0c77d8d3cf394f71a54eefc5b378aaa9ba)) * **quarto-bin:** vendor upstream quarto-cli 1.9.37 binary + nix run .#update-quarto updater ([79c8f16](https://github.com/cameronraysmith/vanixiets/commit/79c8f16c23e0ff69bbbcf846a1ec15b94e65dad3)), closes [.#update-quarto](https://github.com/./issues/update-quarto) * **radicle:** run radicle-node as a user service on darwin and linux ([6ff3fa2](https://github.com/cameronraysmith/vanixiets/commit/6ff3fa2f128ae7e32d4ae021884667c74ab6464a)) * **release:** forecast each pull request's release as a check run ([976a4d0](https://github.com/cameronraysmith/vanixiets/commit/976a4d0438fbba67cc5afbdebe4810c0de4d6816)) * **secrets:** add hindsight creds ([98b5dd9](https://github.com/cameronraysmith/vanixiets/commit/98b5dd9035fe899c757f7250a602dd1310ae7dc2)) * **secrets:** add linear ([29c9719](https://github.com/cameronraysmith/vanixiets/commit/29c9719448b52aad363503298b74e6b2da27307c)) * **secrets:** wire the moshi-hook pairing token for crs58 ([cfa04a0](https://github.com/cameronraysmith/vanixiets/commit/cfa04a030afd955345af2bad94437e2e5994904e)) * **skill/meta-session-resume:** collapse multi-step procedure into one self-contained command ([83a4532](https://github.com/cameronraysmith/vanixiets/commit/83a4532ca9c7db366d65bf4f2b4167f3c32f0918)) * **skills/agentic-planning-development-workflow:** state-machine router skill ([e70d88f](https://github.com/cameronraysmith/vanixiets/commit/e70d88f8d901a1a7b67a0cf06a19c826c9ef8fb0)) * **skills/agentic-planning:** bind roborev gate to inline codex review (advisory, triage-surface, calibrated effort) ([13bc402](https://github.com/cameronraysmith/vanixiets/commit/13bc4027df1fd96ecfd3ac638a673c335b5a89b8)) * **skills/agentic-planning:** scope board execution-mode mechanisms to HIL ([8080b18](https://github.com/cameronraysmith/vanixiets/commit/8080b18fcc1cabbef7640864c0a411a5a059f80b)) * **skills/jj-{workflow,summary}:** avoid interactive editors with multi-boundary split, JJ_EDITOR escape hatch, SIGTERM recovery ([572841c](https://github.com/cameronraysmith/vanixiets/commit/572841c8f42183a55d0358526835911d41f7567a)) * **skills/jj-summary:** restructure decision tree with three-tier escalation, demote workspace to explicit-request escape hatch ([e7c3037](https://github.com/cameronraysmith/vanixiets/commit/e7c30378a8a925f7a5f9ab8095e872aa8828f1c4)) * **skills/jj-version-control/diamond-workflow:** formalize as canonical operational reference with bidirectional cross-references ([be5be41](https://github.com/cameronraysmith/vanixiets/commit/be5be41c29e4d1126cbba4dc89b00d5516ed59bb)) * **skills/jj-version-control:** consolidate development-join entity definition into canonical subsection with route-step recovery recipe ([f864e34](https://github.com/cameronraysmith/vanixiets/commit/f864e340dd9cf5a3215c1075f7ffe1d2a02652b7)) * **skills/jj-version-control:** establish tiered ceremony model for jj-mode work ([002a126](https://github.com/cameronraysmith/vanixiets/commit/002a126b42882353821cc45bcb57ebaaf5cba42a)) * **skills/jj-workflow:** reframe workspace section as explicit-user-request-only, demote isolation enumeration to informative context ([4b8ec78](https://github.com/cameronraysmith/vanixiets/commit/4b8ec7814afc9ca559ea62b8a0f428ba69c06edc)) * **skills/nix-flake-pr-cycle:** add validate-to-merge workflow skill with traceability-audit framing ([245b81c](https://github.com/cameronraysmith/vanixiets/commit/245b81c373c19190d6a015e4c8028aa664490a99)) * **skills/openspec-linear-sync:** generalize openspec/linear.yaml into a monorepo registry; move D10 ledger to per-change frontmatter ([b9fe0aa](https://github.com/cameronraysmith/vanixiets/commit/b9fe0aa6984c841c6f34613feb908736af5c6ff3)) * **skills/openspec-linear-sync:** linear-cli Linear/OpenSpec sync overlay skill ([5565be6](https://github.com/cameronraysmith/vanixiets/commit/5565be6776c2f7abf1cc6f5835cdd4f906998726)) * **skills/openspec-linear-sync:** make linear_project optional; gate archive spec-mirror on project presence (skip+log when absent) ([5b74365](https://github.com/cameronraysmith/vanixiets/commit/5b74365fb12ab1094878aee098bc8416d7f4b03a)) * **skills/openspec-linear-sync:** make setup/selection registry-aware and resolve document UPSERT per project ([815b449](https://github.com/cameronraysmith/vanixiets/commit/815b449de9ea6fa18b8ea1216faac448c3d78ece)) * **skills/openspec-linear-sync:** relocate D10 sync ledger to per-change proposal frontmatter with team-scoped state resolution ([f87a839](https://github.com/cameronraysmith/vanixiets/commit/f87a839376524d364325195ab23e634f14a835be)) * **skills/openspec-linear-sync:** resolve archive-mirror canonical spec path via 1.4.1 status --json (jq, repo-mode guarded) ([d16774b](https://github.com/cameronraysmith/vanixiets/commit/d16774b572ab6ae3a6c863e0b9cd9bce5ae18fc5)) * **skills/openspec-linear-sync:** seed and re-sync the Linear issue description from proposal.md business content ([a98d74a](https://github.com/cameronraysmith/vanixiets/commit/a98d74a48f2b886b6231846b3f0dd9d8672dbced)) * **skills/preferences-compositional-continuous-verification:** add theoretical anchor for compositional continuous verification ([e6696cb](https://github.com/cameronraysmith/vanixiets/commit/e6696cba848ae89ea495e1124ae1112f43ff386b)) * **skills/preferences-nix-checks-architecture:** add CCV meta-checks section and per-artifact observability expectation ([f21a34f](https://github.com/cameronraysmith/vanixiets/commit/f21a34fc28a0b18bc52ecc4c55112c11cf45ca71)) * **skills/preferences-nix-ci-cd-integration:** disambiguate compositional continuous verification from existing continuous-validation references ([1308096](https://github.com/cameronraysmith/vanixiets/commit/130809692efb5f05087f3a5cf1d08c2edb24858a)) * **skills/preferences-observability-engineering:** frame observability checks as first-class CCV regulators ([bdff03e](https://github.com/cameronraysmith/vanixiets/commit/bdff03ec6d07844cdfc45fb9d8855d81724a6b04)) * **skills/preferences-production-readiness:** disambiguate narrow continuous validation from compositional continuous verification ([674ac81](https://github.com/cameronraysmith/vanixiets/commit/674ac8123f497ea16ae17ad6a1b0d3a6d8e42d84)) * **skills/preferences-validation-assurance:** cross-ref CCV as systems operationalization of severity, refinement, and confidence promotion ([d2a9432](https://github.com/cameronraysmith/vanixiets/commit/d2a94329c666d2cf6064bb1d6031314ff4bb91f1)) * **skills/project-management:** human-facing PM hub skill ([7986cc4](https://github.com/cameronraysmith/vanixiets/commit/7986cc470659af8889c8ce3052aed32e10d5b21f)) * **skills/theoretical-foundations:** add type-checked Lean and Python worked example ([7faabbc](https://github.com/cameronraysmith/vanixiets/commit/7faabbc4ee65fc7266c21137278ab02d09c34544)) * **skills:** add aiSkills.extraSkillDirs store-path hook to skills injector ([7ac8bb4](https://github.com/cameronraysmith/vanixiets/commit/7ac8bb4f0564c241c7c6d43b48a944482f18fc4c)) * **skills:** add atdd-outer-loop skill ([b7081e9](https://github.com/cameronraysmith/vanixiets/commit/b7081e9f26070a6f4c29c807a99da249669e1182)) * **skills:** add bdd-gherkin-formulation skill ([078deaf](https://github.com/cameronraysmith/vanixiets/commit/078deaf1396ab8c3be3ed783676bf0d02c9118c5)) * **skills:** add bdd-step-definitions skill ([6aa8488](https://github.com/cameronraysmith/vanixiets/commit/6aa8488af5f50924b8f1241c604eaf76a00983fa)) * **skills:** add dependency-source-acquisition skill for ghq-based source review ([58e716e](https://github.com/cameronraysmith/vanixiets/commit/58e716ead2334409dcd08762b00a618cbca3bf23)) * **skills:** add meta-orchestrator-checkpoint handoff-payload-schema sub-file ([f38245e](https://github.com/cameronraysmith/vanixiets/commit/f38245e42b3f5cdfa0b6742efdb14debb2f7119b)) * **skills:** add meta-orchestrator-checkpoint routing-layer SKILL.md ([d52ca5d](https://github.com/cameronraysmith/vanixiets/commit/d52ca5d8c0484bd480392637c108363deb3746bd)) * **skills:** add meta-orchestrator-initiate discipline-and-cycle-patterns sub-file ([1b69e0c](https://github.com/cameronraysmith/vanixiets/commit/1b69e0cce523fbf1ff851d8fa6d0ab4b6a9ed37d)) * **skills:** add meta-orchestrator-initiate exemplar-session sub-file ([71a6bc8](https://github.com/cameronraysmith/vanixiets/commit/71a6bc87a1b2aab82fea609c1ed087d5e9558d9b)) * **skills:** add meta-orchestrator-initiate operational-patterns sub-file ([e9ddd81](https://github.com/cameronraysmith/vanixiets/commit/e9ddd817cf88c29872af513d3226086cdfd9219e)) * **skills:** add meta-orchestrator-initiate routing-layer SKILL.md ([8837eda](https://github.com/cameronraysmith/vanixiets/commit/8837edafee791b57737495b40022e4964db83e1e)) * **skills:** add meta-orchestrator-initiate spawn-prompt-template sub-file ([4c2a763](https://github.com/cameronraysmith/vanixiets/commit/4c2a763ecdb0559089d26b4dfa9549e8b8755fa3)) * **skills:** add meta-orchestrator-initiate tier-and-gate sub-file ([be10082](https://github.com/cameronraysmith/vanixiets/commit/be10082f20e2eae4dd9257c704ec1a6b18b97576)) * **skills:** add nucleus-platform thin-router skill ([37a9699](https://github.com/cameronraysmith/vanixiets/commit/37a9699ab6228d2fbaf129ac55f49e17fafa7146)) * **skills:** add preferences-comment-cleanup uncomment workflow skill ([2b0dd02](https://github.com/cameronraysmith/vanixiets/commit/2b0dd02bf5298d922e2a2df7a6b02ce8b1be6df3)) * **skills:** add preferences-workflow-orchestration-algebra core skill ([c19349c](https://github.com/cameronraysmith/vanixiets/commit/c19349c642f42d2220117099addc380b1566dd14)) * **skills:** add prose-clarity, essential-complexity, ci-log-verification skills and jj hazards reference ([ced2c4d](https://github.com/cameronraysmith/vanixiets/commit/ced2c4d3d52ca23f5156decbeccea02bb9007187)) * **skills:** add the README hierarchy as a documentation tier ([3665eb0](https://github.com/cameronraysmith/vanixiets/commit/3665eb0b56679848b50282a921684d44a0dbf805)) * **skills:** add the satisfaction argument audit ([bcd5655](https://github.com/cameronraysmith/vanixiets/commit/bcd565546b687bc0a83308f91b4f5998cf20fffc)) * **skills:** add the stratum dimension to the acceptance layer ([8fe17e7](https://github.com/cameronraysmith/vanixiets/commit/8fe17e7aaa841a207b057823d4fcc7cca1c281f2)) * **skills:** add the WRSPM requirements engineering hub ([fabb6c3](https://github.com/cameronraysmith/vanixiets/commit/fabb6c335fda15effaac5f6cb596d4c9bcc66f33)) * **skills:** additively integrate executable-specification-testing into the HIL TDD apply path ([e6b4394](https://github.com/cameronraysmith/vanixiets/commit/e6b439478f8a00d8f9bfa382a650e431e20044b6)) * **skills:** allow jj-workflow auto-invocation by removing disable-model-invocation flag ([278e19e](https://github.com/cameronraysmith/vanixiets/commit/278e19ed9d458e06e6fd9f4e9f71d6421d602f91)) * **skills:** bump superpowers to v6.3.0 and mattpocock to v1.2.3 ([2cec15a](https://github.com/cameronraysmith/vanixiets/commit/2cec15aa4a630f20acc7c7639764fbbf0c14c7e1)) * **skills:** bump worktrunk to v0.76.0 ([8ed34f4](https://github.com/cameronraysmith/vanixiets/commit/8ed34f4aff7ab101f6a83952bf01d3cf8146b02b)) * **skills:** cohere data-modeling siblings with the LinkML lowering-path bifurcation ([30e7759](https://github.com/cameronraysmith/vanixiets/commit/30e77598eaa07e4fb8c41be695f1e262c8f81d4c)) * **skills:** compress diamond-workflow paraphrases across jj-workflow, jj-summary, 03-jj-mode to pointer summaries with canonical link ([e29017b](https://github.com/cameronraysmith/vanixiets/commit/e29017b84802d5a28b09269b6ff225e141a6a3ba)) * **skills:** cross-ref CCV from scientific-inquiry-methodology, session-orient, session-review ([9016bd4](https://github.com/cameronraysmith/vanixiets/commit/9016bd45791d798af992c8ce3864e67eae7cc656)) * **skills:** deliver ~/.agents/skills as real files for codex (codex skips symlinked SKILL.md leaves) ([b0cb66f](https://github.com/cameronraysmith/vanixiets/commit/b0cb66fcf8ec14fb9fe7001bff59fe48e9d23871)) * **skills:** ground discovery and glossary in designation discipline ([aaf5064](https://github.com/cameronraysmith/vanixiets/commit/aaf50643b2fe24be0cea68a22f02f73277228dfd)) * **skills:** harden @-stays-[wip] diamond invariant across version-control skills ([85c7fb0](https://github.com/cameronraysmith/vanixiets/commit/85c7fb0a8dff4a472299bbcfdbc69f00229e8116)) * **skills:** own contract and institution theory in foundations ([b479a18](https://github.com/cameronraysmith/vanixiets/commit/b479a18e8265483cb43daff8c31f458735d80ac3)) * **skills:** propagate the linear-cli skill through planning-and-development ([62ad543](https://github.com/cameronraysmith/vanixiets/commit/62ad543627ab0b4d9b2725ab7352e21695e3d4c2)) * **skills:** record Linear assignee and label conventions at creation ([3463998](https://github.com/cameronraysmith/vanixiets/commit/34639980d660fa96aa52da966994b3124fc818a1)) * **skills:** record the WRSPM shear and the openspec corpus relationship ([f035f0b](https://github.com/cameronraysmith/vanixiets/commit/f035f0ba9eb104f42f718e9f35dc839f335414e4)) * **skills:** refine workflow-orchestration-algebra from dogfooding ([9a10484](https://github.com/cameronraysmith/vanixiets/commit/9a104842d0c03fb958a40a4bf2bfce37051949b0)) * **skills:** route the satisfaction argument through the verification triad ([6a0eb0e](https://github.com/cameronraysmith/vanixiets/commit/6a0eb0ec35f39162f1f67018501d14fa9f49dd12)) * **skills:** scaffold testing-and-quality apm group ([c59fd78](https://github.com/cameronraysmith/vanixiets/commit/c59fd781cf391fa7f6140944fe94059fe0e09ebe)) * **stack-land:** add hermetic landing mechanism ([33f94e2](https://github.com/cameronraysmith/vanixiets/commit/33f94e2ce211948a8ccabbd6e712ef812aa48765)) * **stack-land:** demote the landing tool to assertion-only diagnostics ([138f311](https://github.com/cameronraysmith/vanixiets/commit/138f311dae305a9a2b516514dd40e9d2f803a6a5)) * **system:** add the stibnite build-access module and wire both machines ([4d39c00](https://github.com/cameronraysmith/vanixiets/commit/4d39c00b1878bfa0c71ce2d6516da52c80eefb35)) * **system:** declare mosh across nixos and darwin machines ([a1639fd](https://github.com/cameronraysmith/vanixiets/commit/a1639fdf2b5a4e3b6260831b5c4a3b9d5b8477b9)) * **terranix:** add kb + auth Cloudflare DNS records (CNAME -> magnetite) ([7fbcb42](https://github.com/cameronraysmith/vanixiets/commit/7fbcb42d60bc2a43a5deb044aa36478dc5122d22)) * **terranix:** adopt the sciexp R2 bucket and own its lifecycle rules ([53b1e96](https://github.com/cameronraysmith/vanixiets/commit/53b1e96702b0d2afe521fded4839c5982053c620)) * **terranix:** pre-emptively add accounts.scientistexperience.net CNAME for kanidm ([1845430](https://github.com/cameronraysmith/vanixiets/commit/1845430a0a69d1bc93b6d683e9707a59a48f83d6)) * **test-and-quality:** add bdd skills ([75ec0af](https://github.com/cameronraysmith/vanixiets/commit/75ec0af959df163180fc1e245d34ed35f98a2fb5)) * **testing-and-quality:** add executable-specification-testing skill and wire atdd/algebraic-laws routing ([b63d136](https://github.com/cameronraysmith/vanixiets/commit/b63d136be7819e2e4d04f6c163aa8f4b48422fcd)) * **tm-restore:** register restored directory destinations with zoxide ([3420734](https://github.com/cameronraysmith/vanixiets/commit/3420734b76cf95f56491a6750976c2b7fd2d632e)) * **tmux:** scrub HM session-vars guards on activation ([acb2282](https://github.com/cameronraysmith/vanixiets/commit/acb228243e8c5b14e52b0e77c0bd81b83370da52)) * **tools/git:** add jj-linearize-join script and nix wrapper ([c46bd4e](https://github.com/cameronraysmith/vanixiets/commit/c46bd4ec9c0c1e4dcc73be8bd38da5f4544f16e9)) * **tools/git:** add jj-stack-submit script and nix wrapper ([327b198](https://github.com/cameronraysmith/vanixiets/commit/327b198df7cf6003d1a7baaf27e1ac844c4b3c1f)) * **tools:** add nixbot-logs CLI for nixbot build log retrieval ([d07a0f8](https://github.com/cameronraysmith/vanixiets/commit/d07a0f8bde7d5bcf57d692bdbf92aad313dcfc04)) * **tools:** replace gh-approve-open-prs with gh-queue-open-prs ([653ae31](https://github.com/cameronraysmith/vanixiets/commit/653ae31be4627626d079e506e167ffde1a167001)), closes [#approve-open-prs](https://github.com/cameronraysmith/vanixiets/issues/approve-open-prs) [#queue-open-prs](https://github.com/cameronraysmith/vanixiets/issues/queue-open-prs) * **tuicr:** deliver the upstream skill bundle with the pinned package ([004dfea](https://github.com/cameronraysmith/vanixiets/commit/004dfea93725b4b01496e895d459a80e6b8ca214)) * **uncomment:** init config ([f3482c6](https://github.com/cameronraysmith/vanixiets/commit/f3482c69fea57b301a7aea1468eb5a6d7ab47b0d)) * **wezterm:** add Shift+Enter soft-newline keybind ([f79c5c9](https://github.com/cameronraysmith/vanixiets/commit/f79c5c93500d1db62637e2e969f051f4bcd94c78)) * **workflows:** add dedicated Omnigent worker lifecycle ([cce8918](https://github.com/cameronraysmith/vanixiets/commit/cce89188d18afe0ae0634a8b824f1ecf969e8992)) * **workflows:** add Janette identity and credential phases ([c59d94f](https://github.com/cameronraysmith/vanixiets/commit/c59d94fd263beaee9850390ce5db10ed7a57bb6f)) * **workflows:** add stand-up-gitea-mq durable execution workflow ([3f0f6d3](https://github.com/cameronraysmith/vanixiets/commit/3f0f6d3b041f44df62af2142587ae01d7ef9d92a)) * **workflows:** add the atomic derivation bump workflow ([31f8656](https://github.com/cameronraysmith/vanixiets/commit/31f86568dab026e45c847b4473ebb4a427e7c4b9)), closes [.#atomic](https://github.com/./issues/atomic) * **workflows:** apply terraform from an integrated source and adopt routed slices ([edda078](https://github.com/cameronraysmith/vanixiets/commit/edda0780388e50ace4fea73c694d25185799b38f)) * **workflows:** defer app installation and adopt an already-routed S1 ([15f2280](https://github.com/cameronraysmith/vanixiets/commit/15f22804edf5b9fa45d7b657a5712889a55b790a)) * **workflows:** generalize derivation bump workflow ([00fbc80](https://github.com/cameronraysmith/vanixiets/commit/00fbc8095fed2ca18b1018f262680cc2031f42c5)) * **workflows:** let stand-up-gitea-mq adopt an S1 implementation already in the working copy ([79193d4](https://github.com/cameronraysmith/vanixiets/commit/79193d4233531bed649cc805e2498e1948e661c7)) ### Performance Improvements * **checks:** assert omnigent capability rejections with one composite home ([6b723a1](https://github.com/cameronraysmith/vanixiets/commit/6b723a17427265662b802f7f591f41a8c5f7ffff)) * **checks:** assert omnigent fleet obligations on the machine checks ([501ec37](https://github.com/cameronraysmith/vanixiets/commit/501ec37517a80ce7d06a2b8577aadf312c74620f)) * **cognee:** switch chat model to gpt-5-nano to cut LLM completion cost ([fe80d31](https://github.com/cameronraysmith/vanixiets/commit/fe80d315b714649c8fc2fb457ffcef2b8f1da320)) * **devshells:** only compose agent context when AGENTS.md is absent ([a728ccc](https://github.com/cameronraysmith/vanixiets/commit/a728ccc43b0c2b9f80640fec5ab7d2260d369256)) * **docs:** consume vanixiets-docs-deps and narrow its workspace cache entry ([01c1b57](https://github.com/cameronraysmith/vanixiets/commit/01c1b57c56eda1a8cfc5fe6a34eea193dd677a05)) * **magnetite:** raise nix daemon cache-fetch concurrency ([023c5a5](https://github.com/cameronraysmith/vanixiets/commit/023c5a5253d05388d6c504037a7af780ccaf6112)) * **nixbot:** raise eval workers to 6 to shorten the serial eval chain ([45b05a5](https://github.com/cameronraysmith/vanixiets/commit/45b05a549393765caa68ac86a14809dcd41e0958)) * **nixbot:** run 8 eval workers at 4096 MiB under a 12 GiB MemoryHigh ([e2b51e9](https://github.com/cameronraysmith/vanixiets/commit/e2b51e9d121524d30580e599d0ef168d6620f4b2)) * **pyrite:** declare nix job concurrency against its actual hardware ([e047814](https://github.com/cameronraysmith/vanixiets/commit/e04781434e81fd9c10030d202320c0fd71940b4b)) ### Reverts * Revert "chore(caches): disable cachix" ([94a1489](https://github.com/cameronraysmith/vanixiets/commit/94a14892446ee366694c6ef42a13caf92eb33829)) ### BREAKING CHANGES * pkgs.dbt-fusion no longer provides dbt-lsp; use `dbtf lsp`. Nothing in this repository referenced dbt-lsp. Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a6964 RELEASE-PLAN: evidence-worker 0.6.3 -> 1.0.0