dotfiles

Public-safe workstation config, setup notes, agent workflow rules, and small helper tools.

This repo is focused on being a clean, agent-runnable dotfiles workspace that can be inspected, dry-run, and gradually migrated without leaking private machine state.

• shell, editor, terminal, and AI tool config
• macOS, Linux, Raspberry Pi, and self-hosting notes
• Docker and Tailscale setup guidance
• small repo-local helper scripts
• autonomous cleanup state for repeatable agent loops

• public-safe by default
• dry-run before apply
• no silent overwrites
• no private credentials or generated auth state
• small, auditable changes

• docs/: architecture, bootstrap, security, and platform notes
• state/: current loop plan, state, decisions, and notes
• config/: canonical public-safe config sources
• stow/: GNU Stow packages for managed dotfiles
• packages/: Homebrew, npm, uv, mas, and VS Code extension inventories
• scripts/: repo helper scripts such as link.sh and doctor.sh
• macos/, linux/, raspberry-pi/: platform-specific setup and service notes
• services/: self-hosting and service glue
• tools/: personal tools and incubating CLIs
• ai/: AI-specific rules, prompts, and examples

• SPEC.md
• AGENTS.md
• docs/architecture.md
• docs/bootstrap.md
• docs/security.md
• state/plan.md
• state/state.md

./scripts/doctor.sh --status
./scripts/link.sh --dry-run
./tools/bin/git-repo-radar [ROOT ...]

doctor.sh is read-only. link.sh defaults to dry-run and refuses to overwrite regular files or directories. git-repo-radar is a safe local repository status radar: it fetches with prompts disabled, prints git status -sb-based attention summaries, and never pulls/merges/rebases automatically.

The root cleanup structure is in place. Remaining warnings are mostly migration-related: canonical config/ and stow/ layouts are not fully seeded yet, and local home-directory config files intentionally block unsafe relinking until that migration is ready.