docs: update AGENTS.md for m3ta-home integration, work identity, new structure

feat: complete host home.nix files + add m3-daedalus, clean up m3tam3re.nix
- hosts/m3-kratos/home.nix: XDG/MIME defaults + dual DP Hyprland monitors - hosts/m3-ares/home.nix: XDG/MIME defaults + eDP+HDMI Hyprland monitors - hosts/m3-daedalus/home.nix: XDG/MIME defaults (no Hyprland) - hosts/common/users/m3tam3re.nix: refactored hostFlags into let binding, added m3-daedalus profile (desktop/coding+media, no gaming/Hyprland)
2026-05-02 10:54:42 +02:00 · 2026-05-02 10:41:12 +02:00 · 2026-05-02 10:08:50 +02:00 · 2026-05-02 09:53:27 +02:00 · 2026-05-01 16:15:13 +02:00 · 2026-05-01 16:06:49 +02:00
181 changed files with 5592 additions and 2274 deletions
--- a/.beads/.gitignore
+++ b/.beads/.gitignore
@@ -1,39 +1,73 @@
-# SQLite databases
-*.db
-*.db?*
-*.db-journal
-*.db-wal
-*.db-shm
+# Dolt database (managed by Dolt, not git)
+dolt/
+embeddeddolt/

-# Daemon runtime files
-daemon.lock
-daemon.log
-daemon.pid
+# Runtime files
 bd.sock
+bd.sock.startlock
 sync-state.json
 last-touched
+.exclusive-lock
+
+# Daemon runtime (lock, log, pid)
+daemon.*
+
+# Interactions log (runtime, not versioned)
+interactions.jsonl
+
+# Push state (runtime, per-machine)
+push-state.json
+
+# Lock files (various runtime locks)
+*.lock
+
+# Credential key (encryption key for federation peer auth — never commit)
+.beads-credential-key

 # Local version tracking (prevents upgrade notification spam after git ops)
 .local_version

-# Legacy database files
-db.sqlite
-bd.db
-
 # Worktree redirect file (contains relative path to main repo's .beads/)
 # Must not be committed as paths would be wrong in other clones
 redirect

-# Merge artifacts (temporary files from 3-way merge)
-beads.base.jsonl
-beads.base.meta.json
-beads.left.jsonl
-beads.left.meta.json
-beads.right.jsonl
-beads.right.meta.json
+# Sync state (local-only, per-machine)
+# These files are machine-specific and should not be shared across clones
+.sync.lock
+export-state/
+export-state.json

-# NOTE: Do NOT add negation patterns (e.g., !issues.jsonl) here.
-# They would override fork protection in .git/info/exclude, allowing
-# contributors to accidentally commit upstream issue databases.
-# The JSONL files (issues.jsonl, interactions.jsonl) and config files
-# are tracked by git by default since no pattern above ignores them.
+# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
+ephemeral.sqlite3
+ephemeral.sqlite3-journal
+ephemeral.sqlite3-wal
+ephemeral.sqlite3-shm
+
+# Dolt server management (auto-started by bd)
+dolt-server.pid
+dolt-server.log
+dolt-server.lock
+dolt-server.port
+dolt-server.activity
+
+# Corrupt backup directories (created by bd doctor --fix recovery)
+*.corrupt.backup/
+
+# Backup data (auto-exported JSONL, local-only)
+backup/
+
+# Per-project environment file (Dolt connection config, GH#2520)
+.env
+
+# Legacy files (from pre-Dolt versions)
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+db.sqlite
+bd.db
+# NOTE: Do NOT add negation patterns here.
+# They would override fork protection in .git/info/exclude.
+# Config files (metadata.json, config.yaml) are tracked by git by default
+# since no pattern above ignores them.
--- a/.beads/.sync.lock
+++ b/.beads/.sync.lock
--- a/.beads/README.md
+++ b/.beads/README.md
@@ -23,17 +23,17 @@ bd list
 bd show <issue-id>

 # Update issue status
-bd update <issue-id> --status in_progress
+bd update <issue-id> --claim
 bd update <issue-id> --status done

-# Sync with git remote
-bd sync
+# Sync with Dolt remote
+bd dolt push
 ```

 ### Working with Issues

 Issues in Beads are:
- **Git-native**: Stored in `.beads/issues.jsonl` and synced like code
+- **Git-native**: Stored in Dolt database with version control and branching
 - **AI-friendly**: CLI-first design works perfectly with AI coding agents
 - **Branch-aware**: Issues can follow your branch workflow
 - **Always in sync**: Auto-syncs with your commits
@@ -53,7 +53,7 @@ Issues in Beads are:
 🔧 **Git Integration**
 - Automatic sync with git commits
 - Branch-aware issue tracking
- Intelligent JSONL merge resolution
+- Dolt-native three-way merge resolution

 ## Get Started with Beads

--- a/.beads/config.yaml
+++ b/.beads/config.yaml
@@ -0,0 +1,56 @@
+# Beads Configuration File
+# This file configures default behavior for all bd commands in this repository
+# All settings can also be set via environment variables (BD_* prefix)
+# or overridden with command-line flags
+
+# Issue prefix for this repository (used by bd init)
+# If not set, bd init will auto-detect from directory name
+# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
+# issue-prefix: ""
+
+# Use no-db mode: JSONL-only, no Dolt database
+# When true, bd will use .beads/issues.jsonl as the source of truth
+# no-db: false
+
+# Enable JSON output by default
+# json: false
+
+# Feedback title formatting for mutating commands (create/update/close/dep/edit)
+# 0 = hide titles, N > 0 = truncate to N characters
+# output:
+#   title-length: 255
+
+# Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
+# actor: ""
+
+# Export events (audit trail) to .beads/events.jsonl on each flush/sync
+# When enabled, new events are appended incrementally using a high-water mark.
+# Use 'bd export --events' to trigger manually regardless of this setting.
+# events-export: false
+
+# Multi-repo configuration (experimental - bd-307)
+# Allows hydrating from multiple repositories and routing writes to the correct database
+# repos:
+#   primary: "."  # Primary repo (where this database lives)
+#   additional:   # Additional repos to hydrate from (read-only)
+#     - ~/beads-planning  # Personal planning repo
+#     - ~/work-planning   # Work planning repo
+
+# JSONL backup (periodic export for off-machine recovery)
+# Auto-enabled when a git remote exists. Override explicitly:
+# backup:
+#   enabled: false     # Disable auto-backup entirely
+#   interval: 15m      # Minimum time between auto-exports
+#   git-push: false    # Disable git push (export locally only)
+#   git-repo: ""       # Separate git repo for backups (default: project repo)
+
+# Integration settings (access with 'bd config get/set')
+# These are stored in the database, not in this file:
+# - jira.url
+# - jira.project
+# - linear.url
+# - linear.api-key
+# - github.org
+# - github.repo
+
+sync.remote: "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixos-config.git"
--- a/.beads/hooks/post-checkout
+++ b/.beads/hooks/post-checkout
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run post-checkout "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'post-checkout' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run post-checkout "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'post-checkout'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.2 ---
--- a/.beads/hooks/post-merge
+++ b/.beads/hooks/post-merge
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run post-merge "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'post-merge' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run post-merge "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'post-merge'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.2 ---
--- a/.beads/hooks/pre-commit
+++ b/.beads/hooks/pre-commit
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run pre-commit "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'pre-commit' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run pre-commit "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'pre-commit'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.2 ---
--- a/.beads/hooks/pre-push
+++ b/.beads/hooks/pre-push
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run pre-push "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'pre-push' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run pre-push "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'pre-push'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.2 ---
--- a/.beads/hooks/prepare-commit-msg
+++ b/.beads/hooks/prepare-commit-msg
@@ -0,0 +1,24 @@
+#!/usr/bin/env sh
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
+# This section is managed by beads. Do not remove these markers.
+if command -v bd >/dev/null 2>&1; then
+  export BD_GIT_HOOK=1
+  _bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$_bd_timeout" bd hooks run prepare-commit-msg "$@"
+    _bd_exit=$?
+    if [ $_bd_exit -eq 124 ]; then
+      echo >&2 "beads: hook 'prepare-commit-msg' timed out after ${_bd_timeout}s — continuing without beads"
+      _bd_exit=0
+    fi
+  else
+    bd hooks run prepare-commit-msg "$@"
+    _bd_exit=$?
+  fi
+  if [ $_bd_exit -eq 3 ]; then
+    echo >&2 "beads: database not initialized — skipping hook 'prepare-commit-msg'"
+    _bd_exit=0
+  fi
+  if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
+fi
+# --- END BEADS INTEGRATION v1.0.2 ---
--- a/.beads/interactions.jsonl
+++ b/.beads/interactions.jsonl
--- a/.beads/issues.jsonl
+++ b/.beads/issues.jsonl
@@ -1,2 +1,3 @@
-{"id":"nixos-config-gx2","title":"form","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-01-11T11:49:21.688289476+01:00","created_by":"m3tam3re","updated_at":"2026-01-11T11:51:36.426124223+01:00","deleted_at":"2026-01-11T11:51:36.426124223+01:00","deleted_by":"daemon","delete_reason":"delete","original_type":"task"}
-{"id":"nixos-config-n4l","title":"Create Gitea action for nix-update package updates","description":"Create a Gitea action to automatically update packages in this nixos-config repository using nix-update.\n\n**Context:**\n- Gitea instance is already running on m3-atlas at code.m3ta.dev (configured in hosts/m3-atlas/services/gitea.nix)\n- The repository is self-hosted on this Gitea instance\n- nix-update is already referenced in home/features/cli/default.nix\n- Currently no Gitea workflows exist (.gitea/ directory does not exist)\n\n**Goal:**\nAutomate package updates by creating a Gitea Actions workflow that:\n1. Runs nix-update periodically (e.g., weekly or on schedule)\n2. Updates package definitions in pkgs/ directory\n3. Creates pull requests with the updates\n4. Uses appropriate secrets/credentials for the Gitea instance\n\n**Requirements:**\n- Create .gitea/workflows/ directory structure\n- Define workflow file with nix-update command\n- Configure triggers (schedule, manual, or on repository events)\n- Set up proper permissions and secrets\n- Test the workflow execution\n\n**Current Repository State:**\n- pkgs/default.nix exists but is minimal (currently just a comment)\n- Multiple nixpkgs inputs are used (unstable, 25.11, locked, master)\n- Custom m3ta-nixpkgs overlay at code.m3ta.dev/m3tam3re/nixpkgs\n- Uses agenix for secrets management\n\n**Related Files:**\n- hosts/m3-atlas/services/gitea.nix (existing Gitea configuration)\n- hosts/common/ports.nix (port management)\n- home/features/cli/default.nix (nix-update reference)\n\n**Acceptance Criteria:**\n- [ ] Create .gitea/workflows directory\n- [ ] Implement nix-update workflow YAML\n- [ ] Configure appropriate triggers\n- [ ] Test workflow on the repository\n- [ ] Document setup and configuration","status":"closed","priority":2,"issue_type":"feature","owner":"p@m3ta.dev","created_at":"2026-01-13T20:39:49.838916335+01:00","created_by":"m3tm3re","updated_at":"2026-01-13T20:51:43.833041989+01:00","closed_at":"2026-01-13T20:51:43.833041989+01:00","close_reason":"Closed"}
+{"id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
--- a/.beads/metadata.json
+++ b/.beads/metadata.json
@@ -1,4 +1,7 @@
 {
-  "database": "beads.db",
-  "jsonl_export": "issues.jsonl"
+  "database": "dolt",
+  "backend": "dolt",
+  "dolt_mode": "embedded",
+  "dolt_database": "home_profile_restructuring",
+  "project_id": "664fc7e3-94eb-4874-aab6-e47835abe9d8"
 }
--- a/.beads/sync_base.jsonl
+++ b/.beads/sync_base.jsonl
@@ -1,2 +0,0 @@
-{"id":"nixos-config-gx2","title":"form","status":"tombstone","priority":2,"issue_type":"task","created_at":"2026-01-11T11:49:21.688289476+01:00","created_by":"m3tam3re","updated_at":"2026-01-11T11:51:36.426124223+01:00","deleted_at":"2026-01-11T11:51:36.426124223+01:00","deleted_by":"daemon","delete_reason":"delete","original_type":"task"}
-{"id":"nixos-config-n4l","title":"Create Gitea action for nix-update package updates","description":"Create a Gitea action to automatically update packages in this nixos-config repository using nix-update.\n\n**Context:**\n- Gitea instance is already running on m3-atlas at code.m3ta.dev (configured in hosts/m3-atlas/services/gitea.nix)\n- The repository is self-hosted on this Gitea instance\n- nix-update is already referenced in home/features/cli/default.nix\n- Currently no Gitea workflows exist (.gitea/ directory does not exist)\n\n**Goal:**\nAutomate package updates by creating a Gitea Actions workflow that:\n1. Runs nix-update periodically (e.g., weekly or on schedule)\n2. Updates package definitions in pkgs/ directory\n3. Creates pull requests with the updates\n4. Uses appropriate secrets/credentials for the Gitea instance\n\n**Requirements:**\n- Create .gitea/workflows/ directory structure\n- Define workflow file with nix-update command\n- Configure triggers (schedule, manual, or on repository events)\n- Set up proper permissions and secrets\n- Test the workflow execution\n\n**Current Repository State:**\n- pkgs/default.nix exists but is minimal (currently just a comment)\n- Multiple nixpkgs inputs are used (unstable, 25.11, locked, master)\n- Custom m3ta-nixpkgs overlay at code.m3ta.dev/m3tam3re/nixpkgs\n- Uses agenix for secrets management\n\n**Related Files:**\n- hosts/m3-atlas/services/gitea.nix (existing Gitea configuration)\n- hosts/common/ports.nix (port management)\n- home/features/cli/default.nix (nix-update reference)\n\n**Acceptance Criteria:**\n- [ ] Create .gitea/workflows directory\n- [ ] Implement nix-update workflow YAML\n- [ ] Configure appropriate triggers\n- [ ] Test workflow on the repository\n- [ ] Document setup and configuration","status":"closed","priority":2,"issue_type":"feature","owner":"p@m3ta.dev","created_at":"2026-01-13T20:39:49.838916335+01:00","created_by":"m3tm3re","updated_at":"2026-01-13T20:51:43.833041989+01:00","closed_at":"2026-01-13T20:51:43.833041989+01:00","close_reason":"Closed"}
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,23 @@ Thumbs.db
 # Opencode rules
 .opencode-rules
 opencode.json
+
+# AI agent state
+.sidecar/
+.sidecar-*
+.sisyphus/
+.sidecar-agent
+.sidecar-task
+.sidecar-pr
+.sidecar-start.sh
+.sidecar-base
+.td-root
+.cache
+.pi*
+.worktrees/
+docs/plans/
+
+# Beads / Dolt files (added by bd init)
+.dolt/
+*.db
+.beads-credential-key
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,157 +1,445 @@
-# NIXOS CONFIGURATION KNOWLEDGE BASE
+# Agent Instructions

-**Generated:** 2025-12-31 16:13:40 UTC  
-**Commit:** ebc8291  
-**Branch:** HEAD
+This project uses **bd** (beads) for issue tracking. Run `bd prime` for full workflow context.

-## OVERVIEW
-Personal NixOS configuration managing 6 hosts (4 servers, 2 desktops) using flakes, agenix secrets, and feature-based home-manager setup.
+## Quick Reference

-## STRUCTURE
-```
-./
-├── flake.nix              # Main entry: host definitions, inputs, outputs
-├── secrets.nix            # Agenix public key mappings
-├── hosts/
-│   ├── common/            # Shared: base config, users, extraServices, ports
-│   ├── m3-atlas/          # Server: 20+ containerized services with Traefik
-│   ├── m3-helios/         # Server: AdGuard, internal routing
-│   ├── m3-ares/           # Desktop: NVIDIA GPU, Btrfs
-│   ├── m3-kratos/         # Desktop: AMD GPU, ZFS
-│   └── m3-aether/         # Cloud VM
-├── home/
-│   ├── common/            # Home-manager base config
-│   ├── features/          # Modular feature toggles (cli, desktop, coding)
-│   └── m3tam3re/          # Per-host user configs
-├── modules/               # Custom NixOS/home-manager modules
-├── overlays/              # Package overlays (stable, locked, pinned, master)
-├── pkgs/                  # Custom package definitions
-└── secrets/               # Agenix encrypted .age files (19 secrets)
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add new host | `flake.nix` + `hosts/<name>/` | Copy template from m3-atlas (server) or m3-ares (desktop) |
-| Add service to m3-atlas | `hosts/m3-atlas/services/` | See containers/ for Podman + Traefik pattern |
-| Configure desktop features | `home/features/desktop/` | Feature toggles with mkEnableOption |
-| Add CLI tool | `home/features/cli/` | Fish + Nushell integration expected |
-| Manage secrets | `secrets.nix` + `agenix -e` | SSH keys defined in secrets.nix |
-| Define ports | `hosts/common/ports.nix` | Centralized port registry |
-| Add user | `hosts/common/users/` | Shared across all hosts |
-| Custom packages | `pkgs/default.nix` | Exposed via flake outputs |
-
-## CONVENTIONS
-
-### Secrets (agenix)
- **Create**: `agenix -e secrets/<name>.age` after adding keys to `secrets.nix`
- **Reference**: `config.age.secrets.<name>.path` in service configs
- **Pattern**: Service env files use `environmentFiles = [config.age.secrets.<service>-env.path]`
-
-### Service Organization
- **Native services**: `hosts/<host>/services/<service>.nix`
- **Containers**: `hosts/<host>/services/containers/<service>.nix`
- **Traefik integration**: All m3-atlas services include dynamic config for SSL + routing
- **Networking**: Containers use dedicated `web` network (10.89.0.0/24) with static IPs
-
-### Port Management
- **Registry**: All ports defined in `hosts/common/ports.nix`
- **Access**: `config.m3ta.ports.get "service-name"`
- **Convention**: Internal services use 3000-3020 range
-
-### Home-Manager Features
- **Enable**: `features.<category>.<feature>.enable = true` in user config
- **Categories**: `cli`, `desktop`, `coding`
- **Pattern**: Features are opt-in modules with default.nix aggregators
-
-### Multiple nixpkgs Inputs
- **stable**: 25.11 release
- **locked/pinned**: Specific commits for compatibility
- **master**: Bleeding edge
- **m3ta-nixpkgs**: Custom local overlay at `path:/home/m3tam3re/p/nix/nixpkgs`
-
-## COMMANDS
 ```bash
-# Build/deploy specific host
-sudo nixos-rebuild switch --flake .#m3-ares
-
-# Build/deploy current host
-sudo nixos-rebuild switch --flake .#$(uname -n)
-
-# Home-manager update
-home-manager --flake . switch
-
-# Update all flake inputs
-nix flake update
-
-# Add/edit secret
-agenix -e secrets/<name>.age
-
-# Infrastructure shell (OpenTofu)
-nix develop .#infraShell
-
-# Check configuration (no activation)
-nixos-rebuild dry-build --flake .#<hostname>
+bd ready              # Find available work
+bd show <id>          # View issue details
+bd update <id> --claim  # Claim work atomically
+bd close <id>         # Complete work
+bd dolt push          # Push beads data to remote
 ```

-## TRAEFIK PATTERNS (m3-atlas only)
+## Non-Interactive Shell Commands

-### SSL Termination
- **Provider**: Godaddy DNS challenge
- **Cert storage**: `/var/lib/traefik/acme.json`
- **Config**: `hosts/m3-atlas/services/traefik.nix`
+**ALWAYS use non-interactive flags** with file operations to avoid hanging on confirmation prompts.
+
+Shell commands like `cp`, `mv`, and `rm` may be aliased to include `-i` (interactive) mode on some systems, causing the agent to hang indefinitely waiting for y/n input.
+
+**Use these forms instead:**
+
+```bash
+# Force overwrite without prompting
+cp -f source dest           # NOT: cp source dest
+mv -f source dest           # NOT: mv source dest
+rm -f file                  # NOT: rm file
+
+# For recursive operations
+rm -rf directory            # NOT: rm -r directory
+cp -rf source dest          # NOT: cp -r source dest
+```
+
+**Other commands that may prompt:**
+
+- `scp` - use `-o BatchMode=yes` for non-interactive
+- `ssh` - use `-o BatchMode=yes` to fail instead of prompting
+- `apt-get` - use `-y` flag
+- `brew` - use `HOMEBREW_NO_AUTO_UPDATE=1` env var
+
+<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
+
+## Beads Issue Tracker
+
+This project uses **bd (beads)** for persistent task tracking. Run `bd prime` for full workflow context.
+
+### Why Beads?
+
+- **Prefer Beads over ad-hoc markdown TODO lists** — Beads provides structured, queryable, shareable issue tracking with dependency management
+- **Never use `bd edit`** — it opens an interactive editor which blocks agent workflows
+- **Use flags and stdin instead** — `bd update <id> --claim`, `bd create --title "..." --estimate 2`
+
+### Slash Commands (Agent Workflow)
+
+| Command | Purpose |
+|---------|---------|
+| `/beads:ready` | Find unblocked issues |
+| `/beads:create` | Create a new issue |
+| `/beads:update` | Update an issue (claim, status) |
+| `/beads:close` | Close completed work |
+| `/beads:stats` | Project-level snapshot |
+
+### Core Workflow (6 Steps)
+
+#### 1. Find Unblocked Work
+```bash
+bd ready --json
+```
+Lists issues with no blocking dependencies that are ready to work on.
+
+#### 2. Claim Work
+```bash
+bd update <id> --claim
+```
+Atomically assigns the issue to you (sets status to "in-progress").
+
+#### 3. Inspect Details
+```bash
+bd show <id>
+```
+View full issue details including:
+- Description and acceptance criteria
+- Blocking/blocked-by dependencies
+- Time estimates
+- Status history
+
+#### 4. Create Newly Discovered Work
+```bash
+# Create a new issue
+bd create \
+  --title "Fix audio on m3-helios" \
+  --estimate 2 \
+  --priority high \
+  --labels nixos,audio
+
+# Link dependencies
+bd dep <id> --blocks <blocked-id>      # This issue blocks another
+bd dep <id> --after <after-id>         # This issue after another completes
+bd dep <id> --requires <requires-id>  # This issue requires another
+```
+
+#### 5. Complete Work
+```bash
+bd close <id> --reason "Added PulseAudio fallback to configuration.nix"
+```
+Provide a concise summary of what was done. The `--reason` is mandatory.
+
+#### 6. Project Snapshot
+```bash
+bd status --json    # Current state of all issues
+bd stats            # Metrics: velocity, cycle time, bottlenecks
+```
+
+### Example Complete Workflow
+
+```bash
+# Start session - find work
+bd ready --json
+
+# Claim available issue
+bd update 42 --claim
+
+# Do the work...
+
+# Discover something else needed
+bd create --title "Document hermes-agent setup" --estimate 1
+# Link as related
+bd dep 43 --after 42
+
+# Complete original
+bd close 42 --reason "Added Hyprland idle timeout config"
+
+# Close related
+bd close 43 --reason "Added setup docs to AGENTS.md"
+
+# Push state to remote
+bd dolt push
+```
+
+### Rules
+
+- Use `bd` for ALL task tracking — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
+- Run `bd prime` for detailed command reference and session close protocol
+- Use `bd remember` for persistent knowledge — do NOT use MEMORY.md files
+
+## Session Completion
+
+**When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
+
+**MANDATORY WORKFLOW:**
+
+1. **File issues for remaining work** - Create issues for anything that needs follow-up
+2. **Run quality gates** (if code changed) - Tests, linters, builds
+3. **Update issue status** - Close finished work, update in-progress items
+4. **PUSH TO REMOTE** - This is MANDATORY:
+   ```bash
+   git pull --rebase
+   bd dolt push
+   git push
+   git status  # MUST show "up to date with origin"
+   ```
+5. **Clean up** - Clear stashes, prune remote branches
+6. **Verify** - All changes committed AND pushed
+7. **Hand off** - Provide context for next session
+
+**CRITICAL RULES:**
+
+- Work is NOT complete until `git push` succeeds
+- NEVER stop before pushing - that leaves work stranded locally
+- NEVER say "ready to push when you are" - YOU must push
+- If push fails, resolve and retry until it succeeds
+<!-- END BEADS INTEGRATION -->
+
+# Project Agent
+
+**Workspace Path:** `/home/m3tam3re/p/NIX/nixos-config`
+_(Note to Pi: Your file write/edit tools run in a different directory by default. You MUST use absolute paths starting with the Workspace Path above for ALL file operations!)_
+
+**Generated:** 2026-04-26
+
+---
+
+## Stack
+
+| Component        | Version/Source                    |
+| ---------------- | --------------------------------- |
+| **Nixpkgs**      | nixos-unstable + 25.05 stable     |
+| **Home Manager** | github:nix-community/home-manager |
+| **m3ta-home**    | code.m3ta.dev/m3tam3re/m3ta-home  |
+| **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs    |
+| **Agenix**       | github:ryantm/agenix              |
+| **Disko**        | github:nix-community/disko        |
+| **NUR**          | github:nix-community/NUR          |
+| **Formatter**    | alejandra                         |
+| **Linters**      | statix, deadnix                   |
+| **IDE**          | nixd                              |
+| **Hermes Agent** | NousResearch/hermes-agent         |
+| **LLM Agents**   | numtide/llm-agents.nix            |
+
+---
+
+## Structure
+
+```
+nixos-config/
+├── flake.nix                    # Entry point: hosts, overlays, dev shells, m3ta-home input
+├── coding-rules.json            # Opencode rules configuration
+│
+├── hosts/                        # Per-host NixOS configurations
+│   ├── common/                   # Shared across all hosts
+│   │   ├── users/
+│   │   │   └── m3tam3re.nix     # ← Central user + m3ta-home integration
+│   │   ├── default.nix          # Shared NixOS settings, overlays, home-manager setup
+│   │   ├── ports.nix            # Network ports config
+│   │   └── extraServices/       # Common service toggles
+│   ├── m3-ares/                  # TUXEDO laptop (desktop)
+│   │   └── home.nix             # Hyprland: eDP-1 + HDMI, XDG/MIME
+│   ├── m3-kratos/                # AMD desktop (desktop)
+│   │   └── home.nix             # Hyprland: dual DP, XDG/MIME
+│   ├── m3-daedalus/              # Portable laptop (desktop, no Hyprland)
+│   │   └── home.nix             # XDG/MIME only
+│   ├── m3-atlas/                 # Primary server (server + coding)
+│   ├── m3-helios/                # AdGuard DNS server (minimal server)
+│   ├── m3-hermes/                # Secondary server (minimal server)
+│   └── m3-aether/                # Cloud VM (minimal server)
+│
+├── modules/                      # Reusable NixOS modules
+│   └── nixos/                    # NixOS-specific modules
+│
+├── overlays/                    # Package overlays (stable/locked/master/pinned)
+│   ├── default.nix
+│   └── mods/
+│
+├── pkgs/                        # Custom packages
+│
+├── secrets/                     # Encrypted secrets (agenix)
+│   └── secrets.nix
+│
+├── .opencode-rules/             # Opencode AI rules
+│   ├── concerns/
+│   ├── languages/nix.md
+│   └── USAGE.md
+│
+└── .pi/                         # Agent configuration
+```
+
+### Home-Manager Integration
+
+Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
+- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
+- **Docs**: See m3ta-home README for full documentation
+
+What lives where:
+
+| Concern | Location | Why |
+|---------|----------|-----|
+| Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
+| User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
+| Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
+| Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
+| XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
+| NixOS overlays | `nixos-config/overlays/` | System-level package management |
+
+#### Host → Profile Mapping
+
+Defined in `hosts/common/users/m3tam3re.nix`:

-### Service Integration Template
 ```nix
-services.traefik.dynamicConfigOptions.http = {
-  services.<name>.loadBalancer.servers = [{ url = "http://127.0.0.1:<port>"; }];
-  routers.<name> = {
-    rule = "Host(`<subdomain>.m3ta.dev`)";
-    service = "<name>";
-    tls.certResolver = "godaddy";
-  };
+hostProfiles = {
+  # Desktop hosts
+  m3-ares     = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-kratos   = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
+  m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
+  # Server hosts
+  m3-atlas    = { context = "server";  sets = ["coding"]; };
+  m3-helios   = { context = "server";  sets = []; };
+  m3-hermes   = { context = "server";  sets = []; };
+  m3-aether   = { context = "server";  sets = []; };
 };
 ```

-### Container Pattern
- **Network**: `--network=web --ip=10.89.0.<sequential>`
- **Ports**: Bind localhost only (`127.0.0.1:<external>:<internal>`)
- **Database access**: `--add-host=mysql:10.89.0.1` (gateway IP)
+#### Work Identity Use Case

-## HOST ROLES
+The same `m3ta-home` repo supports a **work identity** for company machines:

-| Host | Type | Hardware | Purpose |
-|------|------|----------|---------|
-| m3-atlas | Server | x86_64, disko | 20+ services, Traefik hub, PostgreSQL, MySQL |
-| m3-helios | Server | x86_64, disko | AdGuard DNS, internal routing |
-| m3-ares | Desktop | NVIDIA, Btrfs | Personal workstation, n8n, PostgreSQL |
-| m3-kratos | Desktop | AMD, ZFS | Workstation, mem0, PostgreSQL |
-| m3-aether | Cloud | QEMU | General purpose VM |
-| m3-daedalus | Laptop | home-only | Portable (no full NixOS config) |
+```nix
+# On a work NixOS machine:
+(m3ta-lib.mkHome {
+  user = "m3tam3re";
+  identity = "work";       # ← switches git to sascha.koenig, SSH to AZ hosts
+  context = "desktop";
+  sets = ["coding"];
+})
+```

-## ANTI-PATTERNS (THIS PROJECT)
+This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.

- **DON'T** add secrets to `secrets/` without updating `secrets.nix` public keys
- **DON'T** hardcode ports - use `config.m3ta.ports.get` or add to registry
- **DON'T** create containers outside the `web` network on m3-atlas
- **DON'T** skip Traefik config for public-facing services on m3-atlas
- **DON'T** bypass extraServices flags - use `hosts/common/extraServices/` pattern
- **DON'T** commit unencrypted secrets or test with real credentials
+---

-## UNIQUE TO THIS CONFIG
+## Commands

- **Custom m3ta-nixpkgs**: Local overlay for unreleased/patched packages
- **extraServices abstraction**: Boolean flags to toggle Podman, Ollama, virtualisation per host
- **Mythological naming**: All hosts named after Greek mythology
- **Dual domain strategy**: New services on `m3ta.dev`, legacy redirects from `m3tam3re.com`
- **Per-host nixpkgs versions**: Different hosts can use different nixpkgs commits via specialArgs
- **Container IP registry**: Static IP assignments in 10.89.0.0/24 subnet for predictable networking
+| Action               | Command                                                                | Notes                                             |
+| -------------------- | ---------------------------------------------------------------------- | ------------------------------------------------- |
+| **Enter dev shell**  | `nix develop`                                                          | Includes alejandra, nixd, agenix, statix, deadnix |
+| **Build host**       | `sudo nixos-rebuild switch --flake .#m3-ares`                          | Replace hostname as needed                        |
+| **Dry run build**    | `sudo nixos-rebuild dry-run --flake .#m3-ares`                         | Validate without applying                         |
+| **List hosts**       | `nix flake show`                                                       | Shows all NixOS configurations                    |
+| **Update flake**     | `sudo nixos-rebuild switch --flake .#m3-ares --update-input nixpkgs`   | Update specific input                             |
+| **Format code**      | `alejandra .`                                                          | Run before committing                             |
+| **Check lint**       | `statix check .`                                                       | Run statix for antipatterns                       |
+| **Remove dead code** | `deadnix -w .`                                                         | Clean up unused let bindings                      |
+| **Build ISO**        | `nix build .#nixosConfigurations.m3-ares.config.system.build.isoImage` | Generate install ISO                              |

-## NOTES
+---

- m3-atlas is the service hub - most complex configuration
- Secrets require host SSH keys defined in `secrets.nix` before `agenix -e` works
- Fish and Nushell both configured - choose per-user with shell aliases
- Color scheme (Dracula) applied via nix-colors across all visual tools
- See subdirectory AGENTS.md for deep dives on containers, desktop features, CLI tools
+## Conventions
+
+### Formatting & Style
+
+- **Formatter:** `alejandra` (mandatory, run before commits)
+- **Indentation:** 2 spaces (alejandra default)
+- **Variables:** camelCase (e.g., `maxRetryAttempts`)
+- **Types/Modules:** PascalCase (e.g., `MyService`)
+- **Constants:** UPPER_SNAKE_CASE (e.g., `MAX_RETRIES`)
+- **Files:** hyphen-case (e.g., `my-file.nix`)
+
+### Nix Module Patterns
+
+```nix
+{ config, lib, pkgs, ... }:
+{
+  options.myService.enable = lib.mkEnableOption "my service";
+  config = lib.mkIf config.myService.enable {
+    services.myService.enable = true;
+  };
+}
+```
+
+### Conditionals
+
+```nix
+config = lib.mkMerge [
+  (lib.mkIf cfg.enable { ... })
+  (lib.mkIf cfg.extraConfig { ... })
+];
+```
+
+### Anti-Patterns (AVOID)
+
+- **Never use `with pkgs;`** — always use explicit package references
+- **Never use `builtins.fetchTarball`** — use flake inputs instead
+- **Never use `import <nixpkgs>`** — always use inputs
+- **Never use `builtins.getAttr/hasAttr`** — use `lib.attrByPath` or `lib.optionalAttrs`
+- **Avoid anonymous functions in config** — extract to named lets
+
+### Imports
+
+- Use flake inputs for dependencies (e.g., `inputs.home-manager.nixosModules.home-manager`)
+- Import relative paths with `./` or `../`
+- Never use absolute paths in imports
+
+### Secrets
+
+- Secrets managed via **agenix** in `secrets/` directory
+- Never commit plaintext secrets
+- Use `.nix` extension for secret files
+
+### Flake Input URLs
+
+All `code.m3ta.dev` inputs use **SSH** URLs:
+```nix
+url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
+```
+Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
+
+---
+
+## Key Files
+
+| File                               | Purpose                                                                                    |
+| ---------------------------------- | ------------------------------------------------------------------------------------------ |
+| `flake.nix`                        | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
+| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`)         |
+| `hosts/common/users/m3tam3re.nix`  | User definition + m3ta-home mkHome integration + per-host feature flags                    |
+| `hosts/<name>/home.nix`            | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME                      |
+| `overlays/default.nix`             | Package version overrides (stable/locked/master branches)                                  |
+| `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns                                                      |
+
+---
+
+## What to Avoid
+
+1. **Don't modify `flake.lock`** directly — use `nix flake update`
+2. **Don't use impure operations** — this is a pure flake-based config
+3. **Don't commit without formatting** — always run `alejandra .` first
+4. **Don't add packages to hosts directly** — prefer adding to overlays or using NUR
+5. **Don't hardcode paths** — use `inputs` and relative imports
+6. **Don't create monolithic modules** — keep functions under 20 lines
+7. **Don't skip the dry-run** — always test with `--dry-run` before switching
+8. **Don't use lib.mkDefault lightly** — understand the precedence implications
+
+---
+
+## Notes
+
+### Adding a New Host
+
+1. Add entry to `flake.nix` → `nixosConfigurations`
+2. Create directory in `hosts/` with:
+   - `default.nix` — imports common + specific configs
+   - `configuration.nix` — host-specific system config
+   - `hardware-configuration.nix` — from `nixos-generate-config`
+   - `programs.nix`, `services/`, `secrets.nix` as needed
+3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
+4. Add feature flags in the `hostFlags` section
+5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
+6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
+
+### Adding a New Package
+
+1. For simple packages: add to appropriate overlay in `overlays/default.nix`
+2. For complex packages: create in `pkgs/` directory
+3. For upstream packages: use NUR or add as flake input
+
+### Adding a New Home-Manager Feature
+
+1. Create the module in `m3ta-home` under the appropriate profile directory
+2. Add the import to the parent `default.nix` in m3ta-home
+3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
+
+### Development Workflow
+
+1. Edit config files
+2. Run `alejandra .` to format
+3. Run `statix check .` for linting
+4. Run `sudo nixos-rebuild dry-run --flake .#m3-ares`
+5. If successful: `sudo nixos-rebuild switch --flake .#m3-ares`
+
+### Remote Building
+
+```bash
+# Build on remote machine
+nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
+ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
+```
--- a/coding-rules.json
+++ b/coding-rules.json
@@ -0,0 +1 @@
+{"$schema":"https://opencode.ai/config.json","instructions":[".opencode-rules/concerns/coding-style.md",".opencode-rules/concerns/naming.md",".opencode-rules/concerns/documentation.md",".opencode-rules/concerns/testing.md",".opencode-rules/concerns/git-workflow.md",".opencode-rules/concerns/project-structure.md",".opencode-rules/languages/nix.md"]}
--- a/flake.lock
+++ b/flake.lock
@@ -22,13 +22,31 @@
      }
    },
    "agents": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1777399938,
+        "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
+        "ref": "refs/heads/master",
+        "rev": "9a91f1ee0cf011a7eaf1f16a9e17610b0457e055",
+        "revCount": 85,
+        "type": "git",
+        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
+      }
+    },
+    "agents_2": {
      "flake": false,
      "locked": {
-        "lastModified": 1773479083,
-        "narHash": "sha256-qwope4VrtrMsebTjyqhiwO6NxZ4t8kk+65K8y41ada0=",
+        "lastModified": 1777399938,
+        "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
        "ref": "refs/heads/master",
-        "rev": "8bcb5e11fbfeb4c00b81358163162324d0893ff8",
-        "revCount": 64,
+        "rev": "9a91f1ee0cf011a7eaf1f16a9e17610b0457e055",
+        "revCount": 85,
        "type": "git",
        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
      },
@@ -53,6 +71,28 @@
        "type": "github"
      }
    },
+    "basecamp": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774505501,
+        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "owner": "basecamp",
+        "repo": "basecamp-cli",
+        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "basecamp",
+        "ref": "v0.7.2",
+        "repo": "basecamp-cli",
+        "type": "github"
+      }
+    },
    "blueprint": {
      "inputs": {
        "nixpkgs": [
@@ -65,11 +105,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1771437256,
-        "narHash": "sha256-bLqwib+rtyBRRVBWhMuBXPCL/OThfokA+j6+uH7jDGU=",
+        "lastModified": 1776249299,
+        "narHash": "sha256-Dt9t1TGRmJFc0xVYhttNBD6QsAgHOHCArqGa0AyjrJY=",
        "owner": "numtide",
        "repo": "blueprint",
-        "rev": "06ee7190dc2620ea98af9eb225aa9627b68b0e33",
+        "rev": "56131e8628f173d24a27f6d27c0215eff57e40dd",
        "type": "github"
      },
      "original": {
@@ -84,7 +124,6 @@
          "llm-agents",
          "flake-parts"
        ],
-        "import-tree": "import-tree",
        "nixpkgs": [
          "llm-agents",
          "nixpkgs"
@@ -99,15 +138,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1770895533,
-        "narHash": "sha256-v3QaK9ugy9bN9RXDnjw0i2OifKmz2NnKM82agtqm/UY=",
+        "lastModified": 1777369708,
+        "narHash": "sha256-1xW7cRZNsFNPQD+cE0fwnLVStnDth0HSoASEIFeT7uI=",
        "owner": "nix-community",
        "repo": "bun2nix",
-        "rev": "c843f477b15f51151f8c6bcc886954699440a6e1",
+        "rev": "e659e1cc4b8e1b21d0aa85f1c481f9db61ecfa98",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
+        "ref": "staging-2.1.0",
        "repo": "bun2nix",
        "type": "github"
      }
@@ -141,11 +181,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772867152,
-        "narHash": "sha256-RIFgZ4O6Eg+5ysZ8Tqb3YvcqiRaNy440GEY22ltjRrs=",
+        "lastModified": 1776613567,
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "eaafb89b56e948661d618eefd4757d9ea8d77514",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
        "type": "github"
      },
      "original": {
@@ -157,7 +197,7 @@
    "flake-parts": {
      "inputs": {
        "nixpkgs-lib": [
-          "llm-agents",
+          "hermes-agent",
          "nixpkgs"
        ]
      },
@@ -176,6 +216,27 @@
      }
    },
    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
      "inputs": {
        "nixpkgs-lib": [
          "nur",
@@ -214,6 +275,30 @@
        "type": "github"
      }
    },
+    "hermes-agent": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": "nixpkgs_3",
+        "npm-lockfile-fix": "npm-lockfile-fix",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix_2",
+        "uv2nix": "uv2nix_2"
+      },
+      "locked": {
+        "lastModified": 1777573861,
+        "narHash": "sha256-whY/1WL2fQUhPqDp7CGm3MSwOOo7FB1eADhNVnHeCRU=",
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "rev": "73bf3ab1b22314ed9dfecbb59242c03742fe72af",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NousResearch",
+        "ref": "v2026.4.30",
+        "repo": "hermes-agent",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -242,11 +327,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772845525,
-        "narHash": "sha256-Dp5Ir2u4jJDGCgeMRviHvEQDe+U37hMxp6RSNOoMMPc=",
+        "lastModified": 1777476904,
+        "narHash": "sha256-EeLoE8n4+QCbteyAsYXxhfr97RFfWL1ga0xwfL6lpKw=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "27b93804fbef1544cb07718d3f0a451f4c4cd6c0",
+        "rev": "8c8e5389e75a36bee53920de8ee24f017b3ae03e",
        "type": "github"
      },
      "original": {
@@ -302,14 +387,14 @@
      "inputs": {
        "flake-utils": "flake-utils",
        "home-manager": "home-manager_3",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1767767975,
-        "narHash": "sha256-yBejG3j6OLQYn87UozFAI3q9a1vH00u9xjIf2Q4V5j8=",
+        "lastModified": 1776923321,
+        "narHash": "sha256-QowlCOrE4jGOTDCUCEx/E8gHjqSx3r25y7v4dEBpBhk=",
        "owner": "Jas-SinghFSU",
        "repo": "HyprPanel",
-        "rev": "0e73df1dfedf0f6fa21ed0ae5e031b0663c8f400",
+        "rev": "1961ba86ad5ab880beb639e5454054b2b5037e0d",
        "type": "github"
      },
      "original": {
@@ -318,36 +403,21 @@
        "type": "github"
      }
    },
-    "import-tree": {
-      "locked": {
-        "lastModified": 1763762820,
-        "narHash": "sha256-ZvYKbFib3AEwiNMLsejb/CWs/OL/srFQ8AogkebEPF0=",
-        "owner": "vic",
-        "repo": "import-tree",
-        "rev": "3c23749d8013ec6daa1d7255057590e9ca726646",
-        "type": "github"
-      },
-      "original": {
-        "owner": "vic",
-        "repo": "import-tree",
-        "type": "github"
-      }
-    },
    "llm-agents": {
      "inputs": {
        "blueprint": "blueprint",
        "bun2nix": "bun2nix",
-        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_3",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_5",
        "systems": "systems_3",
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1773459162,
-        "narHash": "sha256-QdrMe4cftS8ALHB2+DTNOZIkw+rqddm5lcsAhm/voqk=",
+        "lastModified": 1777439951,
+        "narHash": "sha256-1Bs4ZbBayXWicrOrQQn3/BnnqhEy+tQjdFn40wHu1dw=",
        "owner": "numtide",
        "repo": "llm-agents.nix",
-        "rev": "64d8585ea7ba1a88b1afa82a89bdd10d4c894f45",
+        "rev": "2641c18f5bb9d0b95e81beca1b0415e174d7e650",
        "type": "github"
      },
      "original": {
@@ -358,17 +428,18 @@
    },
    "m3ta-nixpkgs": {
      "inputs": {
-        "nixpkgs": "nixpkgs_4",
+        "agents": "agents_2",
+        "basecamp": "basecamp",
+        "nixpkgs": "nixpkgs_6",
        "nixpkgs-master": "nixpkgs-master",
-        "opencode": "opencode",
        "openspec": "openspec"
      },
      "locked": {
-        "lastModified": 1772876766,
-        "narHash": "sha256-PiikuOqrjyzTAqUbnUwIKCr9+YvKX0xTRZ4q0srkQKU=",
+        "lastModified": 1777486032,
+        "narHash": "sha256-UStORUF67vzXQ1jtORzR2cTv8GCvrxweF7HFHJgPpqw=",
        "ref": "refs/heads/master",
-        "rev": "291e3a0744d4a0192654c8afdbe3d1636c9c0890",
-        "revCount": 156,
+        "rev": "1da8c96447eb74a316861f6242421ef0309c29a8",
+        "revCount": 267,
        "type": "git",
        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
      },
@@ -414,7 +485,7 @@
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
        "lastModified": 1769813415,
@@ -511,11 +582,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1772847790,
-        "narHash": "sha256-lEK3FqujT4UPgk31wI90scsZQK+I1GaLa61SOQ2Jirc=",
+        "lastModified": 1777470666,
+        "narHash": "sha256-uAi+pTjKLturTz3XqTwnsU0fJnqf8xx8orfPpRbdaKQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9724b991f92022aafa14b3610840f9742752227d",
+        "rev": "053b9fa5f0fbdac0bd9d248cea58a11223eb495d",
        "type": "github"
      },
      "original": {
@@ -527,11 +598,11 @@
    },
    "nixpkgs-master_2": {
      "locked": {
-        "lastModified": 1772874821,
-        "narHash": "sha256-ehnRKCc/qq0hjyi5aaE/H4RPUPfSDqjndWqAGZFesfY=",
+        "lastModified": 1777483759,
+        "narHash": "sha256-luE+pNcTx3gz109lEC/xUxPHrx1aEZsp5X4OEBcnGaw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "10e7894b40eb0ad14d3a3184d20cc1beace1414d",
+        "rev": "b540331d6f1e343b6812b5aa1d97c707a0de0da2",
        "type": "github"
      },
      "original": {
@@ -543,11 +614,11 @@
    },
    "nixpkgs-stable": {
      "locked": {
-        "lastModified": 1772598333,
-        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
+        "lastModified": 1777077449,
+        "narHash": "sha256-AIiMJiqvGrN4HyLEbKAoCSRRYn0rnlW5VbKNIMIYqm4=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
+        "rev": "a4bf06618f0b5ee50f14ed8f0da77d34ecc19160",
        "type": "github"
      },
      "original": {
@@ -558,6 +629,38 @@
      }
    },
    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1772479524,
+        "narHash": "sha256-u7nCaNiMjqvKpE+uZz9hE7pgXXTmm5yvdtFaqzSzUQI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4215e62dc2cd3bc705b0a423b9719ff6be378a43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1775036866,
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
      "locked": {
        "lastModified": 1750776420,
        "narHash": "sha256-/CG+w0o0oJ5itVklOoLbdn2dGB0wbZVOoDm4np6w09A=",
@@ -573,13 +676,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1773231277,
-        "narHash": "sha256-Xy3WEpUAbpsz8ydgvVAQAGGB/WB+8cNA5cshiL0McTI=",
+        "lastModified": 1776949667,
+        "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "75690239f08f885ca9b0267580101f60d10fbe62",
+        "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30",
        "type": "github"
      },
      "original": {
@@ -589,13 +692,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_4": {
+    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1772624091,
-        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
        "type": "github"
      },
      "original": {
@@ -605,7 +708,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_5": {
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1736657626,
        "narHash": "sha256-FWlPMUzp0lkQBdhKlPqtQdqmp+/C+1MBiEytaYfrCTY=",
@@ -621,13 +724,13 @@
        "type": "github"
      }
    },
-    "nixpkgs_6": {
+    "nixpkgs_8": {
      "locked": {
-        "lastModified": 1772624091,
-        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
        "type": "github"
      },
      "original": {
@@ -637,7 +740,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
+    "nixpkgs_9": {
      "locked": {
        "lastModified": 1710272261,
        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
@@ -653,19 +756,40 @@
        "type": "github"
      }
    },
+    "npm-lockfile-fix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "type": "github"
+      }
+    },
    "nur": {
      "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1772875192,
-        "narHash": "sha256-R706OBJ+nMQsVP2Dni+FaG3UDfhlE2zR4rz+YGnEi8I=",
+        "lastModified": 1777486007,
+        "narHash": "sha256-5R0q8ESHux3Le76n4IuNUThkAo4o2M+Kj1Loj2J7ahI=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "2b3f4e0a0eea5a32dc78204fefba15ee83d437d3",
+        "rev": "6f5d55cfd726ff4cd68d006bddbdf459d0dc471b",
        "type": "github"
      },
      "original": {
@@ -674,28 +798,6 @@
        "type": "github"
      }
    },
-    "opencode": {
-      "inputs": {
-        "nixpkgs": [
-          "m3ta-nixpkgs",
-          "nixpkgs-master"
-        ]
-      },
-      "locked": {
-        "lastModified": 1772782174,
-        "narHash": "sha256-FBmF7/uwZYY/qY1252Hz+XhXdE+Qp5axySAy5Jw7XUQ=",
-        "owner": "anomalyco",
-        "repo": "opencode",
-        "rev": "6c7d968c4423a0cd6c85099c9377a6066313fa0a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "anomalyco",
-        "ref": "v1.2.20",
-        "repo": "opencode",
-        "type": "github"
-      }
-    },
    "openspec": {
      "inputs": {
        "nixpkgs": [
@@ -704,11 +806,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772182342,
-        "narHash": "sha256-9Q0iUyZGcDPLdgvnrBN3GumV8g9akV8TFb8bFkD1yYs=",
+        "lastModified": 1776788052,
+        "narHash": "sha256-L4LBHVVtgMhSJm+IzZSYOR0UXPbvIRg4xiEV5urYxdI=",
        "owner": "Fission-AI",
        "repo": "OpenSpec",
-        "rev": "afdca0d5dab1aa109cfd8848b2512333ccad60c3",
+        "rev": "3c7a05c5dc88b2397c478805890b55ed392b19e8",
        "type": "github"
      },
      "original": {
@@ -717,31 +819,125 @@
        "type": "github"
      }
    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1772555609,
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "c37f66a953535c394244888598947679af231863",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769936401,
+        "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772865871,
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771518446,
+        "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "agenix": "agenix",
        "agents": "agents",
        "disko": "disko",
+        "hermes-agent": "hermes-agent",
        "home-manager": "home-manager_2",
        "hyprpanel": "hyprpanel",
        "llm-agents": "llm-agents",
        "m3ta-nixpkgs": "m3ta-nixpkgs",
        "nix-colors": "nix-colors",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": "nixpkgs_8",
        "nixpkgs-45570c2": "nixpkgs-45570c2",
        "nixpkgs-9e58ed7": "nixpkgs-9e58ed7",
        "nixpkgs-locked": "nixpkgs-locked",
        "nixpkgs-master": "nixpkgs-master_2",
        "nixpkgs-stable": "nixpkgs-stable",
        "nur": "nur",
-        "rose-pine-hyprcursor": "rose-pine-hyprcursor"
+        "rose-pine-hyprcursor": "rose-pine-hyprcursor",
+        "skills-anthropic": "skills-anthropic",
+        "skills-basecamp": "skills-basecamp",
+        "skills-kestra": "skills-kestra",
+        "skills-superpowers": "skills-superpowers",
+        "skills-vercel": "skills-vercel"
      }
    },
    "rose-pine-hyprcursor": {
      "inputs": {
        "hyprlang": "hyprlang",
-        "nixpkgs": "nixpkgs_7",
+        "nixpkgs": "nixpkgs_9",
        "utils": "utils"
      },
      "locked": {
@@ -758,6 +954,86 @@
        "type": "github"
      }
    },
+    "skills-anthropic": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776964038,
+        "narHash": "sha256-xFsg66TCtKzSgRIW6Ab771FWEIhei3jPgfE4byMiB44=",
+        "owner": "anthropics",
+        "repo": "skills",
+        "rev": "5128e1865d670f5d6c9cef000e6dfc4e951fb5b9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "anthropics",
+        "repo": "skills",
+        "type": "github"
+      }
+    },
+    "skills-basecamp": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1777481361,
+        "narHash": "sha256-GJ94Y1n+zR6zpOWjAGFYFWFIFpT1royFJOy2TaQXpzU=",
+        "owner": "basecamp",
+        "repo": "basecamp-cli",
+        "rev": "59d59b66974d442190b0762129b4f1749adcedf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "basecamp",
+        "repo": "basecamp-cli",
+        "type": "github"
+      }
+    },
+    "skills-kestra": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1773046826,
+        "narHash": "sha256-w1zFqfCAcu9FsaGf8uAyaaYVbSwwtUzotfDJ1jSt+q0=",
+        "owner": "kestra-io",
+        "repo": "agent-skills",
+        "rev": "b536825bf5b9213d7a7fb5ab7c47823f1044490b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kestra-io",
+        "repo": "agent-skills",
+        "type": "github"
+      }
+    },
+    "skills-superpowers": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776996157,
+        "narHash": "sha256-0WupTacT1jIwVBloj1i0RF7wIllVtP8eMPRl7VrXdbE=",
+        "owner": "obra",
+        "repo": "superpowers",
+        "rev": "6efe32c9e2dd002d0c394e861e0529675d1ab32e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "obra",
+        "repo": "superpowers",
+        "type": "github"
+      }
+    },
+    "skills-vercel": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1777394685,
+        "narHash": "sha256-YxCMuTl+pVJ7dXhaL7l9vDw9k2orlG31j7/0pgllMJk=",
+        "owner": "vercel-labs",
+        "repo": "skills",
+        "rev": "7c0a9af3f8738965b71341712710ac7371089b34",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vercel-labs",
+        "repo": "skills",
+        "type": "github"
+      }
+    },
    "systems": {
      "locked": {
        "lastModified": 1681028828,
@@ -841,11 +1117,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1773297127,
-        "narHash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk=",
+        "lastModified": 1775636079,
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
        "type": "github"
      },
      "original": {
@@ -871,6 +1147,55 @@
        "repo": "flake-utils",
        "type": "github"
      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "hermes-agent",
+          "pyproject-build-systems",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770770348,
+        "narHash": "sha256-A2GzkmzdYvdgmMEu5yxW+xhossP+txrYb7RuzRaqhlg=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "5d1b2cb4fe3158043fbafbbe2e46238abbc954b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "uv2nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": "pyproject-nix_3"
+      },
+      "locked": {
+        "lastModified": 1773039484,
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -22,8 +22,7 @@
    nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
    nixpkgs-master.url = "github:nixos/nixpkgs/master";

-    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
-    # m3ta-nixpkgs.url = "path:/home/m3tam3re/p/NIX/nixpkgs";
+    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
    llm-agents.url = "github:numtide/llm-agents.nix";

    #
@@ -44,11 +43,37 @@
    rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
    nix-colors.url = "github:misterio77/nix-colors";

+    m3ta-home = {
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
    agents = {
      # url = "path:/home/m3tam3re/p/AI/AGENTS";
-      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
+      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS";
+    };
+    ## Skills
+    skills-basecamp = {
+      url = "github:basecamp/basecamp-cli";
      flake = false;
    };
+    skills-anthropic = {
+      url = "github:anthropics/skills";
+      flake = false;
+    };
+    skills-kestra = {
+      url = "github:kestra-io/agent-skills";
+      flake = false;
+    };
+    skills-superpowers = {
+      url = "github:obra/superpowers";
+      flake = false;
+    };
+    skills-vercel = {
+      url = "github:vercel-labs/skills";
+      flake = false;
+    };
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.4.30";
  };

  outputs = {
@@ -70,10 +95,12 @@
      "x86_64-darwin"
    ];
    forAllSystems = nixpkgs.lib.genAttrs systems;
+    allOverlays = import ./overlays {inherit inputs outputs;};
  in {
    packages =
      forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = import ./overlays {inherit inputs outputs;};
+    overlays = builtins.removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
    homeManagerModules = import ./modules/home-manager;

    nixosConfigurations = {
@@ -87,6 +114,7 @@
          ./hosts/m3-ares
          agenix.nixosModules.default
          m3ta-nixpkgs.nixosModules.default
+          inputs.hermes-agent.nixosModules.default
        ];
      };
      m3-atlas = nixpkgs.lib.nixosSystem {
@@ -94,7 +122,6 @@
          inherit inputs outputs;
          system = "x86_64-linux";
        };
-        system = "x86_64-linux";
        modules = [
          ./hosts/m3-atlas
          inputs.disko.nixosModules.disko
@@ -113,6 +140,7 @@
          agenix.nixosModules.default
          nur.modules.nixos.default
          m3ta-nixpkgs.nixosModules.default
+          inputs.hermes-agent.nixosModules.default
        ];
      };
      m3-helios = nixpkgs.lib.nixosSystem {
@@ -120,7 +148,6 @@
          inherit inputs outputs;
          system = "x86_64-linux";
        };
-        system = "x86_64-linux";
        modules = [
          ./hosts/m3-helios
          inputs.disko.nixosModules.disko
@@ -128,6 +155,19 @@
          m3ta-nixpkgs.nixosModules.default
        ];
      };
+      m3-hermes = nixpkgs.lib.nixosSystem {
+        specialArgs = {
+          inherit inputs outputs;
+          system = "x86_64-linux";
+        };
+        modules = [
+          ./hosts/m3-hermes
+          inputs.disko.nixosModules.disko
+          agenix.nixosModules.default
+          m3ta-nixpkgs.nixosModules.default
+          inputs.hermes-agent.nixosModules.default
+        ];
+      };
    };
    homeConfigurations = {
      "m3tam3re@m3-daedalus" = home-manager.lib.homeManagerConfiguration {
@@ -146,7 +186,7 @@
        config.allowUnfree = true; # Allow unfree packages in devShell
      };
      m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
-      rules = m3taLib.opencode-rules.mkOpencodeRules {
+      rules = m3taLib.coding-rules.mkCodingRules {
        inherit agents;
        languages = ["nix"];
      };
@@ -157,37 +197,10 @@
          nixd
          openssh
          agenix.packages.${system}.default
+          statix
+          deadnix
        ];
-        inherit (rules) instructions;
-        shellHook = ''
-          ${rules.shellHook}
-          echo "======================================"
-          echo "🧑‍🚀 Nix Development Shell with Opencode Rules"
-          echo "======================================"
-          echo ""
-          echo "Active rules:"
-          echo "  - Nix language conventions"
-          echo "  - Coding-style best practices"
-          echo "  - Naming conventions"
-          echo "  - Documentation standards"
-          echo "  - Testing guidelines"
-          echo "  - Git workflow patterns"
-          echo "  - Project structure guidelines"
-          echo ""
-          echo "Generated files:"
-          echo "  - .opencode-rules/ (symlink to AGENTS repo)"
-          echo "  - opencode.json (configuration file)"
-          echo ""
-          echo "Useful commands:"
-          echo "  - cat opencode.json        View rules configuration"
-          echo "  - ls .opencode-rules/      Browse available rules"
-          echo "  - nix develop              Re-enter this shell"
-          echo ""
-          echo "Remember to add to .gitignore:"
-          echo "  .opencode-rules"
-          echo "  opencode.json"
-          echo "======================================"
-        '';
+        inherit (rules) instructions shellHook;
      };
    });
  };
--- a/home/base/cli-tools/bat.nix
+++ b/home/base/cli-tools/bat.nix
@@ -0,0 +1,145 @@
+# Bat — cat replacement with nix-colors syntax highlighting theme.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.bat;
+  palette = config.colorScheme.palette;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.bat.enable = (mkEnableOption "enable bat with nix-colors theme") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.bat = {
+      enable = true;
+      config = {theme = "universal";};
+      themes = {
+        universal = {
+          src = pkgs.writeText "universal.tmTheme" ''
+            <?xml version="1.0" encoding="UTF-8"?>
+            <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+            <plist version="1.0">
+            <dict>
+              <key>name</key>
+              <string>Universal (nix-colors)</string>
+              <key>settings</key>
+              <array>
+                <dict>
+                  <key>settings</key>
+                  <dict>
+                    <key>background</key>
+                    <string>#${palette.base00}</string>
+                    <key>foreground</key>
+                    <string>#${palette.base05}</string>
+                    <key>caret</key>
+                    <string>#${palette.base05}</string>
+                    <key>selection</key>
+                    <string>#${palette.base02}</string>
+                    <key>selectionForeground</key>
+                    <string>#${palette.base05}</string>
+                    <key>lineHighlight</key>
+                    <string>#${palette.base01}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Comment</string>
+                  <key>scope</key>
+                  <string>comment</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base03}</string>
+                    <key>fontStyle</key>
+                    <string>italic</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>String</string>
+                  <key>scope</key>
+                  <string>string</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0A}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Number</string>
+                  <key>scope</key>
+                  <string>constant.numeric</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0E}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Keyword</string>
+                  <key>scope</key>
+                  <string>keyword</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base08}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Function</string>
+                  <key>scope</key>
+                  <string>entity.name.function</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0B}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Type</string>
+                  <key>scope</key>
+                  <string>entity.name.type, storage.type</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0D}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Variable</string>
+                  <key>scope</key>
+                  <string>variable</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base05}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Constant</string>
+                  <key>scope</key>
+                  <string>constant</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0E}</string>
+                  </dict>
+                </dict>
+              </array>
+            </dict>
+            </plist>
+          '';
+        };
+      };
+    };
+  };
+}
--- a/home/base/cli-tools/carapace.nix
+++ b/home/base/cli-tools/carapace.nix
@@ -0,0 +1,21 @@
+# Carapace — multi-shell completion engine with Fish, Nushell, and Bash integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.carapace;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.carapace.enable = (mkEnableOption "enable carapace completion engine") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.carapace = {
+      enable = true;
+      enableFishIntegration = true;
+      enableNushellIntegration = true;
+      enableBashIntegration = true;
+    };
+  };
+}
--- a/home/base/cli-tools/default.nix
+++ b/home/base/cli-tools/default.nix
@@ -0,0 +1,17 @@
+# CLI tools aggregator — imports all base command-line utilities.
+{...}: {
+  imports = [
+    ./bat.nix
+    ./carapace.nix
+    ./direnv.nix
+    ./eza.nix
+    ./fzf.nix
+    ./lf.nix
+    ./nitch.nix
+    ./packages.nix
+    ./television.nix
+    ./zellij.nix
+    ./zellij-ps.nix
+    ./zoxide.nix
+  ];
+}
--- a/home/base/cli-tools/direnv.nix
+++ b/home/base/cli-tools/direnv.nix
@@ -0,0 +1,20 @@
+# Direnv — automatic environment loading with nix-direnv integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.direnv;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.direnv.enable = (mkEnableOption "enable direnv with nix-direnv") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      enableNushellIntegration = true;
+      nix-direnv.enable = true;
+    };
+  };
+}
--- a/home/base/cli-tools/eza.nix
+++ b/home/base/cli-tools/eza.nix
@@ -0,0 +1,21 @@
+# Eza — modern ls replacement with icons, git status, and long format by default.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.eza;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.eza.enable = (mkEnableOption "enable eza modern ls replacement") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.eza = {
+      enable = true;
+      enableFishIntegration = true;
+      enableBashIntegration = true;
+      extraOptions = ["-l" "--icons" "--git" "-a"];
+    };
+  };
+}
--- a/home/base/cli-tools/fzf.nix
+++ b/home/base/cli-tools/fzf.nix
@@ -1,12 +1,14 @@
+# Fuzzy finder with nix-colors palette and Wayland clipboard integration.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.cli.fzf;
+  cfg = config.base.cliTools.fzf;
 in {
-  options.features.cli.fzf.enable = mkEnableOption "enable fuzzy finder";
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.fzf.enable = (mkEnableOption "enable fuzzy finder") // {default = true;};

  config = mkIf cfg.enable {
    programs.fzf = {
@@ -30,7 +32,6 @@ in {
        "--preview='bat --color=always -n {}'"
        "--bind 'ctrl-/:toggle-preview'"
        "--header 'Press CTRL-Y to copy command into clipboard'"
-        "--bind 'ctrl-/:toggle-preview'"
        "--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
      ];
      defaultCommand = "fd --type f --exclude .git --follow --hidden";
--- a/home/base/cli-tools/lf.nix
+++ b/home/base/cli-tools/lf.nix
@@ -0,0 +1,28 @@
+# Lf — terminal file manager with bat preview and Dracula theme.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.lf;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.lf.enable = (mkEnableOption "enable lf terminal file manager") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.lf];
+
+    programs.lf = {
+      enable = true;
+      settings = {
+        preview = true;
+        drawbox = true;
+        hidden = true;
+        icons = true;
+        previewer = "bat";
+      };
+    };
+  };
+}
--- a/home/base/cli-tools/nitch.nix
+++ b/home/base/cli-tools/nitch.nix
@@ -0,0 +1,17 @@
+# Nitch — minimal system information display tool.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.nitch;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.nitch.enable = (mkEnableOption "enable nitch") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.nitch];
+  };
+}
--- a/home/base/cli-tools/packages.nix
+++ b/home/base/cli-tools/packages.nix
@@ -0,0 +1,62 @@
+# Essential CLI packages — core utilities always available on every host.
+# NOTE: `lazylib` does not exist in nixpkgs. `lazygit` is the correct package
+# (Git TUI) and is intentionally used here instead.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.essentials;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.essentials.enable = (mkEnableOption "enable essential CLI packages") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      # Core utilities
+      coreutils
+      fd
+      htop
+      jq
+      ripgrep
+
+      # Nix
+      alejandra
+      comma
+      nixd
+      nix-diff
+      nix-index
+      nix-update
+
+      # Dev tools
+      bc
+      cmake
+      devenv
+      gcc
+      gnumake
+      go
+      httpie
+      just
+      lazygit
+      progress
+      sqlite
+      sqlite-vec
+      tldr
+
+      # AI tools
+      fabric-ai
+      llm
+
+      # Misc
+      basecamp
+      hyprpaper-random
+      libnotify
+      trash-cli
+      unzip
+      yazi
+      zip
+    ];
+  };
+}
--- a/home/base/cli-tools/television.nix
+++ b/home/base/cli-tools/television.nix
@@ -0,0 +1,60 @@
+# Television — fuzzy finder with custom channels for tldr, git-diff, and git-log.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.television;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.television.enable = (mkEnableOption "enable television") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.television = {
+      enable = true;
+      channels = {
+        tldr = {
+          metadata = {
+            description = "Browse TLDR pages";
+            name = "tldr";
+            requirements = ["tldr"];
+          };
+          preview = {
+            command = "tldr '{}'";
+          };
+          source = {
+            command = "tldr --list";
+          };
+        };
+        git-diff = {
+          metadata = {
+            description = "A channel to select files from git diff commands";
+            name = "git-diff";
+            requirements = ["git"];
+          };
+          preview = {
+            command = "git diff HEAD --color=always -- '{}'";
+          };
+          source = {
+            command = "git diff --name-only HEAD";
+          };
+        };
+        git-log = {
+          metadata = {
+            description = "A channel to select from git log entries";
+            name = "git-log";
+            requirements = ["git"];
+          };
+          preview = {
+            command = "git show -p --stat --pretty=fuller --color=always '{0}'";
+          };
+          source = {
+            command = "git log --oneline --date=short --pretty=\"format:%h %s %an %cd\" \"$@\"";
+            output = "{split: :0}";
+          };
+        };
+      };
+    };
+  };
+}
--- a/home/base/cli-tools/zellij-ps.nix
+++ b/home/base/cli-tools/zellij-ps.nix
@@ -0,0 +1,30 @@
+# Zellij-ps — project-aware Zellij session manager from m3ta-nixpkgs.
+# Delegates to `cli.zellij-ps` — the home-manager module namespace provided by
+# m3ta-nixpkgs (inputs.m3ta-nixpkgs.nixosModules.default). This is intentional;
+# `cli.*` is the convention used by m3ta-nixpkgs home-manager modules.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.zellijPs;
+in {
+  options.base.cliTools.zellijPs = {
+    # Enabled by default — base modules are always-on.
+    enable = (mkEnableOption "enable zellij-ps project session manager") // {default = true;};
+
+    projectFolders = mkOption {
+      type = types.listOf types.path;
+      description = "Project root folders scanned by zellij-ps.";
+      default = ["${config.home.homeDirectory}/p"];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    cli.zellij-ps = {
+      enable = true;
+      projectFolders = cfg.projectFolders;
+    };
+  };
+}
--- a/home/base/cli-tools/zellij.nix
+++ b/home/base/cli-tools/zellij.nix
@@ -1,12 +1,14 @@
+# Zellij terminal multiplexer with nix-colors theming.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.cli.zellij;
+  cfg = config.base.cliTools.zellij;
 in {
-  options.features.cli.zellij.enable = mkEnableOption "enable tmux";
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.zellij.enable = (mkEnableOption "enable zellij multiplexer") // {default = true;};

  config = mkIf cfg.enable {
    programs.zellij = {
--- a/home/base/cli-tools/zoxide.nix
+++ b/home/base/cli-tools/zoxide.nix
@@ -0,0 +1,20 @@
+# Zoxide — smarter cd with Fish and Nushell integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.zoxide;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.zoxide.enable = (mkEnableOption "enable zoxide smarter cd") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.zoxide = {
+      enable = true;
+      enableFishIntegration = true;
+      enableNushellIntegration = true;
+    };
+  };
+}
--- a/home/base/default.nix
+++ b/home/base/default.nix
@@ -0,0 +1,9 @@
+# Base home-manager configuration — always loaded on every host.
+# Includes shell, CLI tools, and secrets modules.
+{...}: {
+  imports = [
+    ./shell
+    ./cli-tools
+    ./secrets/secrets.nix
+  ];
+}
--- a/home/base/secrets/secrets.nix
+++ b/home/base/secrets/secrets.nix
@@ -0,0 +1,24 @@
+# Password store and secrets management via pass-wayland with OTP and import extensions.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.secrets;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.secrets.enable = (mkEnableOption "enable secrets management") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.password-store = {
+      enable = true;
+      package =
+        pkgs.pass-wayland.withExtensions
+        (exts: [exts.pass-otp exts.pass-import]);
+      settings = {PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store";};
+    };
+    home.packages = [pkgs.pinentry-gnome3];
+  };
+}
--- a/home/base/shell/default.nix
+++ b/home/base/shell/default.nix
@@ -0,0 +1,8 @@
+# Shell aggregator — imports Nushell (primary), Fish, and Starship prompt.
+{...}: {
+  imports = [
+    ./nushell.nix
+    ./fish.nix
+    ./starship.nix
+  ];
+}
--- a/home/features/cli/fish.nix
+++ b/home/features/cli/fish.nix
@@ -1,12 +1,14 @@
+# Fish shell configuration exposed under the new base namespace.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.cli.fish;
+  cfg = config.base.shell.fish;
 in {
-  options.features.cli.fish.enable = mkEnableOption "enable fish shell";
+  # Enabled by default — base modules are always-on.
+  options.base.shell.fish.enable = (mkEnableOption "enable fish shell") // {default = true;};

  config = mkIf cfg.enable {
    programs.fish = {
--- a/home/base/shell/nushell.nix
+++ b/home/base/shell/nushell.nix
@@ -0,0 +1,86 @@
+# Primary shell configuration — Nushell with environment, aliases, and integrations.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.shell.nushell;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.nushell = {
+      enable = true;
+      envFile.text = ''
+        $env.config.show_banner = false
+        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
+        $env.NIX_LOG = "iunfo"
+        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
+        $env.TERMINAL = "ghostty"
+        $env.EDITOR = "nvim"
+        $env.VISUAL = "zeditor"
+        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
+        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always -n {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy command into clipboard' --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort' --color bg:#282a36,bg+:#44475a,fg:#f8f8f2,fg+:#f8f8f2,header:#6272a4,hl:#bd93f9,hl+:#bd93f9,info:#ffb86c,marker:#ff79c6,pointer:#ff79c6,prompt:#50fa7b,spinner:#ffb86c"
+        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
+        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
+        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
+        $env.NPM_CONFIG_PREFIX = $"($env.HOME)/.npm-global"
+        $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
+
+        # Load kestractl-env from agenix
+        if ("/run/agenix/kestractl-env" | path exists) {
+          open /run/agenix/kestractl-env
+            | lines
+            | where {($in | str trim | str length) > 0}
+            | parse "{key}={value}"
+            | update value {str trim -c '"'}
+            | transpose -r -d
+            | load-env
+        }
+      '';
+
+      configFile.text = ''
+        # Aliases
+        alias .. = cd ..
+        alias ... = cd ...
+        alias h = cd $env.HOME
+        alias b = yazi
+        alias lt = eza --tree --level=2 --long --icons --git
+        alias grep = rg
+        alias just = just --unstable
+
+        alias node = bun
+        alias npx = bunx
+
+        alias n = nix
+        alias nd = nix develop -c $nu.current-shell
+        alias ns = nix shell
+        alias nsn = nix shell nixpkgs#
+        alias nb = nix build
+        alias nbn = nix build nixpkgs#
+        alias nf = nix flake
+
+        alias nr = sudo nixos-rebuild --flake .
+        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
+        alias snr = sudo nixos-rebuild --flake .
+        alias snrs = sudo nixos-rebuild --flake . switch
+        alias hm = home-manager --flake .
+        alias hms = home-manager --flake . switch
+        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
+
+        alias tsu = sudo tailscale up
+        alias tsd = sudo tailscale down
+
+        alias vi = nvim
+        alias vim = nvim
+
+        if (which tv | is-not-empty) {
+          mkdir ($nu.data-dir | path join "vendor/autoload")
+          tv init nu | save -f ($nu.data-dir | path join "vendor/autoload/tv.nu")
+        }
+      '';
+    };
+  };
+}
--- a/home/features/cli/starship.nix
+++ b/home/features/cli/starship.nix
@@ -1,12 +1,14 @@
+# Starship cross-shell prompt with nix-colors theming.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.cli.starship;
+  cfg = config.base.shell.starship;
 in {
-  options.features.cli.starship.enable = mkEnableOption "enable starship prompt";
+  # Enabled by default — base modules are always-on.
+  options.base.shell.starship.enable = (mkEnableOption "enable starship prompt") // {default = true;};

  config = mkIf cfg.enable {
    programs.starship = {
--- a/home/coding/agents/agents.nix
+++ b/home/coding/agents/agents.nix
@@ -0,0 +1,85 @@
+# AI agent system — OpenCode, Pi, and MCP server configuration.
+# Relies on coding.agents options provided by home/common/default.nix
+# (inputs.m3ta-nixpkgs.homeManagerModules.default).
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  videoDrivers ? [],
+  ...
+}: {
+  # Agent Git Identity configuration
+  # Note: Uses existing gitea SSH key (m3tam3re identity) for push auth
+  coding.agents.gitIdentity = {
+    enable = true;
+    name = "m3ta-chiron";
+    email = "m3ta-chiron@agentmail.to";
+    sshKey = "/home/m3tam3re/.ssh/gitea";
+  };
+
+  imports = [
+    # OpenCode and Pi agent configurations
+    ./opencode.nix
+    ./pi.nix
+  ];
+
+  coding.agents.skills = {
+    agentsInput = inputs.agents;
+    externalSkills = [
+      {
+        src = inputs.skills-anthropic;
+        selectSkills = ["pdf" "docx" "frontend-design"];
+      }
+      {src = inputs.skills-superpowers;}
+      {src = inputs.skills-vercel;}
+      {src = inputs.skills-basecamp;}
+      {src = inputs.skills-kestra;}
+    ];
+  };
+
+  programs.mcp = {
+    enable = true;
+    servers = {
+      DeepWiki = {
+        url = "https://mcp.deepwiki.com/mcp";
+      };
+      Ref = {
+        command = "bash";
+        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
+      };
+      Exa = {
+        command = "bash";
+        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
+      };
+      Outline = {
+        url = "https://wiki.az-gruppe.com/mcp";
+      };
+      ContextMode = {
+        command = "bash";
+        args = ["-c" "exec bunx context-mode@latest"];
+      };
+      Honcho = {
+        command = "bash";
+        args = [
+          "-c"
+          ''exec bunx mcp-remote@latest https://mcp.honcho.dev --header "Authorization:Bearer $(cat /run/agenix/honcho-key)" --header "X-Honcho-User-Name:m3tam3re"''
+        ];
+      };
+    };
+  };
+
+  home.packages = with pkgs; [
+    agenix-cli
+    agent-browser
+    beads
+    pi
+    (qmd.override {
+      vulkanSupport = videoDrivers == ["amdgpu"];
+      cudaSupport = videoDrivers == ["nvidia"];
+    })
+    # opencode-desktop
+    openshell
+    openspec
+  ];
+}
--- a/home/coding/agents/opencode.nix
+++ b/home/coding/agents/opencode.nix
@@ -0,0 +1,260 @@
+{
+  inputs,
+  lib,
+  ...
+}: {
+  coding.agents.opencode = {
+    enable = true;
+    agentsInput = inputs.agents;
+  };
+
+  coding.opencode = {
+    enable = true;
+
+    ohMyOpencodeSettings = {
+      agents = {
+        sisyphus.model = "litellm/claude-opus-4-6";
+        oracle.model = "litellm/claude-sonnet-4-6";
+        librarian.model = "litellm/claude-sonnet-4-6";
+        explore.model = "litellm/claude-haiku-4-5";
+        multimodal-looker.model = "litellm/gpt-5.3-codex";
+        prometheus.model = "litellm/claude-opus-4-6";
+        metis.model = "litellm/claude-opus-4-6";
+        momus.model = "litellm/claude-opus-4-6";
+        atlas.model = "litellm/claude-sonnet-4-6";
+      };
+      categories = {
+        visual-engineering.model = "zai-coding-plan/glm-5.1";
+        ultrabrain.model = "litellm/claude-opus-4-6";
+        deep.model = "litellm/claude-sonnet-4-6";
+        artistry.model = "zai-coding-plan/glm-5.1";
+        quick.model = "litellm/claude-haiku-4-5";
+        unspecified-low.model = "litellm/claude-sonnet-4-6";
+        unspecified-high.model = "litellm/claude-opus-4-6";
+        writing.model = "zai-coding-plan/glm-5.1";
+      };
+    };
+  };
+
+  # Keep TUI settings in programs.opencode.tui to satisfy OpenCode v1.2.15+.
+  programs.opencode.tui.theme = "opencode";
+
+  # Override legacy default settings to avoid deprecated TUI keys in settings.
+  programs.opencode.settings = lib.mkForce {
+    plugin = ["oh-my-openagent"];
+    formatter = {
+      alejandra = {
+        command = ["alejandra" "-q" "-"];
+        extensions = [".nix"];
+      };
+    };
+
+    # Security: permission hardening for OpenCode
+    # Last matching rule wins. Glob patterns: * = any chars, ? = single char.
+    # ~ and $HOME are expanded to the user's home directory.
+    # external_directory gates paths outside the working directory.
+    permission = {
+      # External directory access: ask by default, allow safe paths
+      "external_directory" = {
+        "*" = "ask";
+        "/nix/store/**" = "allow";
+        "/tmp/**" = "allow";
+      };
+
+      # Read access: allow by default, deny sensitive paths
+      "read" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "~/.aws/**" = "deny";
+        "~/.kube/**" = "deny";
+        "~/.config/gh/**" = "deny";
+        "~/.config/gcloud/**" = "deny";
+        "~/.config/op/**" = "deny";
+        "~/.config/sops/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "~/.pi/agent/auth.json" = "deny";
+        "~/.pi/agent/sessions/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+        "*id_rsa*" = "deny";
+        "*id_ed25519*" = "deny";
+        "*id_ecdsa*" = "deny";
+        "*.example.env" = "allow";
+        "*.sample.env" = "allow";
+        "*.test.env" = "allow";
+        ".env.example" = "allow";
+        ".env.sample" = "allow";
+        ".env.test" = "allow";
+        "~/.ssh/*.pub" = "allow";
+        "*.pub" = "allow";
+        "*.csr" = "allow";
+      };
+
+      # Edit access: ask by default, deny sensitive paths
+      "edit" = {
+        "*" = "ask";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "~/.aws/**" = "deny";
+        "~/.kube/**" = "deny";
+        "~/.config/gh/**" = "deny";
+        "~/.config/gcloud/**" = "deny";
+        "~/.config/op/**" = "deny";
+        "~/.config/sops/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "~/.pi/agent/auth.json" = "deny";
+        "~/.pi/agent/sessions/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+        "*id_rsa*" = "deny";
+        "*id_ed25519*" = "deny";
+        "*id_ecdsa*" = "deny";
+        "~/.ssh/*.pub" = "allow";
+        "*.pub" = "allow";
+        "*.csr" = "allow";
+      };
+
+      # Glob patterns: same rules as read for file matching
+      "glob" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+      };
+
+      # Grep: allow search, but deny searching for secrets
+      "grep" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "*PASSWORD*" = "ask";
+        "*SECRET*" = "ask";
+        "*API_KEY*" = "ask";
+        "*PRIVATE_KEY*" = "ask";
+      };
+
+      # Bash: ask by default, deny dangerous and env-leak commands
+      "bash" = {
+        "*" = "ask";
+        "git status*" = "allow";
+        "git diff*" = "allow";
+        "git log*" = "allow";
+        "git branch*" = "allow";
+        "git show*" = "allow";
+        "git remote*" = "allow";
+        "nix --version" = "allow";
+        "nix eval*" = "allow";
+        "nix build*" = "allow";
+        "nix develop*" = "allow";
+        "nix shell*" = "allow";
+        "nix search*" = "allow";
+        "alejandra*" = "allow";
+        "git add*" = "allow";
+        "git commit*" = "allow";
+        "git push*" = "ask";
+        "git pull*" = "allow";
+        "rm *" = "ask";
+        "rm -rf *" = "deny";
+        "sudo *" = "ask";
+        "env" = "deny";
+        "printenv" = "deny";
+        "cat /proc/*/environ" = "deny";
+        "gpg *--export-secret*" = "deny";
+        "ssh-add -D" = "deny";
+        "docker run --privileged*" = "deny";
+        "curl *| *sh" = "deny";
+        "wget *| *sh" = "deny";
+      };
+
+      # Web fetch: ask for sensitive URLs
+      "webfetch" = {
+        "*" = "ask";
+        "https://api.github.com*" = "allow";
+        "https://search.nixos.org*" = "allow";
+      };
+
+      # Doom loop guard
+      "doom_loop" = "ask";
+    };
+
+    # AZ-Gruppe LiteLLM endpoint + available models
+    provider = {
+      litellm = {
+        npm = "@ai-sdk/openai-compatible";
+        name = "LiteLLM (AZ-Gruppe)";
+        options.baseURL = "https://llm.az-gruppe.com/v1";
+        models = {
+          "gpt-5.2" = {
+            name = "GPT-5.2";
+            limit = {
+              context = 400000;
+              output = 128000;
+            };
+          };
+          "gpt-5.3-codex" = {
+            name = "GPT-5.3 Codex";
+            limit = {
+              context = 400000;
+              output = 128000;
+            };
+          };
+          "claude-haiku-4-5" = {
+            name = "Claude Haiku 4.5";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 64000;
+            };
+          };
+          "claude-sonnet-4-6" = {
+            name = "Claude Sonnet 4.6";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 64000;
+            };
+          };
+          "claude-opus-4-6" = {
+            name = "Claude Opus 4.6";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 128000;
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/home/coding/agents/pi.nix
+++ b/home/coding/agents/pi.nix
@@ -0,0 +1,269 @@
+{inputs, ...}: {
+  coding.agents.pi = {
+    enable = true;
+    agentsInput = inputs.agents;
+
+    modelOverrides = {
+      chiron = "minimax/MiniMax-M2.7";
+      chiron-forge = "minimax/MiniMax-M2.7";
+    };
+
+    # Coding rules for Pi agent
+    # Rules sourced from AGENTS repo
+    codingRules = {
+      # Language-specific rules
+      languages = [
+        "nix" # Nix language conventions
+      ];
+
+      # Standard concerns from AGENTS repo
+      concerns = [
+        "coding-style" # General coding principles
+        "naming" # Naming conventions (camelCase, snake_case, etc.)
+        "documentation" # Documentation standards
+        "testing" # Testing guidelines (Arrange-Act-Assert)
+        "git-workflow" # Conventional commits, branch naming
+        "git-identity" # Git identity configuration for agents
+        "project-structure" # Project layout conventions
+      ];
+
+      # No framework-specific rules for NixOS config
+      frameworks = [];
+    };
+
+    settings = {
+      packages = [
+        "npm:@dreadedzombie/pi-init"
+        "npm:@plannotator/pi-extension"
+        "npm:@thesethrose/pi-zai-provider"
+        "npm:pi-agent-browser-native"
+        "npm:pi-beads-extension"
+        "npm:pi-lens"
+        "npm:pi-markdown-preview"
+        "npm:pi-mcp-adapter"
+        "npm:pi-powerline-footer"
+        "npm:pi-prompt-template-model"
+        "npm:pi-subagents"
+        "npm:pi-tool-display"
+        "npm:pi-web-access"
+        "git:github.com/hk-vk/pi-connect"
+      ];
+
+      defaultProvider = "minimax";
+      defaultModel = "MiniMax-M2.7";
+      defaultThinkingLevel = "high";
+    };
+
+    # pi-guardrails: strict security config
+    # NOTE: Path access checks are lexical (not symlink-safe).
+    # NOTE: Local project .pi/extensions/guardrails.json can override same rule IDs.
+    #       For immutable global policies, consider a wrapper or upstream patch.
+    guardrails = {
+      enable = true;
+      config = {
+        enabled = true;
+        applyBuiltinDefaults = true;
+
+        onboarding = {
+          completed = true;
+        };
+
+        features = {
+          policies = true;
+          permissionGate = true;
+          pathAccess = true;
+        };
+
+        pathAccess = {
+          mode = "ask";
+          allowedPaths = [
+            "/nix/store/"
+            "/tmp/"
+          ];
+        };
+
+        policies = {
+          rules = [
+            # ── SSH keys ───────────────────────────────────────────
+            {
+              id = "home-ssh";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.ssh/**";}
+                {pattern = "~/.ssh/*_rsa";}
+                {pattern = "~/.ssh/*_ed25519";}
+                {pattern = "~/.ssh/*.pem";}
+              ];
+              allowedPatterns = [
+                {pattern = "~/.ssh/*.pub";}
+              ];
+            }
+
+            # ── GPG keys ─────────────────────────────────────────
+            {
+              id = "home-gpg";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.gnupg/**";}
+                {pattern = "~/*.gpg";}
+                {pattern = "~/.gpg-agent.conf";}
+              ];
+            }
+
+            # ── AWS credentials ────────────────────────────────────
+            {
+              id = "home-aws";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.aws/**";}
+                {pattern = "~/.aws/credentials";}
+                {pattern = "~/.aws/config";}
+              ];
+            }
+
+            # ── Kubernetes configs ────────────────────────────────
+            {
+              id = "home-kube";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.kube/**";}
+                {pattern = "*kubeconfig*";}
+              ];
+            }
+
+            # ── Cloud CLI configs ────────────────────────────────
+            {
+              id = "home-config";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.config/gh/**";}
+                {pattern = "~/.config/gcloud/**";}
+                {pattern = "~/.config/op/**";}
+                {pattern = "~/.config/sops/**";}
+              ];
+            }
+
+            # ── agenix secrets ───────────────────────────────────
+            {
+              id = "agenix-secrets";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "/run/agenix/**";}
+              ];
+            }
+
+            # ── Pi auth and sessions ────────────────────────────
+            {
+              id = "pi-auth-sessions";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.pi/agent/auth.json";}
+                {pattern = "~/.pi/agent/sessions/**";}
+              ];
+            }
+
+            # ── Environment files ─────────────────────────────────
+            {
+              id = "secret-files";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = true;
+              patterns = [
+                {pattern = ".env";}
+                {pattern = ".env.*";}
+                {pattern = ".dev.vars";}
+              ];
+              allowedPatterns = [
+                {pattern = "*.example.env";}
+                {pattern = "*.sample.env";}
+                {pattern = "*.test.env";}
+                {pattern = ".env.example";}
+                {pattern = ".env.sample";}
+                {pattern = ".env.test";}
+              ];
+            }
+
+            # ── Private keys and certificates ───────────────────
+            {
+              id = "private-keys";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "*.pem";}
+                {pattern = "*.key";}
+                {pattern = "*.p12";}
+                {pattern = "*.pfx";}
+                {pattern = "*id_rsa*";}
+                {pattern = "*id_ed25519*";}
+                {pattern = "*id_ecdsa*";}
+              ];
+              allowedPatterns = [
+                {pattern = "*.pub";}
+                {pattern = "*.csr";}
+              ];
+            }
+          ];
+        };
+
+        permissionGate = {
+          explainCommands = false;
+          # Auto-deny patterns: env leakage and credential dumping
+          autoDenyPatterns = [
+            {
+              pattern = "\\benv\\b";
+              regex = true;
+              description = "env command (may dump environment)";
+            }
+            {
+              pattern = "\\bprintenv\\b";
+              regex = true;
+              description = "printenv command (dumps environment variables)";
+            }
+            {
+              pattern = "/proc/[0-9]+/environ";
+              regex = true;
+              description = "reading process environment files";
+            }
+            {
+              pattern = "gpg\\s+--export-secret-keys";
+              regex = true;
+              description = "GPG secret key export";
+            }
+            {
+              pattern = "gpg\\s+--export-secret-subkeys";
+              regex = true;
+              description = "GPG secret subkey export";
+            }
+            {
+              pattern = "ssh-add\\s+-D";
+              regex = true;
+              description = "delete all SSH identities";
+            }
+            {
+              pattern = "\\b(op|pass)\\s+(read|show|get)";
+              regex = true;
+              description = "password manager read operations";
+            }
+          ];
+        };
+      };
+    };
+
+    # MCP servers auto-inherited from programs.mcp in default.nix
+  };
+}
--- a/home/coding/default.nix
+++ b/home/coding/default.nix
@@ -0,0 +1,12 @@
+# Coding environment aggregator — profile-independent development tooling.
+# Imports editors, LSP servers, git configuration, the agent system, language runtimes, and optional packages.
+{...}: {
+  imports = [
+    ./editor
+    ./lsp
+    ./git/git.nix
+    ./agents/agents.nix
+    ./languages
+    ./packages.nix
+  ];
+}
--- a/home/coding/editor/default.nix
+++ b/home/coding/editor/default.nix
@@ -0,0 +1,6 @@
+# Editor aggregator — delegates to m3ta-nixpkgs editor modules.
+{...}: {
+  imports = [
+    ./neovim.nix
+  ];
+}
--- a/home/coding/editor/neovim.nix
+++ b/home/coding/editor/neovim.nix
@@ -0,0 +1,7 @@
+# NeoVim base configuration via m3ta-nixpkgs coding.editors module.
+# The option `coding.editors.neovim.enable` is declared by
+# inputs.m3ta-nixpkgs.homeManagerModules.default — no re-declaration here.
+{...}: {
+  # Placeholder for host-agnostic NeoVim overrides.
+  # Set coding.editors.neovim.enable = true in per-host files to activate.
+}
--- a/home/coding/git/git.nix
+++ b/home/coding/git/git.nix
@@ -0,0 +1,41 @@
+# Git configuration with signing, aliases, and global ignore.
+# Identity and host-specific SSH keys are set per-host in home/m3tam3re/.
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        name = lib.mkDefault "m3tam3re";
+        email = lib.mkDefault "p@m3ta.dev";
+      };
+      core.excludesfile = "~/.gitignore_global";
+      init.defaultBranch = "master";
+      alias = {
+        st = "status";
+        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
+      };
+    };
+  };
+
+  programs.difftastic.enable = true;
+
+  programs.jujutsu = {
+    enable = true;
+    settings = {
+      user = {
+        email = "m@m3tam3re.com";
+        name = "Sascha Koenig";
+      };
+    };
+  };
+
+  home.packages = with pkgs; [
+    lazygit
+  ];
+}
--- a/home/coding/languages/default.nix
+++ b/home/coding/languages/default.nix
@@ -0,0 +1,10 @@
+# Language runtimes — Python, JavaScript, Rust, Go, TypeScript.
+{...}: {
+  imports = [
+    ./python.nix
+    ./javascript.nix
+    ./rust-toolchain.nix
+    ./go.nix
+    ./typescript.nix
+  ];
+}
--- a/home/coding/languages/go.nix
+++ b/home/coding/languages/go.nix
@@ -0,0 +1,19 @@
+# Go toolchain — compiler and language server.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.go;
+in {
+  options.coding.languages.go.enable = mkEnableOption "Go toolchain";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
+}
--- a/home/coding/languages/javascript.nix
+++ b/home/coding/languages/javascript.nix
@@ -0,0 +1,25 @@
+# JavaScript/TypeScript runtime — Node.js and Bun.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.javascript;
+  npmGlobalPrefix = "${config.home.homeDirectory}/.npm-global";
+in {
+  options.coding.languages.javascript.enable = mkEnableOption "JavaScript runtime (Node.js + Bun)";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      nodejs
+      bun
+    ];
+
+    home.file.".npmrc".text = ''
+      prefix=${npmGlobalPrefix}
+    '';
+    home.sessionVariables.NPM_CONFIG_PREFIX = npmGlobalPrefix;
+  };
+}
--- a/home/coding/languages/python.nix
+++ b/home/coding/languages/python.nix
@@ -0,0 +1,35 @@
+# Python runtime with pip and uv.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.python;
+in {
+  options.coding.languages.python = {
+    enable = mkEnableOption "Python runtime with pip and uv";
+    extraPackages = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExpression "[ pkgs.python3Packages.numpy ]";
+      description = "Additional Python packages to include";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      (pkgs.python3.withPackages (ps:
+        with ps;
+          [
+            uv
+          ]
+          ++ cfg.extraPackages))
+      (writeShellScriptBin "pip" "exec uv pip $@")
+      (writeShellScriptBin "pip3" "exec uv pip $@")
+      pyrefly
+      ruff
+    ];
+  };
+}
--- a/home/coding/languages/rust-toolchain.nix
+++ b/home/coding/languages/rust-toolchain.nix
@@ -0,0 +1,20 @@
+# Rust toolchain — compiler, package manager, and language server.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.rustToolchain;
+in {
+  options.coding.languages.rustToolchain.enable = mkEnableOption "Rust toolchain";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      rustc
+      cargo
+      rust-analyzer
+    ];
+  };
+}
--- a/home/coding/languages/typescript.nix
+++ b/home/coding/languages/typescript.nix
@@ -0,0 +1,19 @@
+# TypeScript support — language server and type checking tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.typescript;
+in {
+  options.coding.languages.typescript.enable = mkEnableOption "TypeScript support";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      typescript
+      typescript-language-server
+    ];
+  };
+}
--- a/home/coding/lsp/default.nix
+++ b/home/coding/lsp/default.nix
@@ -0,0 +1,6 @@
+# LSP aggregator — language server protocol tooling.
+{...}: {
+  imports = [
+    ./servers.nix
+  ];
+}
--- a/home/coding/lsp/servers.nix
+++ b/home/coding/lsp/servers.nix
@@ -0,0 +1,23 @@
+# LSP server configuration — language servers for the development environment.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.lsp;
+in {
+  options.coding.lsp.enable = mkEnableOption "enable LSP servers";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      # Nix
+      nixd
+      # General
+      typescript-language-server
+      tailwindcss-language-server
+      pyrefly
+    ];
+  };
+}
--- a/home/coding/packages.nix
+++ b/home/coding/packages.nix
@@ -0,0 +1,20 @@
+# Additional coding packages — API clients and GUI development tools.
+# Opt-in since not all coding hosts need these desktop-oriented tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.packages;
+in {
+  options.coding.packages.enable = mkEnableOption "additional coding packages (bruno, insomnia)";
+
+  config = mkIf cfg.enable {
+    home.packages = [
+      pkgs.bruno
+      pkgs.insomnia
+    ];
+  };
+}
--- a/home/common/default.nix
+++ b/home/common/default.nix
@@ -25,7 +25,7 @@
      inputs.nur.overlays.default
      inputs.m3ta-nixpkgs.overlays.default
      inputs.m3ta-nixpkgs.overlays.modifications
-      (outputs.overlays.mkLlmAgentsOverlay system)
+      (outputs.lib.mkLlmAgentsOverlay system)
      # You can also add overlays exported from other flakes:
      # neovim-nightly-overlay.overlays.default

--- a/home/desktop/apps/crypto.nix
+++ b/home/desktop/apps/crypto.nix
@@ -0,0 +1,16 @@
+# Cryptocurrency applications — Bisq, Monero GUI, and Trezor Suite.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.crypto;
+in {
+  options.desktop.apps.crypto.enable = mkEnableOption "enable crypto applications";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
+  };
+}
--- a/home/desktop/apps/default.nix
+++ b/home/desktop/apps/default.nix
@@ -0,0 +1,10 @@
+# Desktop apps aggregator — Obsidian, Office, web apps, crypto tools, and productivity.
+{...}: {
+  imports = [
+    ./obsidian.nix
+    ./office.nix
+    ./webapps.nix
+    ./crypto.nix
+    ./productivity.nix
+  ];
+}
--- a/home/features/desktop/obsidian.nix
+++ b/home/features/desktop/obsidian.nix
@@ -1,13 +1,13 @@
+# Obsidian knowledge base with markdown MIME association.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.desktop.obsidian;
+  cfg = config.desktop.apps.obsidian;
 in {
-  options.features.desktop.obsidian.enable =
-    mkEnableOption "enable Obsidian knowledge base";
+  options.desktop.apps.obsidian.enable = mkEnableOption "enable Obsidian knowledge base";

  config = mkIf cfg.enable {
    programs.obsidian.enable = true;
--- a/home/desktop/apps/office.nix
+++ b/home/desktop/apps/office.nix
@@ -0,0 +1,16 @@
+# Office and productivity applications — LibreOffice and document tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.office;
+in {
+  options.desktop.apps.office.enable = mkEnableOption "install office and paperwork apps";
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.libreoffice-fresh];
+  };
+}
--- a/home/desktop/apps/productivity.nix
+++ b/home/desktop/apps/productivity.nix
@@ -0,0 +1,18 @@
+# Productivity tools — Pomodoro timer and focus utilities.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.productivity;
+in {
+  options.desktop.apps.productivity.enable = mkEnableOption "enable productivity tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      pomodoro-timer
+    ];
+  };
+}
--- a/home/features/desktop/webapps.nix
+++ b/home/features/desktop/webapps.nix
@@ -1,6 +1,7 @@
+# Web application desktop entries — Teams, Outlook, Basecamp, and OpenCode launchers.
 {
+  config,
  pkgs,
-  lib,
  ...
 }: let
  icons = {
@@ -41,7 +42,7 @@ in {
      comment = "Open Basecamp as a Desktop App";
      categories = ["Application" "Network"];
      terminal = false;
-      icon = "/home/sascha.koenig/.local/share/icons/basecamp-logo.png";
+      icon = "${config.home.homeDirectory}/.local/share/icons/basecamp-logo.png";
    };
    opencode = {
      name = "Opencode";
--- a/home/features/desktop/default.nix
+++ b/home/features/desktop/default.nix
@@ -1,22 +1,14 @@
+# Desktop environment aggregator — only loaded when context=desktop.
+# Includes window manager, applications, theming, and desktop session config.
 {
  config,
  pkgs,
  ...
 }: {
  imports = [
-    ./coding.nix
-    ./crypto.nix
-    ./fonts.nix
-    ./gaming.nix
-    ./hyprland.nix
-    ./media.nix
-    ./obsidian.nix
-    ./office.nix
-    ./rofi.nix
-    ./theme.nix
-    ./wallpapers.nix
-    ./wayland.nix
-    ./webapps.nix
+    ./wm
+    ./apps
+    ./theme
  ];

  xdg = {
@@ -42,6 +34,7 @@
    userDirs = {
      enable = true;
      createDirectories = true;
+      setSessionVariables = true;
    };
  };

@@ -54,7 +47,13 @@
    XDG_SESSION_TYPE = "wayland";
    XDG_SESSION_DESKTOP = "Hyprland";
  };
-  home.sessionPath = ["\${XDG_BIN_HOME}" "\${HOME}/.cargo/bin" "$HOME/.npm-global/bin" "$HOME/.cache/.bun/bin"];
+
+  home.sessionPath = [
+    "\${XDG_BIN_HOME}"
+    "\${HOME}/.cargo/bin"
+    "$HOME/.npm-global/bin"
+    "$HOME/.cache/.bun/bin"
+  ];

  fonts.fontconfig.enable = true;

@@ -65,17 +64,11 @@
    settings = {
      font-family = "Fira Code";
      copy-on-select = true;
-
-      # Base colors from nix-colors
      foreground = "#${config.colorScheme.palette.base05}";
      background = "#${config.colorScheme.palette.base00}";
      selection-foreground = "#${config.colorScheme.palette.base07}";
      selection-background = "#${config.colorScheme.palette.base02}";
-
-      # Cursor
      cursor-color = "#${config.colorScheme.palette.base05}";
-
-      # Palette (16 colors)
      palette = [
        "0=#${config.colorScheme.palette.base01}"
        "1=#${config.colorScheme.palette.base08}"
@@ -106,50 +99,27 @@

  home.packages = with pkgs; [
    appimage-run
-    # blueberry
    bemoji
    brave
-    # brightnessctl
-    # clipman
    distrobox
+    eigent
+    (element-desktop.override {
+      commandLineArgs = "--password-store=gnome-libsecret";
+    })
    launch-webapp
-    # eww
-    # firefox-devedition
    file-roller
    hyprpanel
    seahorse
    sushi
-    # glib
-    # google-chrome
-    # gsettings-desktop-schemas
-    # graphviz
    ksnip
    msty-studio
    nwg-look
-    # pamixer
-    # pavucontrol
-    # libsForQt5.qtstyleplugins
-    # stable.nyxt
-    # pcmanfm
    rose-pine-hyprcursor
-    # qt5ct
-    # qt6.qtwayland
-    #rustdesk
-    # socat
-    # unrar
-    # unzip
-    # usbutils
-    # v4l-utils
    remmina
    slack
    telegram-desktop
    vivaldi
    vivaldi-ffmpeg-codecs
-    # wl-clipboard
-    # wlogout
-    # wtype
-    # xdg-utils
-    # ydotool
-    # zip
+    vibetyper
  ];
 }
--- a/home/desktop/theme/default.nix
+++ b/home/desktop/theme/default.nix
@@ -0,0 +1,8 @@
+# Theme aggregator — fonts, GTK/Qt theming, and wallpapers.
+{...}: {
+  imports = [
+    ./fonts.nix
+    ./theme.nix
+    ./wallpapers.nix
+  ];
+}
--- a/home/features/desktop/fonts.nix
+++ b/home/features/desktop/fonts.nix
@@ -1,3 +1,4 @@
+# Font packages — Fira Code, JetBrains Mono Nerd Font, and supporting icon fonts.
 {
  config,
  lib,
@@ -5,10 +6,9 @@
  ...
 }:
 with lib; let
-  cfg = config.features.desktop.fonts;
+  cfg = config.desktop.theme.fonts;
 in {
-  options.features.desktop.fonts.enable =
-    mkEnableOption "install additional fonts for desktop apps";
+  options.desktop.theme.fonts.enable = mkEnableOption "install desktop fonts";

  config = mkIf cfg.enable {
    home.packages = with pkgs; [
--- a/home/features/desktop/theme.nix
+++ b/home/features/desktop/theme.nix
@@ -1,11 +1,14 @@
+# GTK and Qt theming — Dracula theme with matching icons and cursor.
 {
  pkgs,
+  config,
  ...
 }: {
  qt = {
    enable = true;
    platformTheme.name = "gtk";
  };
+
  gtk = {
    enable = true;
    theme = {
@@ -16,5 +19,6 @@
      name = "Dracula";
      package = pkgs.dracula-icon-theme;
    };
+    gtk4.theme = config.gtk.theme;
  };
 }
--- a/home/desktop/theme/wallpapers.nix
+++ b/home/desktop/theme/wallpapers.nix
@@ -0,0 +1,19 @@
+# Wallpaper collection — copies wallpapers to Hyprland config directory.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.theme.wallpapers.enable;
+in {
+  options.desktop.theme.wallpapers.enable = mkEnableOption "wallpapers for Hyprland";
+
+  config = mkIf cfg {
+    xdg.configFile."hypr/wallpapers" = {
+      # Wallpapers are stored relative to the home/m3tam3re directory.
+      source = ../../m3tam3re/wallpapers;
+      recursive = true;
+    };
+  };
+}
--- a/home/desktop/wm/default.nix
+++ b/home/desktop/wm/default.nix
@@ -0,0 +1,8 @@
+# Window manager aggregator — Hyprland, Wayland tools, and Rofi launcher.
+{...}: {
+  imports = [
+    ./hyprland.nix
+    ./wayland.nix
+    ./rofi.nix
+  ];
+}
--- a/home/features/desktop/hyprland.nix
+++ b/home/features/desktop/hyprland.nix
@@ -1,13 +1,13 @@
+# Hyprland window manager with keybindings, window rules, idle/lock, and hyprpaper.
 {
  config,
  lib,
  ...
 }:
 with lib; let
-  cfg = config.features.desktop.hyprland;
+  cfg = config.desktop.wm.hyprland;
 in {
-  options.features.desktop.hyprland.enable =
-    mkEnableOption "Hyprland related stuff";
+  options.desktop.wm.hyprland.enable = mkEnableOption "Hyprland window manager";

  config = mkIf cfg.enable {
    wayland.windowManager.hyprland = {
@@ -19,8 +19,9 @@ in {
        exec-once = [
          "hyprpanel"
          "while ! hyprpaper-random; do sleep 0.5; done"
-          "wl-paste --type text --watch cliphist store" # Stores only text data
-          "wl-paste --type image --watch cliphist store" # Stores only image data "wl-paste -p -t text --watch clipman store -P --histpath=\"~/.local/share/clipman-primary.json\""
+          "wl-paste --type text --watch cliphist store"
+          "wl-paste --type image --watch cliphist store"
+          "vibetyper"
        ];

        env = [
@@ -31,6 +32,7 @@ in {
          "XDG_CURRENT_DESKTOP,Hyprland"
          "XDG_SESSION_TYPE,wayland"
          "XDG_SESSION_DESKTOP,Hyprland"
+          "XKB_DEFAULT_LAYOUT,de"
          "NIXOS_OZONE_WL,1"
        ];

@@ -47,7 +49,6 @@ in {
          gaps_in = 5;
          gaps_out = 5;
          border_size = 1;
-          # Keeping the existing active border as requested
          "col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
          "col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
          layout = "dwindle";
@@ -108,8 +109,8 @@ in {
            kb_layout = "us";
          }
        ];
+
        windowrule = [
-          # Floating dialogs
          "match:class file_progress, float on"
          "match:class confirm, float on"
          "match:class dialog, float on"
@@ -123,24 +124,19 @@ in {
          "match:class pavucontrol-qt, float on"
          "match:class pavucontrol, float on"
          "match:class class:^(espanso)$, float on"
-          # wlogout
          "match:class wlogout, fullscreen on"
          "match:title wlogout, float on"
          "match:title wlogout, fullscreen on"
-          # mpv
          "match:class mpv, float on"
          "match:class mpv, idle_inhibit focus"
          "match:class mpv, opacity 1.0 override"
-          # Media/Volume/PiP
          "match:title ^(Media viewer)$, float on"
          "match:title ^(Volume Control)$, float on"
          "match:title ^(Picture-in-Picture)$, float on"
-          # Pomodoro timer
          "match:title ^(floating-pomodoro)$, float on"
          "match:title ^(floating-pomodoro)$, size 250 50"
          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
          "match:title ^(floating-pomodoro)$, pin on"
-          # Streamlabs overlays
          "match:initial_title .*streamlabs.com.*, float on"
          "match:initial_title .*streamlabs.com.*, pin on"
          "match:initial_title .*streamlabs.com.*, size 800 400"
@@ -152,14 +148,15 @@ in {
          "match:initial_title .*streamlabs.com.*, decorate off"
          "match:initial_title .*streamlabs.com.*, no_shadow on"
          "match:initial_title .*streamlabs.com.*, no_blur on"
+          "match:class ^vibe-typer$, match:title ^Recording Indicator$, no_blur on"
          "border_color rgb(ffffff), match:xwayland 1"
        ];
+
        "$mainMod" = "SUPER";
        "$terminal" = "ghostty";

        bind = [
          "$mainMod, return, exec, $terminal nu -c zellij-ps"
-          # "$mainMod, t, exec, warp-terminal"
          "$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
          "$mainMod SHIFT, t, exec, launch-timer"
          "$mainMod, n, exec, $terminal -e nvim"
@@ -181,6 +178,7 @@ in {
          "$mainMod, P, exec, uwsm app -- rofi-pass"
          "$mainMod SHIFT, P, pseudo"
          "$mainMod, R, exec, stt-ptt start"
+          "$mainMod, S, exec, stt-ptt start"
          "$mainMod, J, togglesplit"
          "$mainMod, h, movefocus, l"
          "$mainMod, l, movefocus, r"
@@ -209,15 +207,19 @@ in {
          "$mainMod, mouse_down, workspace, e+1"
          "$mainMod, mouse_up, workspace, e-1"
        ];
+
        bindr = [
          "$mainMod, R, exec, stt-ptt stop"
+          "$mainMod, S, exec, stt-ptt format-stop"
        ];
+
        bindm = [
          "$mainMod, mouse:272, movewindow"
          "$mainMod, mouse:273, resizewindow"
        ];
      };
    };
+
    services.hypridle = {
      enable = true;
      settings = {
@@ -226,14 +228,13 @@ in {
          after_sleep_cmd = "hyprctl dispatch dpms on";
          inhibit_sleep = 3;
        };
-
        listener = [
          {
-            timeout = 300; # 5 min
+            timeout = 300;
            on-timeout = "hyprlock";
          }
          {
-            timeout = 420; # 5.5 min
+            timeout = 420;
            on-timeout = "hyprctl dispatch dpms off";
            on-resume = "hyprctl dispatch dpms on";
          }
--- a/home/features/desktop/rofi.nix
+++ b/home/features/desktop/rofi.nix
@@ -1,3 +1,4 @@
+# Rofi application launcher with nix-colors theme, pass integration, and project opener.
 {
  config,
  pkgs,
@@ -5,23 +6,23 @@
  ...
 }:
 with lib; let
-  cfg = config.features.desktop.rofi;
+  cfg = config.desktop.wm.rofi;
 in {
-  options.features.desktop.rofi.enable = mkEnableOption "enable rofi";
+  options.desktop.wm.rofi.enable = mkEnableOption "enable rofi";

  config = mkIf cfg.enable {
-    programs.rofi = with pkgs; {
+    programs.rofi = {
      enable = true;
-      package = rofi.override {
+      package = pkgs.rofi.override {
        plugins = [
-          rofi-calc
-          rofi-emoji
-          stable.rofi-file-browser
+          pkgs.rofi-calc
+          pkgs.rofi-emoji
+          pkgs.stable.rofi-file-browser
        ];
      };
      pass = {
        enable = true;
-        package = rofi-pass-wayland;
+        package = pkgs.rofi-pass-wayland;
      };
      terminal = "${pkgs.ghostty}/bin/ghostty";
      font = "Fira Code";
@@ -169,7 +170,6 @@ in {
            text-color: @background;
          }

-          /* Scrollbar */
          scrollbar {
            width: 4px;
            border: 0;
@@ -179,6 +179,7 @@ in {
          }
        '');
    };
+
    cli.rofi-project-opener = {
      enable = true;
      projectDirs = {
--- a/home/features/desktop/wayland.nix
+++ b/home/features/desktop/wayland.nix
@@ -1,3 +1,4 @@
+# Wayland extra tooling — screenshot, clipboard, cursor, and display utilities.
 {
  config,
  lib,
@@ -5,9 +6,9 @@
  ...
 }:
 with lib; let
-  cfg = config.features.desktop.wayland;
+  cfg = config.desktop.wm.wayland;
 in {
-  options.features.desktop.wayland.enable = mkEnableOption "wayland extra tools and config";
+  options.desktop.wm.wayland.enable = mkEnableOption "wayland extra tools and config";

  config = mkIf cfg.enable {
    home.packages = with pkgs; [
--- a/home/features/cli/AGENTS.md
+++ b/home/features/cli/AGENTS.md
@@ -1,65 +0,0 @@
-# CLI FEATURES (home-manager)
-
-**Shell and terminal tooling with Fish + Nushell dual configuration**
-
-## OVERVIEW
-8 CLI modules with integrated tooling across Fish and Nushell shells.
-
-## STRUCTURE
-```
-cli/
-├── default.nix      # Imports + shared tools (bat, eza, direnv)
-├── fish.nix         # Fish shell + aliases
-├── fzf.nix          # Fuzzy finder
-├── nitch.nix        # System info tool
-├── nushell.nix      # Nushell + aliases
-├── secrets.nix      # Password-store integration
-├── starship.nix     # Shell prompt
-└── zellij.nix       # Terminal multiplexer
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add CLI tool | default.nix home.packages | Check if shell integration needed |
-| Shell aliases | fish.nix or nushell.nix | Kept in sync between shells |
-| Prompt config | starship.nix | Uses nerd-fonts symbols |
-| Secret access | secrets.nix | Agenix integration |
-
-## CONVENTIONS
-
-### Shell Integration Pattern
-Tools with shell hooks enabled in both Fish and Nushell:
- **carapace**: Completions
- **zoxide**: Smart cd
- **eza**: ls replacement
- **direnv**: Directory environments
- **fzf**: Fuzzy finding
-
-### NixOS Rebuild Aliases (both shells)
-```
-nr/nrs    - nixos-rebuild [switch]
-snr/snrs  - sudo nixos-rebuild [switch]
-hms       - home-manager switch
-```
-
-### Bat Theme
-Custom `universal` theme generated from nix-colors palette in default.nix (lines 34-157).
-
-### Secrets Integration
-Fish/Nushell source `$HOME/.secrets` if `secrets.enable = true` (CLI secrets feature).
-
-## ANTI-PATTERNS
-
- **DON'T** add aliases to only one shell - keep Fish/Nushell in sync
- **DON'T** use `programs.bash` - Nushell is default shell
- **DON'T** bypass carapace for completions - integrated by default
-
-## NOTES
-
- zellij-ps custom package for project session management
- Default shell set to Nushell in hosts/common/default.nix
- Bat theme dynamically generated (no external theme files)
- lf file manager uses bat for previews
- Agenix CLI (agenix-cli) included for secret management
--- a/home/features/cli/default.nix
+++ b/home/features/cli/default.nix
@@ -1,239 +0,0 @@
-{
-  config,
-  pkgs,
-  videoDrivers,
-  ...
-}: {
-  imports = [
-    ./fish.nix
-    ./fzf.nix
-    ./nitch.nix
-    ./nushell.nix
-    ./secrets.nix
-    ./starship.nix
-    ./zellij.nix
-  ];
-  cli.stt-ptt = {
-    enable = true;
-    whisperPackage =
-      if videoDrivers == ["nvidia"]
-      then pkgs.whisper-cpp.override {cudaSupport = true;}
-      else if videoDrivers == ["amdgpu"]
-      then pkgs.whisper-cpp-vulkan
-      else pkgs.whisper-cpp;
-    model = "ggml-large-v3-turbo";
-    notifyTimeout = 2000;
-  };
-
-  programs.carapace = {
-    enable = true;
-    enableFishIntegration = true;
-    enableNushellIntegration = true;
-    enableBashIntegration = true;
-  };
-
-  programs.zoxide = {
-    enable = true;
-    enableFishIntegration = true;
-    enableNushellIntegration = true;
-  };
-
-  programs.bat = {
-    enable = true;
-    config = {theme = "universal";};
-    themes = {
-      universal = {
-        src = pkgs.writeText "universal.tmTheme" ''
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-            <key>name</key>
-            <string>Universal (nix-colors)</string>
-            <key>settings</key>
-            <array>
-              <dict>
-                <key>settings</key>
-                <dict>
-                  <key>background</key>
-                  <string>#${config.colorScheme.palette.base00}</string>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>caret</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>selection</key>
-                  <string>#${config.colorScheme.palette.base02}</string>
-                  <key>selectionForeground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                  <key>lineHighlight</key>
-                  <string>#${config.colorScheme.palette.base01}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Comment</string>
-                <key>scope</key>
-                <string>comment</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base03}</string>
-                  <key>fontStyle</key>
-                  <string>italic</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>String</string>
-                <key>scope</key>
-                <string>string</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0A}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Number</string>
-                <key>scope</key>
-                <string>constant.numeric</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0E}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Keyword</string>
-                <key>scope</key>
-                <string>keyword</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base08}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Function</string>
-                <key>scope</key>
-                <string>entity.name.function</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0B}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Type</string>
-                <key>scope</key>
-                <string>entity.name.type, storage.type</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0D}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Variable</string>
-                <key>scope</key>
-                <string>variable</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base05}</string>
-                </dict>
-              </dict>
-              <dict>
-                <key>name</key>
-                <string>Constant</string>
-                <key>scope</key>
-                <string>constant</string>
-                <key>settings</key>
-                <dict>
-                  <key>foreground</key>
-                  <string>#${config.colorScheme.palette.base0E}</string>
-                </dict>
-              </dict>
-            </array>
-          </dict>
-          </plist>
-        '';
-      };
-    };
-  };
-
-  programs.direnv = {
-    enable = true;
-    enableNushellIntegration = true;
-    nix-direnv.enable = true;
-  };
-
-  programs.eza = {
-    enable = true;
-    enableFishIntegration = true;
-    enableBashIntegration = true;
-    extraOptions = ["-l" "--icons" "--git" "-a"];
-  };
-
-  programs.lf = {
-    enable = true;
-    settings = {
-      preview = true;
-      drawbox = true;
-      hidden = true;
-      icons = true;
-      theme = "Dracula";
-      previewer = "bat";
-    };
-  };
-
-  cli.zellij-ps = {
-    enable = true;
-    projectFolders = ["/home/m3tam3re/p"];
-  };
-
-  home.packages = with pkgs; [
-    comma
-    coreutils
-    devenv
-    fabric-ai
-    fd
-    gcc
-    go
-    htop
-    httpie
-    hyprpaper-random
-    jq
-    just
-    lazygit
-    llm
-    lf
-    nix-index
-    nix-update
-    libnotify
-    nushellPlugins.skim
-    progress
-    ripgrep
-    rocmPackages.rocm-smi
-    rocmPackages.rocminfo
-    rocmPackages.rocm-runtime
-    sqlite
-    sqlite-vec
-    tldr
-    pomodoro-timer
-    trash-cli
-    unimatrix
-    unzip
-    vulkan-tools
-    wttrbar
-    wireguard-tools
-    yazi
-    zellij-ps
-    zip
-  ];
-}
--- a/home/features/cli/nitch.nix
+++ b/home/features/cli/nitch.nix
@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.nitch;
-in {
-  options.features.cli.nitch.enable = mkEnableOption "enable nitch";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [nitch];
-  };
-}
--- a/home/features/cli/nushell.nix
+++ b/home/features/cli/nushell.nix
@@ -1,182 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.nushell;
-in {
-  options.features.cli.nushell.enable = mkEnableOption "enable nushell";
-
-  config = mkIf cfg.enable {
-    programs.nushell = {
-      enable = true;
-      envFile.text = ''
-        $env.config.show_banner = false
-        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
-        $env.NIX_LOG = "iunfo"
-        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
-        $env.TERMINAL = "ghostty"
-        $env.EDITOR = "nvim"
-        $env.VISUAL = "zed"
-        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
-        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always --style=numbers --line-range=:500 {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy to clipboard' --bind 'ctrl-y:execute-silent(echo {} | wl-copy)' --color bg:#${config.colorScheme.palette.base00},bg+:#${config.colorScheme.palette.base02},fg:#${config.colorScheme.palette.base05},fg+:#${config.colorScheme.palette.base05},header:#${config.colorScheme.palette.base03},hl:#${config.colorScheme.palette.base0E},hl+:#${config.colorScheme.palette.base0E},info:#${config.colorScheme.palette.base09},marker:#${config.colorScheme.palette.base08},pointer:#${config.colorScheme.palette.base08},prompt:#${config.colorScheme.palette.base0B},spinner:#${config.colorScheme.palette.base09}"
-        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
-        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
-        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
-        $env.FLAKE = $"($env.HOME)/p/nixos/nixos-config"
-        $env.PATH = ($env.PATH | split row (char esep) | append "/home/m3tam3re/.cache/.bun/bin" | uniq)
-        source /run/agenix/${config.home.username}-secrets
-      '';
-      configFile.text = ''
-        # FZF integration functions for nushell
-        def fzf-file [] {
-          fd --type f --exclude .git --follow --hidden | fzf --preview 'bat --color=always --style=numbers --line-range=:500 {}' --bind 'ctrl-y:execute-silent(echo {} | wl-copy)'
-        }
-
-        def fzf-dir [] {
-          fd --type d --exclude .git --follow --hidden | fzf --preview 'ls -la {}'
-        }
-
-        def fzf-history [] {
-          history | get command | reverse | fzf --bind 'ctrl-y:execute-silent(echo {} | wl-copy)'
-        }
-
-        # Key bindings for FZF
-        $env.config = {
-          keybindings: [
-            {
-              name: fzf_file
-              modifier: control
-              keycode: char_t
-              mode: [emacs, vi_normal, vi_insert]
-              event: {
-                send: executehostcommand
-                cmd: "commandline edit --insert (fzf-file)"
-              }
-            }
-            {
-              name: fzf_history
-              modifier: control
-              keycode: char_r
-              mode: [emacs, vi_normal, vi_insert]
-              event: {
-                send: executehostcommand
-                cmd: "commandline edit --replace (fzf-history)"
-              }
-            }
-          ]
-        }
-
-        # Aliases
-        alias .. = cd ..
-        alias ... = cd ...
-        alias h = cd $env.HOME
-        alias b = yazi
-        alias lt = eza --tree --level=2 --long --icons --git
-        alias grep = rg
-        alias just = just --unstable
-        alias node = bun
-        alias npx = bunx
-
-        alias n = nix
-        alias nd = nix develop -c $nu.current-shell
-        alias ns = nix shell
-        alias nsn = nix shell nixpkgs#
-        alias nb = nix build
-        alias nbn = nix build nixpkgs#
-        alias nf = nix flake
-
-        alias nr = sudo nixos-rebuild --flake .
-        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
-        alias snr = sudo nixos-rebuild --flake .
-        alias snrs = sudo nixos-rebuild --flake . switch
-        alias hm = home-manager --flake .
-        alias hms = home-manager --flake . switch
-        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
-
-        alias tsu = sudo tailscale up
-        alias tsd = sudo tailscale down
-
-        alias vi = nvim
-        alias vim = nvim
-
-        def history_fuzzy [] {
-            let selected = (
-                history
-                | reverse
-                | get command
-                | uniq
-                | to text
-                | ^fzf
-            )
-            if ($selected | is-not-empty) {
-                commandline edit ($selected)
-            } else {
-                null
-            }
-        }
-        def --env dir_fuzzy [] {
-            let selected = (
-                fd --type directory
-                | ^fzf
-            )
-            cd $selected
-        }
-        def find_fuzzy [] {
-            # Find non-hidden text files with matches for any content and select one via fuzzy search
-            let selected = (
-                ^fd --type file --no-hidden -X rg -l --files-with-matches .
-                | lines
-                | to text
-                | ^fzf
-            )
-            if ($selected | is-not-empty) {
-                ^$env.EDITOR $selected
-            }
-        }
-
-        $env.config = {
-          keybindings: [
-            {
-              name: history_fuzzy
-              modifier: control
-              keycode: char_r
-              mode: [emacs, vi_insert, vi_normal]
-              event: [
-                {
-                  send: executehostcommand
-                  cmd: "history_fuzzy"
-                }
-              ]
-            }
-            {
-              name: dir_fuzzy
-              modifier: alt
-              keycode: char_c
-              mode: [emacs, vi_insert, vi_normal]
-              event: [
-                {
-                  send: executehostcommand
-                  cmd: "dir_fuzzy"
-                }
-              ]
-            }
-            {
-              name: history_fuzzy
-              modifier: control
-              keycode: char_t
-              mode: [emacs, vi_insert, vi_normal]
-              event: [
-                {
-                  send: executehostcommand
-                  cmd: "find_fuzzy"
-                }
-              ]
-            }
-          ]
-        }
-      '';
-    };
-  };
-}
--- a/home/features/cli/secrets.nix
+++ b/home/features/cli/secrets.nix
@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.cli.secrets;
-in {
-  options.features.cli.secrets.enable = mkEnableOption "enable secrets";
-
-  config = mkIf cfg.enable {
-    programs.password-store = {
-      enable = true;
-      package =
-        pkgs.pass-wayland.withExtensions
-        (exts: [exts.pass-otp exts.pass-import]);
-    };
-    home.packages = with pkgs; [pinentry-gnome3];
-  };
-}
--- a/home/features/coding/default.nix
+++ b/home/features/coding/default.nix
@@ -1,78 +0,0 @@
-{pkgs, videoDrivers, ...}: {
-  imports = [
-    ./opencode.nix
-  ];
-  programs.mcp = {
-    enable = true;
-    servers = {
-      Ref = {
-        command = "sh";
-        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
-      };
-      Anytype = {
-        command = "sh";
-        args = ["-c" "OPENAPI_MCP_HEADERS=$(cat /run/agenix/anytype-key) exec bunx @anyproto/anytype-mcp"];
-        disabled = true;
-      };
-      Basecamp = {
-        command = "/home/m3tam3re/p/AI/Basecamp-MCP-Server/venv/bin/python";
-        args = ["/home/m3tam3re/p/AI/Basecamp-MCP-Server/basecamp_fastmcp.py"];
-        env = {
-          PYTHONPATH = "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server";
-          VIRTUAL_ENV = "/home/m3tam3re/p/PYTHON/Basecamp-MCP-Server/venv";
-          BASECAMP_ACCOUNT_ID = "5996442";
-        };
-        disabled = true;
-      };
-      Exa = {
-        command = "sh";
-        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
-      };
-      Outline = {
-        command = "sh";
-        args = ["-c" "OUTLINE_API_KEY=$(cat /run/agenix/outline-key) OUTLINE_API_URL=https://wiki.az-gruppe.com/api OUTLINE_DISABLE_DELETE=true exec uv tool run mcp-outline"];
-        disabled = true;
-      };
-      ContextMode = {
-        command = "sh";
-        args = ["-c" "exec bunx context-mode@latest"];
-      };
-    };
-  };
-
-  home.packages = with pkgs; [
-    agenix-cli
-    alejandra
-    bc
-    bun
-    devpod
-    #devpod-desktop
-    code2prompt
-    gnumake
-    cmake
-    (python3.withPackages (ps:
-      with ps; [
-        pip
-        uv
-        # Scientific packages
-        numba
-        numpy
-        torch
-        srt
-      ]))
-    pyrefly
-    nixd
-    nodejs
-    opencode-desktop
-    (qmd.override {
-      vulkanSupport = videoDrivers == ["amdgpu"];
-      cudaSupport = videoDrivers == ["nvidia"];
-    })
-    pi
-    alejandra
-    sidecar
-    tailwindcss
-    tailwindcss-language-server
-    td
-  ];
-}
--- a/home/features/coding/opencode.nix
+++ b/home/features/coding/opencode.nix
@@ -1,119 +0,0 @@
-{inputs, ...}: {
-  xdg.configFile = {
-    "opencode/commands" = {
-      source = "${inputs.agents}/commands";
-      recursive = true;
-    };
-    "opencode/context" = {
-      source = "${inputs.agents}/context";
-      recursive = true;
-    };
-    "opencode/prompts" = {
-      source = "${inputs.agents}/prompts";
-      recursive = true;
-    };
-    "opencode/skills" = {
-      source = "${inputs.agents}/skills";
-      recursive = true;
-    };
-    "opencode/rules" = {
-      source = "${inputs.agents}/rules";
-      recursive = true;
-    };
-  };
-
-  programs.opencode = {
-    enable = true;
-    enableMcpIntegration = true;
-    settings = {
-      theme = "opencode";
-      plugin = ["oh-my-opencode" "opencode-antigravity-auth@beta"];
-      agent =
-        builtins.fromJSON
-        (builtins.readFile "${inputs.agents}/agents/agents.json");
-      formatter = {
-        alejandra = {
-          command = ["alejandra" "-q" "-"];
-          extensions = [".nix"];
-        };
-      };
-      provider = {
-        litellm = {
-          npm = "@ai-sdk/openai-compatible";
-          name = "LiteLLM (AZ-Gruppe)";
-          options.baseURL = "https://llm.az-gruppe.com/v1";
-          models = {
-            "gpt-5.2" = {
-              name = "GPT-5.2";
-              limit = {
-                context = 200000;
-                output = 16384;
-              };
-              modalities = {
-                input = ["text" "image"];
-                output = ["text"];
-              };
-            };
-            "claude-sonnet-4-6" = {
-              name = "Claude Sonnet 4.6";
-              limit = {
-                context = 200000;
-                output = 16000;
-              };
-              modalities = {
-                input = ["text" "image"];
-                output = ["text"];
-              };
-            };
-            "claude-opus-4-6" = {
-              name = "Claude Opus 4.6";
-              limit = {
-                context = 200000;
-                output = 32000;
-              };
-              modalities = {
-                input = ["text" "image"];
-                output = ["text"];
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-
-  home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON {
-    "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";
-    # google_auth removed - use opencode-antigravity-auth plugin instead (already in plugin array)
-    agents = {
-      sisyphus = {model = "zai-coding-plan/glm-5";};
-      oracle = {model = "zai-coding-plan/glm-5";};
-      librarian = {model = "zai-coding-plan/glm-5";};
-      explore = {model = "zai-coding-plan/glm-4.5-air";};
-      multimodal-looker = {model = "zai-coding-plan/glm-4.6v";};
-      prometheus = {model = "zai-coding-plan/glm-5";};
-      metis = {model = "zai-coding-plan/glm-5";};
-      momus = {model = "zai-coding-plan/glm-5";};
-      atlas = {model = "zai-coding-plan/glm-5";};
-    };
-    categories = {
-      visual-engineering = {model = "zai-coding-plan/glm-5";};
-      ultrabrain = {model = "zai-coding-plan/glm-5";};
-      artistry = {model = "zai-coding-plan/glm-5";};
-      quick = {model = "zai-coding-plan/glm-5";};
-      unspecified-low = {model = "zai-coding-plan/glm-5";};
-      unspecified-high = {model = "zai-coding-plan/glm-5";};
-      writing = {model = "zai-coding-plan/glm-5";};
-    };
-    disabled_mcps = ["context7" "websearch"];
-    disabled_hooks = ["comment-checker"];
-    git_master = {
-      commit_footer = false;
-      include_co_authored_by = false;
-    };
-    experimental = {
-      truncate_all_tool_outputs = true;
-      aggressive_truncation = false;
-    };
-  };
-}
--- a/home/features/desktop/AGENTS.md
+++ b/home/features/desktop/AGENTS.md
@@ -1,79 +0,0 @@
-# DESKTOP FEATURES (home-manager)
-
-**Wayland/Hyprland environment with color-coordinated tooling**
-
-## OVERVIEW
-12 modular desktop features with nix-colors (Dracula) integration across all components.
-
-## STRUCTURE
-```
-desktop/
-├── default.nix       # Imports + XDG + Kitty config
-├── coding.nix        # Development tools (VSCode, etc.)
-├── crypto.nix        # Crypto wallets/tools
-├── fonts.nix         # Font packages
-├── gaming.nix        # Gaming tools/Steam
-├── hyprland.nix      # Hyprland WM configuration
-├── media.nix         # Media players/editors
-├── office.nix        # LibreOffice, document tools
-├── rofi.nix          # Application launcher
-├── theme.nix         # GTK/Qt theming
-├── wayland.nix       # Wayland utilities
-└── webapps.nix       # Browser-based apps
-```
-
-## WHERE TO LOOK
-
-| Task | Location | Notes |
-|------|----------|-------|
-| Add desktop app | Relevant feature .nix | Update home.packages |
-| Configure Hyprland | hyprland.nix | Window manager settings |
-| Fix colors | Check colorScheme references | Uses config.colorScheme.palette.base* |
-| Add font | fonts.nix | Increases system closure size |
-
-## CONVENTIONS
-
-### Color Scheme Integration
-All color-aware tools reference `config.colorScheme.palette.base00` through `base0F`:
- **base00-07**: Grayscale (dark to light)
- **base08**: Red/errors
- **base09**: Orange
- **base0A**: Yellow/strings
- **base0B**: Green/functions
- **base0C**: Cyan
- **base0D**: Blue/types
- **base0E**: Purple/constants
- **base0F**: Brown
-
-Template:
-```nix
-foreground = "#${config.colorScheme.palette.base05}";
-background = "#${config.colorScheme.palette.base00}";
-```
-
-### Session Variables
-Set in default.nix for Wayland/Hyprland:
-```nix
-NIXOS_OZONE_WL = "1";
-QT_QPA_PLATFORM = "wayland";
-XDG_CURRENT_DESKTOP = "Hyprland";
-```
-
-### XDG Defaults
- **PDF**: okular
- **Text**: nvim
- **Browser**: Zen (io.github.zen_browser.zen)
- **Archive**: file-roller
-
-## ANTI-PATTERNS
-
- **DON'T** hardcode hex colors - use colorScheme palette
- **DON'T** install fonts globally - keep in user packages
- **DON'T** bypass XDG defaults - set in mimeApps
-
-## NOTES
-
- Kitty terminal configured in default.nix (not separate file)
- Bibata-Modern-Ice cursor theme hardcoded
- Session path includes cargo, npm-global, bun
- Desktop features are always-enabled (no feature flags in this dir)
--- a/home/features/desktop/coding.nix
+++ b/home/features/desktop/coding.nix
@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.coding;
-in {
-  options.features.desktop.coding.enable =
-    mkEnableOption "install coding related stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      bruno
-      insomnia
-    ];
-    coding.editors = {
-      neovim.enable = true;
-      zed.enable = true;
-    };
-  };
-}
--- a/home/features/desktop/crypto.nix
+++ b/home/features/desktop/crypto.nix
@@ -1,15 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.crypto;
-in {
-  options.features.desktop.crypto.enable = mkEnableOption "Enable Crypto";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
-  };
-}
--- a/home/features/desktop/gaming.nix
+++ b/home/features/desktop/gaming.nix
@@ -1,22 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.gaming;
-in {
-  options.features.desktop.gaming.enable =
-    mkEnableOption "install gaming related stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      gamescope
-      gamemode
-      goverlay
-      mangohud
-      protonplus
-    ];
-  };
-}
--- a/home/features/desktop/media.nix
+++ b/home/features/desktop/media.nix
@@ -1,55 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.media;
-in {
-  options.features.desktop.media.enable =
-    mkEnableOption "enable media features";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      # handbrake
-      # kdePackages.kdenlive
-      # makemkv
-      # mediainfo
-      amf
-      ffmpeg_6-full
-      gimp
-      gst_all_1.gstreamer
-      gst_all_1.gst-vaapi
-      handbrake
-      inkscape
-      kdePackages.kdenlive
-      libation
-      #makemkv
-      pamixer
-      pavucontrol
-      qpwgraph
-      v4l-utils
-      plexamp
-      # uxplay
-      # vlc
-      webcord
-      # yt-dlp
-      unimatrix
-    ];
-
-    programs = {
-      mpv = {
-        enable = true;
-        bindings = {
-          WHEEL_UP = "seek 10";
-          WHEEL_DOWN = "seek -10";
-        };
-        config = {
-          profile = "gpu-hq";
-          ytdl-format = "bestvideo+bestaudio";
-        };
-      };
-    };
-  };
-}
--- a/home/features/desktop/office.nix
+++ b/home/features/desktop/office.nix
@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.office;
-in {
-  options.features.desktop.office.enable =
-    mkEnableOption "install office and paperwork stuff";
-
-  config = mkIf cfg.enable {
-    home.packages = with pkgs; [
-      libreoffice-fresh
-    ];
-  };
-}
--- a/home/features/desktop/wallpapers.nix
+++ b/home/features/desktop/wallpapers.nix
@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-with lib; let
-  cfg = config.features.desktop.wallpapers;
-in {
-  options.features.desktop.wallpapers = mkEnableOption "Wallpapers for Hyprland";
-
-  config = mkIf cfg {
-    xdg.configFile."hypr/wallpapers" = {
-      source = ../../m3tam3re/wallpapers;
-      recursive = true;
-    };
-  };
-}
--- a/home/lib/default.nix
+++ b/home/lib/default.nix
@@ -0,0 +1,95 @@
+# home/lib/default.nix
+# Profile loading utilities for home-manager configurations.
+#
+# Usage:
+#   let homeLib = import ../lib { inherit lib; };
+#   in {
+#     imports = [
+#       (homeLib.mkHomeConfig { profiles = ["coding" "gaming"]; context = "desktop"; })
+#     ];
+#   }
+{lib}: let
+  # Infrastructure layer — nixpkgs overlays, nix-colors, m3ta-nixpkgs modules.
+  # Always loaded on every host.
+  commonModule = ../common;
+
+  # Base user environment — shell (nushell, starship), CLI tools, secrets.
+  # Always loaded on every host.
+  baseModule = ../base;
+
+  # Context-specific modules — desktop and server are mutually exclusive.
+  contextModuleMap = {
+    desktop = ../desktop;
+    server = ../server;
+  };
+
+  # Profile modules — freely combinable additions on top of base + context.
+  profileModuleMap = {
+    coding = ../coding;
+    gaming = ../profiles/gaming;
+    media = ../profiles/media;
+  };
+in {
+  # Generate a home-manager module with imports based on profiles and context.
+  #
+  # Args:
+  #   profiles: list of profile names (e.g. ["coding" "gaming" "media"])
+  #   context: host context, one of "desktop" | "server" | null
+  #
+  # Returns: a home-manager module attrset with imports and assertions.
+  #   Desktop and server contexts are mutually exclusive by design — passing
+  #   any value other than "desktop", "server", or null causes an assertion
+  #   failure at evaluation time.
+  mkHomeConfig = {
+    profiles ? [],
+    context ? null,
+  }: let
+    contextImport =
+      if context == "desktop"
+      then [contextModuleMap.desktop]
+      else if context == "server"
+      then [contextModuleMap.server]
+      else [];
+
+    # Partition profiles into known and unknown for assertion + safe import.
+    unknownProfiles =
+      builtins.filter
+      (profileName: ! builtins.hasAttr profileName profileModuleMap)
+      profiles;
+
+    # Only import known profiles; the assertion below catches unknowns.
+    activeProfiles =
+      builtins.filter
+      (profileName: builtins.hasAttr profileName profileModuleMap)
+      profiles;
+
+    profileImports = map (profileName: profileModuleMap.${profileName}) activeProfiles;
+
+    contextStr =
+      if context == null
+      then "null"
+      else context;
+  in {
+    imports =
+      [commonModule baseModule]
+      ++ contextImport
+      ++ profileImports;
+
+    assertions = [
+      {
+        assertion = builtins.elem context ["desktop" "server" null];
+        message =
+          "m3ta home: context must be 'desktop', 'server', or null"
+          + " (got: '${contextStr}')";
+      }
+      {
+        assertion = unknownProfiles == [];
+        message =
+          "m3ta home: unknown profiles requested:"
+          + " [ ${builtins.concatStringsSep " " unknownProfiles} ]."
+          + " Valid profiles are:"
+          + " [ ${builtins.concatStringsSep " " (builtins.attrNames profileModuleMap)} ]";
+      }
+    ];
+  };
+}
--- a/home/m3tam3re/home-server.nix
+++ b/home/m3tam3re/home-server.nix
@@ -19,7 +19,7 @@
  # You should not change this value, even if you update Home Manager. If you do
  # want to update the value, then make sure to first check the Home Manager
  # release notes.
-  home.stateVersion = "24.11"; # Please read the comment before changing.
+  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.

  # The home.packages option allows you to install Nix packages into your
  # environment.
@@ -81,6 +81,7 @@

  programs.git = {
    enable = true;
+    signing.format = null;
    settings = {
      user = {
        name = "m3tm3re";
--- a/home/m3tam3re/home.nix
+++ b/home/m3tam3re/home.nix
@@ -19,7 +19,7 @@
  # You should not change this value, even if you update Home Manager. If you do
  # want to update the value, then make sure to first check the Home Manager
  # release notes.
-  home.stateVersion = "24.11"; # Please read the comment before changing.
+  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.

  # The home.packages option allows you to install Nix packages into your
  # environment.
@@ -87,6 +87,7 @@

  programs.git = {
    enable = true;
+    signing.format = null;
    settings = {
      user = {
        name = "m3tm3re";
@@ -123,6 +124,12 @@
        port = 2022;
        identityFile = "~/.ssh/sascha.koenig";
      };
+      "AZ-PRM-1" = {
+        hostname = "192.168.152.76";
+        user = "sascha.koenig";
+        port = 2022;
+        identityFile = "~/.ssh/sascha.koenig";
+      };
      "github.com" = {
        hostname = "github.com";
        user = "m3tam3re";
@@ -195,6 +202,11 @@
        user = "m3tam3re";
        identityFile = "~/.ssh/m3tam3re";
      };
+      "m3-hermes" = {
+        hostname = "204.168.229.93";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
      "m3-zelda" = {
        hostname = "95.217.189.186";
        user = "m3tam3re";
--- a/home/m3tam3re/m3-aether.nix
+++ b/home/m3tam3re/m3-aether.nix
@@ -1,17 +1,25 @@
-{
+# m3-aether — cloud VM.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
  imports = [
-    ../common
-    ../features/cli
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
    ./home-server.nix
  ];

-  features = {
-    cli = {
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
      fzf.enable = true;
      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
    };
  };
 }
--- a/home/m3tam3re/m3-ares.nix
+++ b/home/m3tam3re/m3-ares.nix
@@ -1,97 +1,142 @@
+# m3-ares — TUXEDO laptop desktop workstation.
+# Context: desktop | Profiles: coding, gaming, media
 {
  config,
  lib,
  ...
-}:
-with lib; {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-  ];
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "gaming" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];

-  config = mkMerge [
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            fish.enable = true;
+            nushell.enable = true;
+            starship.enable = true;
          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
          };
-        };
-      };
-      features = {
-        cli = {
-          fish.enable = true;
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
          secrets.enable = true;
-          starship.enable = true;
        };
-        desktop = {
-          coding.enable = true;
-          crypto.enable = true;
-          gaming.enable = true;
-          hyprland.enable = true;
-          media.enable = true;
-          obsidian.enable = true;
-          office.enable = true;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = true;
-          wallpapers = true;
-        };
-      };
-    }

-    (mkIf config.features.desktop.hyprland.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          exec-once = ["tuxedo-backlight"];
-          monitor = [
-            "eDP-1,preferred,0x0,1.25"
-            "HDMI-A-1,1920x1080@120,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:eDP-1, default:true"
-            "2, monitor:eDP-1"
-            "3, monitor:eDP-1"
-            "4, monitor:HDMI-A-1,"
-            "5, monitor:HDMI-A-1,border:false,rounding:false"
-            "6, monitor:HDMI-A-1"
-          ];
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, fullscreen on"
-            "match:class ^steam_app_\\d+$, workspace 5"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
+        # Desktop features (new namespace)
+        desktop = {
+          wm = {
+            hyprland.enable = true;
+            rofi.enable = true;
+            wayland.enable = true;
+          };
+          apps = {
+            crypto.enable = true;
+            obsidian.enable = true;
+            office.enable = true;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = true;
+          };
        };
-      };
-    })
-  ];
-}
+
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+          packages.enable = true;
+          languages = {
+            python.enable = true;
+            javascript.enable = true;
+            rustToolchain.enable = true;
+            go.enable = true;
+            typescript.enable = true;
+          };
+        };
+
+        # Gaming profile features
+        profiles.gaming = {
+          steam.enable = true;
+          gamescope.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = true;
+          ffmpeg.enable = true;
+          kdenlive.enable = true;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland monitor and workspace layout
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            exec-once = ["tuxedo-backlight"];
+            monitor = [
+              "eDP-1,preferred,0x0,1.25"
+              "HDMI-A-1,1920x1080@120,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:eDP-1, default:true"
+              "2, monitor:eDP-1"
+              "3, monitor:eDP-1"
+              "4, monitor:HDMI-A-1,"
+              "5, monitor:HDMI-A-1,border:false,rounding:false"
+              "6, monitor:HDMI-A-1"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, fullscreen on"
+              "match:class ^steam_app_\\d+$, workspace 5"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }
--- a/home/m3tam3re/m3-atlas.nix
+++ b/home/m3tam3re/m3-atlas.nix
@@ -1,19 +1,29 @@
-{
+# m3-atlas — primary server, Traefik hub and container host.
+# Context: server | Profiles: coding
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
  imports = [
-    ../common
-    ../features/cli
-    ../features/coding/opencode.nix
+    (homeLib.mkHomeConfig {
+      profiles = ["coding"];
+      context = "server";
+    })
    ./home-server.nix
  ];
-  coding.editors.neovim.enable = true;
-  features = {
-    cli = {
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
      nushell.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
      fzf.enable = true;
      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
      zellij.enable = true;
    };
  };
+
+  # Coding environment
+  coding.editors.neovim.enable = true;
 }
--- a/home/m3tam3re/m3-daedalus.nix
+++ b/home/m3tam3re/m3-daedalus.nix
@@ -1,101 +1,127 @@
+# m3-daedalus — portable laptop (standalone home-manager).
+# Context: desktop | Profiles: coding, media
 {
  config,
  lib,
  ...
-}:
-with lib; let
-  cfg = config.features.desktop.hyprland;
-in {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-    #./services/librechat.nix
-  ];
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];

-  options.features.desktop.hyprland.enable =
-    mkEnableOption "enable Hyprland";
-
-  config = mkMerge [
-    # Base configuration
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            fish.enable = true;
+            nushell.enable = true;
+            starship.enable = true;
          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
          };
-        };
-      };
-      features = {
-        cli = {
-          fish.enable = true;
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
          secrets.enable = true;
-          starship.enable = true;
        };
-        desktop = {
-          coding.enable = true;
-          crypto.enable = false;
-          gaming.enable = false;
-          hyprland.enable = false;
-          media.enable = true;
-          office.enable = false;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = false;
-        };
-      };
-    }

-    (mkIf cfg.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          monitor = [
-            "eDP-1,preferred,0x0,1.25"
-            "HDMI-A-1,preferred,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:eDP-1, default:true"
-            "2, monitor:eDP-1"
-            "3, monitor:eDP-1"
-            "4, monitor:HDMI-A-1"
-            "5, monitor:HDMI-A-1,border:false,rounding:false"
-            "6, monitor:HDMI-A-1"
-          ];
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, fullscreen on"
-            "match:class ^steam_app_\\d+$, workspace 5"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
+        # Desktop features (new namespace)
+        desktop = {
+          wm = {
+            hyprland.enable = false;
+            rofi.enable = true;
+            wayland.enable = false;
+          };
+          apps = {
+            obsidian.enable = true;
+            office.enable = false;
+            crypto.enable = false;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = false;
+          };
        };
-      };
-    })
-  ];
-}
+
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = false;
+          ffmpeg.enable = false;
+          kdenlive.enable = false;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland layout — only applies when hyprland is enabled
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            monitor = [
+              "eDP-1,preferred,0x0,1.25"
+              "HDMI-A-1,preferred,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:eDP-1, default:true"
+              "2, monitor:eDP-1"
+              "3, monitor:eDP-1"
+              "4, monitor:HDMI-A-1"
+              "5, monitor:HDMI-A-1,border:false,rounding:false"
+              "6, monitor:HDMI-A-1"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, fullscreen on"
+              "match:class ^steam_app_\\d+$, workspace 5"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }
--- a/home/m3tam3re/m3-helios.nix
+++ b/home/m3tam3re/m3-helios.nix
@@ -1,17 +1,25 @@
-{
+# m3-helios — AdGuard DNS and internal routing server.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
  imports = [
-    ../common
-    ../features/cli
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
    ./home-server.nix
  ];

-  features = {
-    cli = {
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
      fzf.enable = true;
      nitch.enable = true;
-      secrets.enable = false;
-      starship.enable = true;
    };
  };
 }
--- a/home/m3tam3re/m3-hermes.nix
+++ b/home/m3tam3re/m3-hermes.nix
@@ -0,0 +1,25 @@
+# m3-hermes — secondary server.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
+  imports = [
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
+    ./home-server.nix
+  ];
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
+      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
+      fzf.enable = true;
+      nitch.enable = true;
+    };
+  };
+}
--- a/home/m3tam3re/m3-kratos.nix
+++ b/home/m3tam3re/m3-kratos.nix
@@ -1,95 +1,138 @@
+# m3-kratos — AMD desktop workstation.
+# Context: desktop | Profiles: coding, gaming, media
 {
  config,
  lib,
  ...
-}:
-with lib; {
-  imports = [
-    ../common
-    ./home.nix
-    ../features/cli
-    ../features/coding
-    ../features/desktop
-  ];
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "gaming" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];

-  config = mkMerge [
-    {
-      xdg = {
-        # TODO: better structure
-        enable = true;
-        configFile."mimeapps.list".force = true;
-        mimeApps = {
-          enable = true;
-          associations.added = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            nushell.enable = true;
+            starship.enable = true;
          };
-          defaultApplications = {
-            "application/zip" = ["org.gnome.FileRoller.desktop"];
-            "application/csv" = ["calc.desktop"];
-            "application/pdf" = ["vivaldi-stable.desktop"];
-            "application/md" = ["dev.zed.Zed.desktop"];
-            "application/text" = ["dev.zed.Zed.desktop"];
-            "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
-            "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
          };
-        };
-      };
-      features = {
-        cli = {
-          nushell.enable = true;
-          fzf.enable = true;
-          nitch.enable = true;
          secrets.enable = true;
-          starship.enable = true;
        };
+
+        # Desktop features (new namespace)
        desktop = {
-          crypto.enable = true;
-          coding.enable = true;
-          gaming.enable = true;
-          hyprland.enable = true;
-          media.enable = true;
-          obsidian.enable = true;
-          office.enable = true;
-          rofi.enable = true;
-          fonts.enable = true;
-          wayland.enable = true;
-          wallpapers = true;
+          wm = {
+            hyprland.enable = true;
+            rofi.enable = true;
+            wayland.enable = true;
+          };
+          apps = {
+            crypto.enable = true;
+            obsidian.enable = true;
+            office.enable = true;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = true;
+          };
        };
-      };
-    }

-    (mkIf config.features.desktop.hyprland.enable {
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = {
-          monitor = [
-            "DP-1,2560x1440@144,0x0,1"
-            "DP-2,2560x1440@144,2560x0,1"
-          ];
-          workspace = [
-            "1, monitor:DP-1, default:true"
-            "2, monitor:DP-1"
-            "3, monitor:DP-1"
-            "4, monitor:DP-2"
-            "5, monitor:DP-2"
-            "6, monitor:DP-2"
-            "7, monitor:DP-2"
-          ];
-
-          windowrule = [
-            "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
-            "match:class ^(com.obsproject.Studio)$, workspace 2"
-            "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
-            "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
-            "match:class ^steam_app_\\d+$, idle_inhibit focus"
-          ];
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+          languages = {
+            python.enable = true;
+            javascript.enable = true;
+            rustToolchain.enable = true;
+            go.enable = true;
+            typescript.enable = true;
+          };
        };
-      };
-    })
-  ];
-}
+
+        # Gaming profile features
+        profiles.gaming = {
+          steam.enable = true;
+          gamescope.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = true;
+          ffmpeg.enable = true;
+          kdenlive.enable = true;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland monitor and workspace layout (dual 1440p monitors)
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            monitor = [
+              "DP-1,2560x1440@144,0x0,1"
+              "DP-2,2560x1440@144,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:DP-1, default:true"
+              "2, monitor:DP-1"
+              "3, monitor:DP-1"
+              "4, monitor:DP-2"
+              "5, monitor:DP-2"
+              "6, monitor:DP-2"
+              "7, monitor:DP-2"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }
--- a/home/profiles/gaming/default.nix
+++ b/home/profiles/gaming/default.nix
@@ -0,0 +1,8 @@
+# Gaming profile aggregator — Steam platform, Gamescope session, and AMD GPU tools.
+{...}: {
+  imports = [
+    ./steam.nix
+    ./gamescope.nix
+    ./gpu.nix
+  ];
+}
--- a/home/profiles/gaming/gamescope.nix
+++ b/home/profiles/gaming/gamescope.nix
@@ -0,0 +1,16 @@
+# Gamescope — Valve's micro-compositor for Steam gaming sessions.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.gamescope;
+in {
+  options.profiles.gaming.gamescope.enable = mkEnableOption "enable Gamescope session";
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.gamescope];
+  };
+}
--- a/home/profiles/gaming/gpu.nix
+++ b/home/profiles/gaming/gpu.nix
@@ -0,0 +1,21 @@
+# AMD GPU tools — ROCm runtime, monitoring, and Vulkan utilities for gaming.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.gpu;
+in {
+  options.profiles.gaming.gpu.enable = mkEnableOption "enable AMD GPU tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      rocmPackages.rocm-runtime
+      rocmPackages.rocm-smi
+      rocmPackages.rocminfo
+      vulkan-tools
+    ];
+  };
+}
--- a/home/profiles/gaming/steam.nix
+++ b/home/profiles/gaming/steam.nix
@@ -0,0 +1,21 @@
+# Steam gaming platform with Steam Deck compatibility tools and gaming utilities.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.steam;
+in {
+  options.profiles.gaming.steam.enable = mkEnableOption "enable Steam gaming";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      gamemode
+      goverlay
+      mangohud
+      protonplus
+    ];
+  };
+}
--- a/home/profiles/media/default.nix
+++ b/home/profiles/media/default.nix
@@ -0,0 +1,10 @@
+# Media profile aggregator — OBS, FFmpeg, yt-dlp, Kdenlive, and HandBrake.
+{...}: {
+  imports = [
+    ./obs.nix
+    ./ffmpeg.nix
+    ./yt-dlp.nix
+    ./kdenlive.nix
+    ./handbrake.nix
+  ];
+}
--- a/home/profiles/media/ffmpeg.nix
+++ b/home/profiles/media/ffmpeg.nix
@@ -0,0 +1,24 @@
+# FFmpeg — full-featured multimedia processing toolchain.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.ffmpeg;
+in {
+  options.profiles.media.ffmpeg.enable = mkEnableOption "enable FFmpeg tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      amf
+      ffmpeg_6-full
+      gst_all_1.gstreamer
+      gst_all_1.gst-vaapi
+      pamixer
+      pavucontrol
+      qpwgraph
+    ];
+  };
+}
--- a/home/profiles/media/handbrake.nix
+++ b/home/profiles/media/handbrake.nix
@@ -0,0 +1,21 @@
+# HandBrake — open-source video transcoder.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.handbrake;
+in {
+  options.profiles.media.handbrake.enable = mkEnableOption "enable HandBrake transcoder";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      handbrake
+      gimp
+      inkscape
+      libation
+    ];
+  };
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
m3ta-chiron	2078d6bccd	docs: update AGENTS.md for m3ta-home integration, work identity, new structure	2026-05-02 10:54:42 +02:00
m3ta-chiron	5cbb975c78	feat: complete host home.nix files + add m3-daedalus, clean up m3tam3re.nix - hosts/m3-kratos/home.nix: XDG/MIME defaults + dual DP Hyprland monitors - hosts/m3-ares/home.nix: XDG/MIME defaults + eDP+HDMI Hyprland monitors - hosts/m3-daedalus/home.nix: XDG/MIME defaults (no Hyprland) - hosts/common/users/m3tam3re.nix: refactored hostFlags into let binding, added m3-daedalus profile (desktop/coding+media, no gaming/Hyprland)	2026-05-02 10:41:12 +02:00
m3ta-chiron	f2ecd13780	fix: set home-manager.useGlobalPkgs=true for m3ta-nixpkgs overlays	2026-05-02 10:08:50 +02:00
m3ta-chiron	ab1bdc9848	feat: integrate m3ta-home for centralized user profiles	2026-05-02 09:53:27 +02:00
m3tam3re	1692a34f6e	Merge pull request 'feat: enable orchestrator + switch TTS to Edge (Katja voice)' (#8 ) from feature/orchestrator-edge-tts into master Reviewed-on: #8	2026-05-01 16:15:13 +02:00
m3ta-chiron	2403e54039	feat: enable orchestrator + switch TTS to Edge (Seraphina voice) - Enable delegation.orchestrator_enabled with max_spawn_depth=2 - Switch TTS from ElevenLabs (paid) to Edge TTS (free) - Voice: de-DE-SeraphinaMultilingualNeural — friendly, multilingual German female - No API key required	2026-05-01 16:06:49 +02:00
m3tm3re	3e8c95944c	chore: hermes update	2026-05-01 12:06:23 +02:00
m3ta-chiron	fbc555feeb	feat: pi guardrails	2026-04-29 20:14:07 +02:00
m3ta-chiron	6a5d8f0011	feat(agents): add strict security hardening for Pi and OpenCode Pi Guardrails: - Enables @aliou/pi-guardrails with strict default config - Sets onboarding.completed = true to skip onboarding prompt - Enables pathAccess in ask mode for /nix/store and /tmp - Adds noAccess policies for: SSH keys, GPG keys, AWS config, Kubernetes config, cloud CLI configs (gh/gcloud/1password/sops), agenix secrets, Pi auth/sessions, env files, private keys/certs - Adds auto-deny patterns for env leakage commands: env, printenv, /proc/*/environ, GPG secret exports, ssh-add -D, password manager reads OpenCode permissions: - Adds permission section with global security rules - external_directory: ask by default, allow /nix/store and /tmp - read/edit: allow by default, deny SSH/GPG/AWS/Kube/cloud configs, agenix secrets, Pi auth/sessions, env files, private keys/certs - glob: restrict sensitive path patterns - grep: deny SSH/GPG/agenix, ask for PASSWORD/SECRET/API_KEY/PRIVATE_KEY - bash: ask by default, allow safe git/nix commands, deny env/printenv/proc/GPG secret/sudo/ssh-add deletion/curl\|sh - webfetch: ask by default, allow github/nixos search - doom_loop: ask	2026-04-29 19:48:29 +02:00
m3tam3re	9c3d10836f	Merge pull request 'fix: add uv to hermes-agent service PATH' (#7 ) from fix/hermes-agent-uv-path into master Reviewed-on: #7	2026-04-29 16:24:17 +02:00
m3ta-chiron	a615ab61e8	fix: add uv to hermes-agent service PATH Add pkgs.uv to systemd.services.hermes-agent.path so that CronJobs and terminal sessions can execute PEP 723 scripts via 'uv run' (e.g. garmin-daily.py for Garmin Connect health data). Also adds uv to environment.systemPackages for general availability.	2026-04-29 16:18:41 +02:00
m3ta-chiron	193b8c0115	fix(git-identity): use existing gitea SSH key for agent commits The m3ta-chiron SSH key was not accepted by Gitea. Using the existing gitea key instead for push authentication.	2026-04-27 19:52:11 +02:00
m3tm3re	f76c4dd5d4	chore: smlink pip to uv pip	2026-04-27 19:36:52 +02:00
m3tm3re	05dc6bf608	chore: smlink pip to uv pip	2026-04-27 19:07:26 +02:00
m3tam3re	d524864fc3	Merge pull request 'feature/agent-git-identity' (#6 ) from feature/agent-git-identity into master Reviewed-on: #6	2026-04-27 17:55:06 +02:00
m3tm3re	09e2ba8538	chore: AGENTS + nixpkgs input urls	2026-04-27 17:53:08 +02:00
m3tm3re	a427f319d4	feat(agents): add gitIdentity config and git-identity rule - coding.agents.gitIdentity enabled with m3ta-chiron identity - coding.agents.pi.codingRules.concerns includes 'git-identity' - Uses feature/agent-git-identity branches for m3ta-nixpkgs and agents	2026-04-27 13:24:34 +02:00
m3tm3re	936eb13794	feat: add global skills to hermes environment	2026-04-26 15:14:54 +02:00
m3tm3re	5b0e6cbd5d	feat(hermes-agent): add copy-hermes-skills systemd service	2026-04-26 14:37:43 +02:00
m3tm3re	2302810d11	chore: update beads issue state and gitignore docs/plans	2026-04-26 14:35:38 +02:00
m3tm3re	25ac47a422	feat(hermes-agent): add mkOpencodeSkills integration for skills provisioning - Add inputs parameter to module signature for flake input access - Define hermesSkills via inputs.agents.lib.mkOpencodeSkills - Includes customSkills from agents flake and external skills: - skills-basecamp (basecamp/basecamp-cli) - skills-anthropic (anthropics/skills) - skills-kestra (kestra-io/agent-skills) - Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors)	2026-04-26 14:35:06 +02:00
m3tm3re	e6cfcc346b	docs(agents): expand Beads workflow documentation - Add 6-step core workflow with examples - Document slash commands for agent integration - Add 'Why Beads?' section emphasizing persistence - Note to avoid bd edit in agent contexts - Include dependency linking examples	2026-04-26 14:12:30 +02:00
m3tm3re	09bc9da6d9	chore: complete AGENTS.md documentation - Add comprehensive project documentation to AGENTS.md - Remove stale docs from docs/ directory - Update agent configs (agents.nix, pi.nix) - Update python.nix language config - Update .gitignore	2026-04-26 14:10:54 +02:00
m3tm3re	eb06533174	Merge feature/home-profile-restructuring: home-manager profile refactoring Refactor home-manager configuration structure: - Reorganize from features/ to base/coding/desktop/server/profiles/ - Add language runtime modules (go, js, python, rust, typescript) - Add LSP server configuration - Add gaming and media profiles - Add shell modules (fish, nushell, starship) - Consolidate editor and git configuration	2026-04-26 13:53:00 +02:00
m3tm3re	0d81b0e5e9	chore: add beads issue tracker configuration	2026-04-26 13:49:23 +02:00
m3tm3re	0ea8b8d2eb	feat(home): extract CLI tools into modular home/base structure - Add individual modules for: bat, carapace, direnv, eza, fzf, lf, nitch, television, zellij, zellij-ps, zoxide - Centralize in home/base/cli-tools/ with default.nix aggregator - Simplify home/base/packages by removing extracted tools	2026-04-26 13:49:17 +02:00
m3tm3re	30a9a23de2	refactor: add language runtimes module and cleanup agent config - Add home/coding/languages/ with Python, JavaScript, Rust, Go, TypeScript - Move bun/nodejs from agents.nix to languages/javascript.nix - Move python3 with packages to languages/python.nix - Move npm config to javascript.nix (broader context) - Add language options to m3-ares and m3-kratos host configs - Move pyrefly from agents.nix to lsp/servers.nix - Remove duplicate python3 reference (build conflict fix) - Remove unused base/secrets/cli-tools/ duplicates	2026-04-26 13:20:22 +02:00
m3tm3re	6d0149ee6e	feat: add AMD GPU tools, media packages, and productivity module Task 3 - Gaming profile: - Add gpu.nix with ROCm runtime/smi/info and vulkan-tools - Import gpu.nix in gaming profile aggregator Task 4 - Media profile: - Add unimatrix to yt-dlp.nix packages - (plexamp, webcord, mpv config were already present) Task 5 - Desktop apps: - Add productivity.nix with pomodoro-timer - Import productivity.nix in desktop apps aggregator	2026-04-26 12:32:47 +02:00
m3tm3re	d19b87f8cd	feat: add coding packages module (bruno, insomnia)	2026-04-26 12:29:14 +02:00
m3tm3re	8f5d076d7b	fix: make base modules enabled by default; document lazylib→lazygit - All base/* modules now use (mkEnableOption "...") // { default = true; } so they activate automatically when imported — no explicit .enable = true required in host configs - packages.nix: add comment documenting that lazylib does not exist in nixpkgs; lazygit is the correct and intended package - zellij-ps.nix: clarify that cli.zellij-ps namespace is intentional — it is the home-manager module convention from m3ta-nixpkgs - nix flake check passes (warnings are pre-existing)	2026-04-26 12:16:44 +02:00
m3tm3re	3c9a107608	feat: add missing packages and programs to base cli-tools - packages.nix: essential packages (jq, ripgrep, fd, htop, coreutils, lazygit, httpie, just, devenv, gcc, go, sqlite, sqlite-vec, nix-index, nix-update, progress, comma, fabric-ai, llm, basecamp, hyprpaper-random, libnotify, trash-cli, unzip, zip, yazi) - bat.nix: bat with nix-colors derived syntax theme - carapace.nix: multi-shell completion (fish, nushell, bash) - direnv.nix: automatic env loading with nix-direnv - eza.nix: modern ls with icons, git status, long format - lf.nix: terminal file manager with bat preview - zoxide.nix: smarter cd with fish and nushell integration - zellij-ps.nix: project session manager wrapping cli.zellij-ps	2026-04-26 12:06:36 +02:00
m3tm3re	cc01c1d0aa	fix(agents): make videoDrivers optional with safe default For standalone Home Manager evaluation where videoDrivers may be absent	2026-04-26 11:37:17 +02:00
m3tm3re	d59a6b82b6	chore: remove features.old archive and format all files - Delete home/features.old/ (archived old flat feature modules) - All content migrated to new profile-based structure - Run alejandra formatter over 13 changed files - nix flake check passes cleanly	2026-04-26 11:29:49 +02:00
m3tm3re	d44bdad73a	refactor: archive old features directory to features.old The new profile-based structure (home/base, home/desktop, home/server, home/profiles/, home/coding) is fully operational and imported via home/lib/mkHomeConfig. The legacy home/features directory is no longer referenced anywhere in the configuration. Archived rather than deleted to preserve history for reference.	2026-04-26 11:22:17 +02:00
m3tm3re	797ffb2b8a	fix: assert unknown profiles in mkHomeConfig; move agent modules to coding/agents - home/lib/default.nix: add assertion for unknown profile names instead of silently filtering them out; remove unused 'inherit (lib) optional' - home/coding/agents/{opencode,pi}.nix: moved from home/features/coding/ to co-locate with agents.nix (eliminating cross-directory back-references) - home/coding/agents/agents.nix: update imports to ./opencode.nix and ./pi.nix - home/features/coding/: remove now-dead default.nix (nothing imported it)	2026-04-26 11:17:03 +02:00
m3tm3re	73bd2b1f2e	fix: spec review - add missing fish module to base/shell - Create home/base/shell/fish.nix - Add to base/shell/default.nix imports - Migrate remaining hosts from features.cli.fish to base.shell.fish	2026-04-26 11:09:50 +02:00
m3tm3re	f3749c5679	feat: implement profile system with mkHomeConfig and context constraints - Add home/lib/default.nix with mkHomeConfig utility - Loads base + common modules always - Maps profiles (coding, gaming, media) to module imports - Enforces desktop/server mutual exclusion via assertion - Context must be 'desktop', 'server', or null - Migrate all per-host home configs to new profile system - m3-ares: context=desktop, profiles=[coding, gaming, media] - m3-kratos: context=desktop, profiles=[coding, gaming, media] - m3-atlas: context=server, profiles=[coding] - m3-helios: context=server, profiles=[] - m3-hermes: context=server, profiles=[] - m3-aether: context=server, profiles=[] - m3-daedalus: context=desktop, profiles=[coding, media] - Replace features.* options with new namespaces: - features.cli.* -> base.shell.* / base.cliTools.* / base.secrets - features.desktop.* -> desktop.wm.* / desktop.apps.* / desktop.theme.* - gaming/media moved to profiles.gaming.* / profiles.media.* - Fix home/coding/editor/neovim.nix: remove duplicate option declaration (coding.editors.neovim.enable already declared by m3ta-nixpkgs) - Fix home/coding/lsp/servers.nix: replace removed nodePackages.typescript-language-server with typescript-language-server - Fix home/desktop/theme/wallpapers.nix: correct relative path (was ../../.. which resolved to project root, should be ../..)	2026-04-26 11:03:43 +02:00
m3tm3re	9908b9e335	fix: code review fixes - Fix hardcoded user path in webapps.nix (use homeDirectory) - Normalize wallpapers option to use .enable suffix - Remove duplicate FZF keybind declaration - Update comments to match actual implementation	2026-04-26 10:49:01 +02:00
m3tm3re	06b430e067	fix: code review fixes - Fix hardcoded user path in webapps.nix (use homeDirectory) - Normalize wallpapers option to use .enable suffix - Remove duplicate FZF keybind declaration - Update comments to match actual implementation	2026-04-26 10:48:52 +02:00
m3tm3re	1b5bcae686	feat: create new home/ directory structure for profile-based config New structure: - home/base/ - Always loaded (shell, cli-tools, secrets) - home/coding/ - Profile-independent dev tooling (editor, lsp, git, agents) - home/profiles/ - Freely combinable profiles (gaming, media) - home/desktop/ - Desktop-only (wm, apps, theme) - home/server/ - Minimal server stub Migration sources: - home/features/cli/ → home/base/{shell,cli-tools,secrets} - home/features/desktop/hyprland,wayland,rofi → home/desktop/wm/ - home/features/desktop/obsidian,office,webapps,crypto → home/desktop/apps/ - home/features/desktop/fonts,theme,wallpapers → home/desktop/theme/ - gaming.nix split → home/profiles/gaming/{steam,gamescope} - media.nix split → home/profiles/media/{obs,ffmpeg,yt-dlp,kdenlive,handbrake} Option namespaces updated: - features.cli.* → base.shell.* / base.cliTools.* / base.secrets - features.desktop.* → desktop.wm.* / desktop.apps.* / desktop.theme.* - features.desktop.gaming → profiles.gaming.* - features.desktop.media → profiles.media.* Verified: nix flake check passes (warnings only)	2026-04-26 10:37:03 +02:00
m3tm3re	b1eb50a350	chore: add .worktrees to gitignore For isolated feature development	2026-04-26 10:27:13 +02:00
m3tm3re	383f4ef56f	feat: tuwunel matrix server + hermes update	2026-04-24 21:38:57 +02:00
m3tm3re	d47680aef7	chore: n8n update	2026-04-22 19:26:10 +02:00
m3tm3re	047b60a6a8	refactor: update Pi agent configuration and devShell - Switch model provider from zai/glm-5.1 to minimax/MiniMax-M2.7 - Add coding rules for Nix language and standard concerns - Add linting tools (statix, deadnix) to devShell - Simplify devShell configuration - Update AGENTS.md project rules	2026-04-22 17:59:23 +02:00
m3tm3re	382b4c8c98	chore: hermes update	2026-04-21 19:00:49 +02:00
m3tam3re	90fbdfe346	Merge pull request 'feat: pi-agent wrapper' (#5 ) from feature/pi-agent-wrapper into master Reviewed-on: #5	2026-04-14 18:51:44 +02:00
m3tm3re	7e0d60c95b	feat: pi-agent wrapper	2026-04-14 18:36:55 +02:00
m3tam3re	e289698960	Merge pull request 'feat: containerized pi agent' (#4 ) from feature/pi-agent-containerized into master Reviewed-on: #4	2026-04-13 21:31:03 +02:00
m3tm3re	24e39d19e3	feat: containerized pi agent	2026-04-13 21:28:13 +02:00
m3tam3re	197704ee95	Merge pull request 'fix/evaluation-warnings-opencode-neovim' (#3 ) from fix/evaluation-warnings-opencode-neovim into master Reviewed-on: #3	2026-04-13 19:40:38 +02:00
m3tm3re	53a30c7af3	chore: ignore .pi-lens artifacts and untrack cached files	2026-04-13 19:35:58 +02:00
m3tm3re	4684c5dc3e	chore: include local changes and bump home-manager state to 26.05	2026-04-13 19:23:49 +02:00
m3tm3re	55aac2c910	fix: silence nix evaluation warnings for neovim/opencode/system	2026-04-13 19:18:25 +02:00
m3tam3re	fa608ae399	Merge pull request 'fix(hermes): inject matrix-nio via PYTHONPATH in container' (#2 ) from fix/matrix-nio-pythonpath into master Reviewed-on: #2	2026-04-13 17:00:10 +02:00
m3tam3re	717e7b0291	Merge pull request 'feat: config with agents rework' (#1 ) from feature/agents-rework into master Reviewed-on: #1	2026-04-13 16:56:56 +02:00
m3tm3re	40507bb930	feat: config with agents rework	2026-04-13 16:53:33 +02:00
m3tm3re	7bf686481c	feat: config with agents rework	2026-04-13 16:44:18 +02:00
Chiron Agent	3868f69958	fix(hermes): inject matrix-nio via PYTHONPATH in container matrix-nio is installed in the container's writable venv layer (~/.venv) but the hermes process uses the read-only Nix store Python. This adds PYTHONPATH and LD_LIBRARY_PATH as container-level env vars so matrix-nio + libolm (e2e encryption) are importable.	2026-04-11 05:17:51 +00:00
m3tm3re	ab3332e45b	feat: hermes agent for m3-ares	2026-04-09 19:56:19 +02:00
m3tm3re	c92868308b	chore: initialize taskplane tasks	2026-04-08 20:44:51 +02:00
m3tm3re	6a58b3656a	flake update + hermes workaround for upstream bug	2026-04-08 17:48:27 +02:00
sascha.koenig	6853bb3063	+m3-hermes	2026-04-07 06:19:05 +02:00
m3tm3re	38c27eff1c	+basic hermes config	2026-04-06 18:44:07 +02:00
m3tm3re	d9d4b6cd85	feat: add openwork to desktop packages, update flake inputs and misc config	2026-04-03 12:45:55 +02:00
m3tm3re	44c0234739	chore: update mcp config	2026-03-31 13:30:47 +02:00
m3tm3re	4f0a92e43b	fix: nushell tv warning m3-atlas	2026-03-28 10:29:05 +01:00
m3tm3re	87939ce630	feat: implement agent skills	2026-03-28 10:17:29 +01:00
m3tm3re	1bc1616a4f	m3-ares update	2026-03-22 17:21:25 +01:00
m3tm3re	43523cf2d8	+television, flake-update	2026-03-21 09:39:19 +01:00
				`@@ -0,0 +1 @@`
				`{"$schema":"https://opencode.ai/config.json","instructions":[".opencode-rules/concerns/coding-style.md",".opencode-rules/concerns/naming.md",".opencode-rules/concerns/documentation.md",".opencode-rules/concerns/testing.md",".opencode-rules/concerns/git-workflow.md",".opencode-rules/concerns/project-structure.md",".opencode-rules/languages/nix.md"]}`