Align nixpkgs with Home Manager 26.11

Root cause: The complex concatStringsSep command with power commands
(--power-shutdown, --power-reboot) and multiple --remember flags was
causing tuigreet to display its usage/flags instead of the login UI.
The quoting in the systemd binary paths may have been problematic.

Changes:
- Use lib.getExe instead of manual bin path for tuigreet
- Use simple 'Hyprland' command (found via PATH) instead of
  the full start-hyprland path which may have issues
- Remove unverified options: --remember-session, --remember-user-session,
  --user-menu, --user-menu-min-uid, --power-shutdown, --power-reboot
- Keep only verified options: --time, --remember, --asterisks, --cmd
- Update tmpfiles comment to reflect actual requirement

This provides a minimal, stable login that works reliably.
User can reboot to test.

.a5c/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+runs/
+*.log

.a5c/inputs/project-install.json

@@ -0,0 +1,5 @@
+{
+  "projectRoot": "/home/m3tam3re/p/NIX/nixos-config",
+  "isNewProject": false,
+  "additionalContext": "Install and configure babysitter for this existing NixOS flake configuration repository. Respect AGENTS.md instructions, Beads workflow, Nix conventions, and avoid interactive/destructive operations unless explicitly approved."
+}

.a5c/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "nixos-config-a5c",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@a5c-ai/babysitter-sdk": "latest"
+  }
+}

.a5c/project-profile.json

@@ -0,0 +1,596 @@
+{
+  "projectName": "nixos-config",
+  "description": "A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.",
+  "goals": [
+    {
+      "id": "goal-reliability-1",
+      "description": "Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment.",
+      "category": "reliability",
+      "priority": "high",
+      "status": "active"
+    },
+    {
+      "id": "goal-architecture-1",
+      "description": "Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules.",
+      "category": "architecture",
+      "priority": "high",
+      "status": "active"
+    },
+    {
+      "id": "goal-modularization-1",
+      "description": "Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate.",
+      "category": "modularization",
+      "priority": "high",
+      "status": "active"
+    },
+    {
+      "id": "goal-cicd-1",
+      "description": "CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks.",
+      "category": "automation",
+      "priority": "medium",
+      "status": "deferred"
+    }
+  ],
+  "techStack": {
+    "languages": [
+      {
+        "name": "Nix",
+        "role": "primary system, module, overlay, and package configuration language"
+      },
+      {
+        "name": "Markdown",
+        "role": "project, agent, and workflow documentation"
+      },
+      {
+        "name": "JSON/YAML",
+        "role": "tool configuration and metadata"
+      }
+    ],
+    "frameworks": [
+      {
+        "name": "Nix flakes",
+        "category": "reproducible dependency and output model"
+      },
+      {
+        "name": "NixOS modules",
+        "category": "host and service configuration"
+      },
+      {
+        "name": "Home Manager",
+        "category": "user environment management"
+      },
+      {
+        "name": "Agenix",
+        "category": "encrypted secret management"
+      },
+      {
+        "name": "Disko",
+        "category": "server disk provisioning"
+      },
+      {
+        "name": "NUR",
+        "category": "community package access"
+      },
+      {
+        "name": "llm-agents.nix",
+        "category": "LLM agent packages overlay"
+      },
+      {
+        "name": "m3ta-home",
+        "category": "external reusable Home Manager profiles"
+      },
+      {
+        "name": "m3ta-nixpkgs",
+        "category": "external custom packages/modules/overlays"
+      }
+    ],
+    "databases": [],
+    "infrastructure": [
+      {
+        "name": "m3-ares",
+        "category": "desktop NixOS host"
+      },
+      {
+        "name": "m3-kratos",
+        "category": "desktop NixOS host"
+      },
+      {
+        "name": "m3-daedalus",
+        "category": "portable laptop/Home Manager configuration"
+      },
+      {
+        "name": "m3-atlas",
+        "category": "primary server NixOS host"
+      },
+      {
+        "name": "m3-helios",
+        "category": "minimal server/AdGuard host"
+      },
+      {
+        "name": "m3-hermes",
+        "category": "secondary server/Hermes host"
+      },
+      {
+        "name": "m3-aether",
+        "category": "cloud VM/minimal server host"
+      }
+    ],
+    "buildTools": [
+      "nix",
+      "nixos-rebuild",
+      "nix build",
+      "nix flake show",
+      "alejandra",
+      "statix",
+      "deadnix"
+    ],
+    "packageManagers": [
+      "nix flakes"
+    ]
+  },
+  "architecture": {
+    "pattern": "Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.",
+    "modules": [
+      {
+        "name": "flake.nix",
+        "path": "flake.nix",
+        "description": "Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells."
+      },
+      {
+        "name": "hosts/common",
+        "path": "hosts/common",
+        "description": "Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users."
+      },
+      {
+        "name": "hosts",
+        "path": "hosts",
+        "description": "Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM."
+      },
+      {
+        "name": "modules/nixos",
+        "path": "modules/nixos",
+        "description": "Reusable NixOS modules."
+      },
+      {
+        "name": "modules/home-manager",
+        "path": "modules/home-manager",
+        "description": "Reusable Home Manager module exports."
+      },
+      {
+        "name": "overlays",
+        "path": "overlays",
+        "description": "Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages."
+      },
+      {
+        "name": "pkgs",
+        "path": "pkgs",
+        "description": "Custom package export set."
+      },
+      {
+        "name": "secrets",
+        "path": "secrets",
+        "description": "Encrypted agenix secret files and registry."
+      }
+    ],
+    "entryPoints": [
+      "flake.nix",
+      "hosts/<host>/default.nix",
+      "hosts/<host>/configuration.nix",
+      "hosts/common/default.nix",
+      "hosts/common/users/m3tam3re.nix",
+      "overlays/default.nix",
+      "pkgs/default.nix",
+      "secrets.nix"
+    ],
+    "dataFlow": "flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules."
+  },
+  "team": [
+    {
+      "name": "m3tam3re",
+      "role": "solo developer and operator",
+      "responsibilities": [
+        "architecture",
+        "implementation",
+        "host maintenance",
+        "deployments",
+        "review"
+      ]
+    },
+    {
+      "name": "m3ta-chiron",
+      "role": "agent contributor",
+      "responsibilities": [
+        "semi-autonomous implementation",
+        "validation",
+        "documentation updates",
+        "conventional commits"
+      ]
+    }
+  ],
+  "workflows": [
+    {
+      "name": "development",
+      "description": "Default feature-branch workflow for solo development with conventional commits and validation before push.",
+      "steps": [
+        "review Beads issues with bd ready --json",
+        "claim work with bd update <id> --claim when applicable",
+        "edit Nix modules or project files",
+        "run alejandra .",
+        "run statix check .",
+        "run targeted nix flake or host dry-run checks",
+        "commit with conventional commit format",
+        "pull --rebase and push"
+      ],
+      "triggers": [
+        "new feature",
+        "bug fix",
+        "refactor",
+        "agent task"
+      ]
+    },
+    {
+      "name": "nix validation",
+      "description": "Quality gate for Nix configuration changes.",
+      "steps": [
+        "alejandra .",
+        "statix check .",
+        "deadnix check or deadnix -w when appropriate",
+        "nix flake show",
+        "sudo nixos-rebuild dry-run --flake .#<host> for affected hosts"
+      ],
+      "triggers": [
+        "Nix code changes",
+        "before deployment",
+        "before commit"
+      ]
+    },
+    {
+      "name": "host deployment",
+      "description": "Manual deployment after successful dry-run validation.",
+      "steps": [
+        "sudo nixos-rebuild dry-run --flake .#<host>",
+        "sudo nixos-rebuild switch --flake .#<host>"
+      ],
+      "triggers": [
+        "manual host update"
+      ]
+    },
+    {
+      "name": "dependency/input update",
+      "description": "Controlled flake input updates without manually editing flake.lock.",
+      "steps": [
+        "use nix flake update or nixos-rebuild --update-input <input>",
+        "validate affected outputs",
+        "commit flake.nix/flake.lock changes"
+      ],
+      "triggers": [
+        "planned dependency update",
+        "security update"
+      ]
+    },
+    {
+      "name": "beads issue tracking",
+      "description": "Persistent issue tracking and session handoff workflow.",
+      "steps": [
+        "bd ready --json",
+        "bd show <id>",
+        "bd update <id> --claim",
+        "bd close <id> --reason <summary>",
+        "bd dolt push"
+      ],
+      "triggers": [
+        "start of tracked work",
+        "completion of tracked work"
+      ]
+    }
+  ],
+  "processes": [
+    {
+      "id": "cradle/project-install",
+      "name": "Babysitter project install",
+      "status": "installing",
+      "purpose": "Create and save a Babysitter project profile and setup recommendations."
+    }
+  ],
+  "tools": {
+    "formatting": [
+      {
+        "name": "alejandra",
+        "purpose": "Nix formatting",
+        "configPaths": [
+          "flake.nix devShells.default"
+        ]
+      }
+    ],
+    "linting": [
+      {
+        "name": "statix",
+        "purpose": "Nix anti-pattern linting",
+        "configPaths": [
+          "flake.nix devShells.default"
+        ]
+      },
+      {
+        "name": "deadnix",
+        "purpose": "Detect unused Nix code",
+        "configPaths": [
+          "flake.nix devShells.default"
+        ]
+      }
+    ],
+    "testing": [
+      {
+        "name": "nix flake show",
+        "purpose": "Evaluate flake outputs",
+        "configPaths": [
+          "flake.nix"
+        ]
+      },
+      {
+        "name": "nixos-rebuild dry-run",
+        "purpose": "Validate host configurations without applying changes",
+        "configPaths": [
+          "flake.nix",
+          "hosts/*"
+        ]
+      },
+      {
+        "name": "nix build",
+        "purpose": "Build selected outputs such as host toplevels or ISOs",
+        "configPaths": [
+          "flake.nix"
+        ]
+      }
+    ],
+    "issueTracking": [
+      {
+        "name": "Beads",
+        "command": "bd",
+        "purpose": "Persistent task tracking"
+      }
+    ]
+  },
+  "services": [
+    {
+      "name": "code.m3ta.dev",
+      "type": "git hosting",
+      "url": "git+ssh://gitea@code.m3ta.dev"
+    },
+    {
+      "name": "GitHub",
+      "type": "flake input hosting",
+      "url": "github:* flake inputs"
+    },
+    {
+      "name": "Agenix",
+      "type": "secret encryption",
+      "url": "github:ryantm/agenix"
+    },
+    {
+      "name": "Hermes Agent",
+      "type": "NixOS module/agent service",
+      "url": "github:NousResearch/hermes-agent"
+    },
+    {
+      "name": "RustFS",
+      "type": "NixOS server service flake",
+      "url": "github:rustfs/rustfs-flake"
+    }
+  ],
+  "externalIntegrations": [
+    {
+      "service": "Beads",
+      "category": "issue tracking",
+      "enabled": true
+    },
+    {
+      "service": "Dolt",
+      "category": "Beads storage/sync",
+      "enabled": true
+    },
+    {
+      "service": "Agenix",
+      "category": "secrets",
+      "enabled": true
+    },
+    {
+      "service": "Home Manager",
+      "category": "user environment",
+      "enabled": true
+    },
+    {
+      "service": "m3ta-home",
+      "category": "external home profiles",
+      "enabled": true
+    },
+    {
+      "service": "m3ta-nixpkgs",
+      "category": "external Nix modules/packages",
+      "enabled": true
+    },
+    {
+      "service": "NUR",
+      "category": "Nix packages",
+      "enabled": true
+    },
+    {
+      "service": "Disko",
+      "category": "disk provisioning",
+      "enabled": true
+    },
+    {
+      "service": "Hermes Agent",
+      "category": "LLM/agent service",
+      "enabled": true
+    }
+  ],
+  "cicd": {
+    "provider": null,
+    "enabled": false,
+    "configPaths": [],
+    "pipelines": [],
+    "notes": "CI/CD is intentionally disabled for now. If re-enabled later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.",
+    "babysitterIntegration": {
+      "enabled": false,
+      "triggerOn": [],
+      "processIds": []
+    }
+  },
+  "painPoints": [
+    {
+      "id": "pp-architecture-1",
+      "description": "The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.",
+      "severity": "high",
+      "category": "architecture",
+      "discoveredVia": "user interview",
+      "suggestedRemediation": "Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs."
+    },
+    {
+      "id": "pp-validation-1",
+      "description": "A single shared Nix change can require validating several hosts to be confident.",
+      "severity": "medium",
+      "category": "validation",
+      "discoveredVia": "repo structure and AGENTS workflow",
+      "suggestedRemediation": "Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled."
+    },
+    {
+      "id": "pp-dependency-1",
+      "description": "Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.",
+      "severity": "medium",
+      "category": "dependency management",
+      "discoveredVia": "flake and history analysis",
+      "suggestedRemediation": "Update inputs intentionally, group related updates, and validate affected host outputs."
+    },
+    {
+      "id": "pp-operations-1",
+      "description": "Service additions often need synchronized module, secret, and network/TLS changes.",
+      "severity": "medium",
+      "category": "operations",
+      "discoveredVia": "git history and tree structure",
+      "suggestedRemediation": "Use checklist-style issue templates or Babysitter processes for service changes."
+    }
+  ],
+  "bottlenecks": [
+    {
+      "id": "bn-flake-1",
+      "description": "flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once.",
+      "impact": "High; evaluation failures can block all hosts.",
+      "location": "flake.nix, flake.lock",
+      "frequency": "very frequent"
+    },
+    {
+      "id": "bn-secrets-1",
+      "description": "Secret registry and host secret modules must stay aligned with encrypted .age files.",
+      "impact": "Medium to high; missing or mismatched secrets break host deployment.",
+      "location": "secrets.nix, hosts/*/secrets.nix, secrets/*.age",
+      "frequency": "recurring"
+    },
+    {
+      "id": "bn-services-1",
+      "description": "Server service changes can span service modules, secrets, Traefik/networking, and flake inputs.",
+      "impact": "High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.",
+      "location": "hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common",
+      "frequency": "frequent"
+    },
+    {
+      "id": "bn-home-1",
+      "description": "Home Manager behavior depends on both the external m3ta-home input and local host flags.",
+      "impact": "Medium; may require coordinated updates across repositories.",
+      "location": "flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input",
+      "frequency": "frequent after migration"
+    }
+  ],
+  "conventions": {
+    "naming": {
+      "files": "hyphen-case for Nix/docs where practical; host directories use m3-* names",
+      "hosts": "m3-<greek-name>",
+      "modules": "one module per file/directory where possible",
+      "nixVariables": "camelCase"
+    },
+    "git": {
+      "branchStrategy": "default feature branches for non-trivial work; master as integration branch",
+      "commits": "conventional commits for agent work",
+      "reviews": "optional for solo development",
+      "releaseCadence": "continuous/manual as needed",
+      "remote": "code.m3ta.dev over SSH for private inputs and repo access"
+    },
+    "codeStyle": {
+      "formatter": "alejandra",
+      "indentation": "2 spaces",
+      "nixStyle": "explicit pkgs references preferred; avoid with pkgs, builtins.fetchTarball, import <nixpkgs>, builtins.getAttr/hasAttr"
+    },
+    "importOrder": [
+      "module function arguments",
+      "imports",
+      "let bindings",
+      "options/config"
+    ],
+    "errorHandling": "Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.",
+    "testingConventions": "Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.",
+    "additionalRules": [
+      "Use Beads for persistent task tracking.",
+      "Use non-interactive flags for shell file operations.",
+      "Do not modify flake.lock directly; use nix flake update.",
+      "Do not commit plaintext secrets.",
+      "Use SSH URLs for code.m3ta.dev flake inputs.",
+      "Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions."
+    ]
+  },
+  "repositories": [
+    {
+      "name": "nixos-config",
+      "path": "/home/m3tam3re/p/NIX/nixos-config",
+      "role": "primary multi-host NixOS configuration"
+    },
+    {
+      "name": "m3ta-home",
+      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home",
+      "role": "external Home Manager profiles"
+    },
+    {
+      "name": "m3ta-nixpkgs",
+      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs",
+      "role": "external custom packages/modules/overlays"
+    }
+  ],
+  "claudeMdInstructions": [
+    "Respect AGENTS.md as the source of project workflow rules.",
+    "Resolve the active Babysitter process library before using library processes.",
+    "Use cradle/project-install for project setup or profile refresh.",
+    "Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.",
+    "Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.",
+    "Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.",
+    "Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.",
+    "Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions."
+  ],
+  "installedSkills": [
+    "project-install",
+    "babysit",
+    "specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md",
+    "specializations/devops-sre-platform/skills/gitops/SKILL.md",
+    "specializations/devops-sre-platform/skills/secrets-management/SKILL.md"
+  ],
+  "installedAgents": [
+    "general-purpose",
+    "specializations/devops-sre-platform/agents/platform-engineer/AGENT.md",
+    "specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md"
+  ],
+  "installedProcesses": [
+    "cradle/project-install",
+    "methodologies/gsd/quick.js",
+    "methodologies/gsd/verify-work.js",
+    "methodologies/gsd/iterative-convergence.js",
+    "methodologies/evolutionary.js",
+    "specializations/devops-sre-platform/iac-testing.js"
+  ],
+  "preferences": {
+    "babysitterAutonomy": "semi-autonomous",
+    "breakpointTolerance": "moderate",
+    "externalIntegrationsRequested": false,
+    "cicdDesired": false,
+    "cicdNote": "Deferred for now; Gitea Actions is the preferred provider if CI/CD is added later."
+  },
+  "createdAt": "2026-05-29T15:50:48.754Z",
+  "updatedAt": "2026-05-29T16:07:19.245463Z",
+  "version": 1
+}

.a5c/project-profile.md

@@ -0,0 +1,238 @@
+# Project Profile: nixos-config
+
+A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.
+
+> Last updated: 2026-05-29T16:02:11.092188Z | Version: 1
+
+## Goals
+
+- **reliability** [high]: Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment. (active)
+- **architecture** [high]: Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules. (active)
+- **modularization** [high]: Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate. (active)
+- **automation** [medium]: CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks. (deferred)
+
+## Tech Stack
+
+### Languages
+
+- Nix (primary system, module, overlay, and package configuration language)
+- Markdown (project, agent, and workflow documentation)
+- JSON/YAML (tool configuration and metadata)
+
+### Frameworks
+
+- Nix flakes [reproducible dependency and output model]
+- NixOS modules [host and service configuration]
+- Home Manager [user environment management]
+- Agenix [encrypted secret management]
+- Disko [server disk provisioning]
+- NUR [community package access]
+- llm-agents.nix [LLM agent packages overlay]
+- m3ta-home [external reusable Home Manager profiles]
+- m3ta-nixpkgs [external custom packages/modules/overlays]
+
+### Infrastructure
+
+- m3-ares [desktop NixOS host]
+- m3-kratos [desktop NixOS host]
+- m3-daedalus [portable laptop/Home Manager configuration]
+- m3-atlas [primary server NixOS host]
+- m3-helios [minimal server/AdGuard host]
+- m3-hermes [secondary server/Hermes host]
+- m3-aether [cloud VM/minimal server host]
+
+**Build tools:** nix, nixos-rebuild, nix build, nix flake show, alejandra, statix, deadnix
+
+**Package managers:** nix flakes
+
+## Architecture
+
+**Pattern:** Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.
+**Data flow:** flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules.
+
+### Modules
+
+| Module | Path | Description |
+|--------|------|-------------|
+| flake.nix | `flake.nix` | Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells. |
+| hosts/common | `hosts/common` | Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users. |
+| hosts | `hosts` | Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM. |
+| modules/nixos | `modules/nixos` | Reusable NixOS modules. |
+| modules/home-manager | `modules/home-manager` | Reusable Home Manager module exports. |
+| overlays | `overlays` | Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages. |
+| pkgs | `pkgs` | Custom package export set. |
+| secrets | `secrets` | Encrypted agenix secret files and registry. |
+
+**Entry points:** `flake.nix`, `hosts/<host>/default.nix`, `hosts/<host>/configuration.nix`, `hosts/common/default.nix`, `hosts/common/users/m3tam3re.nix`, `overlays/default.nix`, `pkgs/default.nix`, `secrets.nix`
+
+## Team
+
+- **m3tam3re** (solo developer and operator): architecture, implementation, host maintenance, deployments, review
+- **m3ta-chiron** (agent contributor): semi-autonomous implementation, validation, documentation updates, conventional commits
+
+## Workflows
+
+### development
+
+Default feature-branch workflow for solo development with conventional commits and validation before push.
+**Triggers:** new feature, bug fix, refactor, agent task
+
+1. review Beads issues with bd ready --json
+2. claim work with bd update <id> --claim when applicable
+3. edit Nix modules or project files
+4. run alejandra .
+5. run statix check .
+6. run targeted nix flake or host dry-run checks
+7. commit with conventional commit format
+8. pull --rebase and push
+
+### nix validation
+
+Quality gate for Nix configuration changes.
+**Triggers:** Nix code changes, before deployment, before commit
+
+1. alejandra .
+2. statix check .
+3. deadnix check or deadnix -w when appropriate
+4. nix flake show
+5. sudo nixos-rebuild dry-run --flake .#<host> for affected hosts
+
+### host deployment
+
+Manual deployment after successful dry-run validation.
+**Triggers:** manual host update
+
+1. sudo nixos-rebuild dry-run --flake .#<host>
+2. sudo nixos-rebuild switch --flake .#<host>
+
+### dependency/input update
+
+Controlled flake input updates without manually editing flake.lock.
+**Triggers:** planned dependency update, security update
+
+1. use nix flake update or nixos-rebuild --update-input <input>
+2. validate affected outputs
+3. commit flake.nix/flake.lock changes
+
+### beads issue tracking
+
+Persistent issue tracking and session handoff workflow.
+**Triggers:** start of tracked work, completion of tracked work
+
+1. bd ready --json
+2. bd show <id>
+3. bd update <id> --claim
+4. bd close <id> --reason <summary>
+5. bd dolt push
+
+## Processes
+
+- **Babysitter project install** (`cradle/project-install`, undefined)
+
+## Tools
+
+### Linting
+
+- statix
+- deadnix
+
+### Testing
+
+- nix flake show
+- nixos-rebuild dry-run
+- nix build
+
+### Formatting
+
+- alejandra
+
+## Services
+
+- **code.m3ta.dev** (git hosting) - git+ssh://gitea@code.m3ta.dev
+- **GitHub** (flake input hosting) - github:* flake inputs
+- **Agenix** (secret encryption) - github:ryantm/agenix
+- **Hermes Agent** (NixOS module/agent service) - github:NousResearch/hermes-agent
+- **RustFS** (NixOS server service flake) - github:rustfs/rustfs-flake
+
+## CI/CD
+
+**Status:** Not configured/enabled for now.
+
+No Babysitter CI/CD workflow is currently installed. If CI/CD is added later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.
+
+## Pain Points
+
+- **high** [architecture]: The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.
+  - Remediation: Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs.
+- **medium** [validation]: A single shared Nix change can require validating several hosts to be confident.
+  - Remediation: Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled.
+- **medium** [dependency management]: Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.
+  - Remediation: Update inputs intentionally, group related updates, and validate affected host outputs.
+- **medium** [operations]: Service additions often need synchronized module, secret, and network/TLS changes.
+  - Remediation: Use checklist-style issue templates or Babysitter processes for service changes.
+
+## Bottlenecks
+
+- flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once. at flake.nix, flake.lock (very frequent)
+  Impact: High; evaluation failures can block all hosts.
+- Secret registry and host secret modules must stay aligned with encrypted .age files. at secrets.nix, hosts/*/secrets.nix, secrets/*.age (recurring)
+  Impact: Medium to high; missing or mismatched secrets break host deployment.
+- Server service changes can span service modules, secrets, Traefik/networking, and flake inputs. at hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common (frequent)
+  Impact: High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.
+- Home Manager behavior depends on both the external m3ta-home input and local host flags. at flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input (frequent after migration)
+  Impact: Medium; may require coordinated updates across repositories.
+
+## Conventions
+
+### Naming
+
+- **files:** hyphen-case for Nix/docs where practical; host directories use m3-* names
+- **hosts:** m3-<greek-name>
+- **modules:** one module per file/directory where possible
+- **nixVariables:** camelCase
+
+### Git
+
+- **branchStrategy:** default feature branches for non-trivial work; master as integration branch
+- **commits:** conventional commits for agent work
+- **reviews:** optional for solo development
+- **releaseCadence:** continuous/manual as needed
+- **remote:** code.m3ta.dev over SSH for private inputs and repo access
+
+**Import order:** module function arguments > imports > let bindings > options/config
+
+**Error handling:** Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.
+
+**Testing:** Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.
+
+### Additional Rules
+
+- Use Beads for persistent task tracking.
+- Use non-interactive flags for shell file operations.
+- Do not modify flake.lock directly; use nix flake update.
+- Do not commit plaintext secrets.
+- Use SSH URLs for code.m3ta.dev flake inputs.
+- Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions.
+
+## Repositories
+
+- **nixos-config** [`/home/m3tam3re/p/NIX/nixos-config`]
+- **m3ta-home** - git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home
+- **m3ta-nixpkgs** - git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs
+
+## CLAUDE.md Instructions
+
+- Respect AGENTS.md as the source of project workflow rules.
+- Resolve the active Babysitter process library before using library processes.
+- Use cradle/project-install for project setup or profile refresh.
+- Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.
+- Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.
+- Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.
+- Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.
+- Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions.
+
+## Installed Extensions
+
+- Skills: project-install, babysit, specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md, specializations/devops-sre-platform/skills/gitops/SKILL.md, specializations/devops-sre-platform/skills/secrets-management/SKILL.md
+- Agents: general-purpose, specializations/devops-sre-platform/agents/platform-engineer/AGENT.md, specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md
+- Processes: cradle/project-install, methodologies/gsd/quick.js, methodologies/gsd/verify-work.js, methodologies/gsd/iterative-convergence.js, methodologies/evolutionary.js, specializations/devops-sre-platform/iac-testing.js

.a5c/quality-gates.json

@@ -0,0 +1,53 @@
+{
+  "qualityThreshold": 80,
+  "testCoverage": {
+    "minimum": 0,
+    "rationale": "NixOS configuration repository without a coverage-producing test suite."
+  },
+  "formatting": [
+    {
+      "name": "alejandra",
+      "command": "alejandra .",
+      "ciCommand": "alejandra --check ."
+    }
+  ],
+  "linting": [
+    {
+      "name": "statix",
+      "command": "statix check ."
+    },
+    {
+      "name": "deadnix",
+      "command": "deadnix . --fail"
+    }
+  ],
+  "evaluation": [
+    {
+      "name": "flake outputs",
+      "command": "nix flake show"
+    },
+    {
+      "name": "affected host dry-run",
+      "command": "sudo nixos-rebuild dry-run --flake .#<host>",
+      "when": "Run for affected hosts when practical and safe."
+    }
+  ],
+  "commitChecks": [
+    "alejandra .",
+    "statix check .",
+    "deadnix . --fail",
+    "nix flake show"
+  ],
+  "deployGates": [
+    "formatting passes",
+    "linting passes",
+    "flake outputs evaluate",
+    "affected host dry-run succeeds",
+    "secrets are encrypted and host secret modules remain aligned"
+  ],
+  "cicdIntegrationPoints": [],
+  "cicd": {
+    "enabled": false,
+    "notes": "No CI/CD integration is currently configured. Add Gitea Actions later if automated Babysitter or Nix validation is desired."
+  }
+}

.gitignore

@@ -46,3 +46,10 @@ CLAUDE.md
 .dolt/
 *.db
 .beads-credential-key
+
+# --- babysitter managed ---
+.a5c/creds.env
+.a5c/creds.env.tmp.*
+.a5c/logs/
+.a5c/runs/
+# --- end babysitter managed ---

agent-sources.lock.json

@@ -0,0 +1,681 @@
+{
+  "generatedBy": "agent-lib",
+  "schemaVersion": 1,
+  "sources": {
+    "m3ta-agents": {
+      "discovery": {
+        "agents": {
+          "include": [
+            "**/AGENT.md"
+          ],
+          "paths": [
+            "agents"
+          ]
+        },
+        "prompts": {
+          "include": [
+            "**/PROMPT.md"
+          ],
+          "paths": [
+            "prompts"
+          ]
+        },
+        "skills": {
+          "include": [
+            "**/SKILL.md"
+          ],
+          "paths": [
+            "skills"
+          ]
+        },
+        "tools": {
+          "include": [
+            "**/TOOL.md"
+          ],
+          "paths": [
+            "tools"
+          ]
+        }
+      },
+      "items": {
+        "agents": {},
+        "prompts": {},
+        "skills": {
+          "agent-development": {
+            "entry": "skills/agent-development/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "(opencode - Skill) Create and configure agents for Opencode. Use when: (1) creating a new agent, (2) adding agents to agents.json or opencode.json, (3) configuring agent permissions, (4) setting up primary vs subagent modes, (5) writing agent system prompts, (6) understanding agent triggering. Triggers: create agent, add agent, agents.json, subagent, primary agent, agent permissions, agent configuration, agent prompt.",
+              "name": "agent-development",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/agent-development"
+          },
+          "basecamp-project": {
+            "entry": "skills/basecamp-project/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Use when: (1) setting up a new Basecamp project, (2) turning an idea or plan into a reviewed project launch package, (3) creating Basecamp task lists, kickoff messages, project briefs, check-ins, or launch structure, (4) stress-testing project scope, timeline, roles, risks, and feasibility before Basecamp launch. Triggers: create Basecamp project, setup project in Basecamp, project kickoff, project plan to Basecamp, launch project.",
+              "name": "basecamp-project",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/basecamp-project"
+          },
+          "brainstorming": {
+            "entry": "skills/brainstorming/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "General-purpose ideation and strategic thinking. Use when: (1) clarifying thoughts on any topic, (2) exploring options and trade-offs, (3) building strategies or plans, (4) making decisions with multiple factors, (5) thinking through problems. Triggers: brainstorm, think through, explore options, clarify, what are my options, help me decide, strategy for, how should I approach.",
+              "name": "brainstorming",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/brainstorming"
+          },
+          "changelog": {
+            "entry": "skills/changelog/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Automate changelog generation from commits, PRs, and releases following Keep a Changelog format. Use when setting up release workflows, generating release notes, or standardizing commit conventions.",
+              "name": "changelog",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/changelog"
+          },
+          "doc-translator": {
+            "entry": "skills/doc-translator/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Translates external documentation websites to specified language(s) and publishes to Outline wiki. Use when: (1) Translating SaaS/product documentation into German or Czech, (2) Publishing translated docs to Outline wiki, (3) Re-hosting external images to Outline. Triggers: 'translate docs', 'translate documentation', 'translate to German', 'translate to Czech', 'publish to wiki', 'doc translation', 'TEEM translation'.",
+              "name": "doc-translator",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/doc-translator"
+          },
+          "excalidraw": {
+            "entry": "skills/excalidraw/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Create Excalidraw diagram JSON files that make visual arguments. Use when: (1) user wants to visualize workflows, architectures, or concepts, (2) creating system diagrams, (3) generating .excalidraw files. Triggers: excalidraw, diagram, visualize, architecture diagram, system diagram.",
+              "name": "excalidraw",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/excalidraw"
+          },
+          "grill-me": {
+            "entry": "skills/grill-me/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions \"grill me\".",
+              "name": "grill-me",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/grill-me"
+          },
+          "mem0-memory": {
+            "entry": "skills/mem0-memory/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "DEPRECATED: Replaced by opencode-memory plugin. See skills/memory/SKILL.md for current memory system.",
+              "name": "mem0-memory",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/mem0-memory"
+          },
+          "obsidian": {
+            "entry": "skills/obsidian/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Obsidian Local REST API integration for knowledge management. Use when: (1) Creating, reading, updating, or deleting notes in Obsidian vault, (2) Searching vault content by title, content, or tags, (3) Managing daily notes and journaling, (4) Working with WikiLinks and vault metadata. Triggers: 'Obsidian', 'note', 'vault', 'WikiLink', 'daily note', 'journal', 'create note'.",
+              "name": "obsidian",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/obsidian"
+          },
+          "outline": {
+            "entry": "skills/outline/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Outline wiki integration for knowledge management and documentation workflows. Use when Opencode needs to interact with Outline for: (1) Creating and editing documents, (2) Searching and retrieving knowledge base content, (3) Managing document collections and hierarchies, (4) Handling document sharing and permissions, (5) Collaborative features like comments. Triggers: 'Outline', 'wiki', 'knowledge base', 'documentation', 'team docs', 'document in Outline', 'search Outline', 'Outline collection'.",
+              "name": "outline",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/outline"
+          },
+          "pdf": {
+            "entry": "skills/pdf/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When the Coding Agent needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.",
+              "name": "pdf",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/pdf"
+          },
+          "plan-writing": {
+            "entry": "skills/plan-writing/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Use when you have a spec or requirements for a multi-step task, before touching code",
+              "name": "plan-writing",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/plan-writing"
+          },
+          "prompt-engineering-patterns": {
+            "entry": "skills/prompt-engineering-patterns/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Master advanced prompt engineering techniques to maximize LLM performance, reliability, and controllability in production. Use when optimizing prompts, improving LLM outputs, or designing production prompt templates.",
+              "name": "prompt-engineering-patterns",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/prompt-engineering-patterns"
+          },
+          "qmd": {
+            "entry": "skills/qmd/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Knowledge retrieval and memory system via qmd (Query Markup Documents). Use when: (1) Searching knowledge vault for relevant context, (2) Storing memories, decisions, preferences from sessions, (3) Auto-recall of relevant context at session start, (4) Writing session summaries, (5) Querying past decisions or project context. Triggers: 'remember', 'recall', 'search vault', 'what did we decide', 'session summary', 'qmd', 'knowledge', 'memory', 'context'.",
+              "name": "qmd",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/qmd"
+          },
+          "reflection": {
+            "entry": "skills/reflection/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Conversation analysis to improve skills based on user feedback. Use when: (1) user explicitly requests reflection ('reflect', 'improve', 'learn from this'), (2) reflection mode is ON and clear correction signals detected, (3) user asks to analyze skill performance. Triggers: reflect, improve, learn, analyze conversation, skill feedback. Toggle with /reflection on|off command.",
+              "name": "reflection",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/reflection"
+          },
+          "skill-creator": {
+            "entry": "skills/skill-creator/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Guide for creating effective Opencode Agent Skills. Use this when users want to create a new skill (or update an existing skill) that extends Opencode's capabilities with specialized knowledge, workflows, or tool integrations.",
+              "name": "skill-creator",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/skill-creator"
+          },
+          "systematic-debugging": {
+            "entry": "skills/systematic-debugging/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes",
+              "name": "systematic-debugging",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/systematic-debugging"
+          },
+          "xlsx": {
+            "entry": "skills/xlsx/SKILL.md",
+            "licenseFiles": [],
+            "metadata": {
+              "description": "Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When the Coding Agent needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing data, (3) Modify existing spreadsheets while preserving formulas, (4) Data analysis and visualization in spreadsheets, or (5) Recalculating formulas",
+              "name": "xlsx",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/xlsx"
+          }
+        },
+        "tools": {}
+      },
+      "narHash": "sha256:7cca53dff2e26b7aeab5c6548d3efd135198ee42f1af81c2300d05e400330ff4",
+      "ref": null,
+      "rev": "b6e1aaa6261c5056d024d8d4785659eaa4e675e6",
+      "root": ".",
+      "type": "git",
+      "url": "https://code.m3ta.dev/m3tam3re/AGENTS",
+      "warnings": []
+    },
+    "mattpocock": {
+      "discovery": {
+        "agents": {
+          "include": [
+            "**/AGENT.md"
+          ],
+          "paths": [
+            "agents"
+          ]
+        },
+        "prompts": {
+          "include": [
+            "**/PROMPT.md"
+          ],
+          "paths": [
+            "prompts"
+          ]
+        },
+        "skills": {
+          "include": [
+            "**/SKILL.md"
+          ],
+          "paths": [
+            "skills"
+          ]
+        },
+        "tools": {
+          "include": [
+            "**/TOOL.md"
+          ],
+          "paths": [
+            "tools"
+          ]
+        }
+      },
+      "items": {
+        "agents": {},
+        "prompts": {},
+        "skills": {
+          "caveman": {
+            "entry": "skills/productivity/caveman/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": ">",
+              "name": "caveman",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/productivity/caveman"
+          },
+          "design-an-interface": {
+            "entry": "skills/deprecated/design-an-interface/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions \"design it twice\".",
+              "name": "design-an-interface",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/deprecated/design-an-interface"
+          },
+          "diagnose": {
+            "entry": "skills/engineering/diagnose/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.",
+              "name": "diagnose",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/diagnose"
+          },
+          "edit-article": {
+            "entry": "skills/personal/edit-article/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Edit and improve articles by restructuring sections, improving clarity, and tightening prose. Use when user wants to edit, revise, or improve an article draft.",
+              "name": "edit-article",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/personal/edit-article"
+          },
+          "git-guardrails-claude-code": {
+            "entry": "skills/misc/git-guardrails-claude-code/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.",
+              "name": "git-guardrails-claude-code",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/misc/git-guardrails-claude-code"
+          },
+          "grill-me": {
+            "entry": "skills/productivity/grill-me/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions \"grill me\".",
+              "name": "grill-me",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/productivity/grill-me"
+          },
+          "grill-with-docs": {
+            "entry": "skills/engineering/grill-with-docs/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.",
+              "name": "grill-with-docs",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/grill-with-docs"
+          },
+          "handoff": {
+            "entry": "skills/productivity/handoff/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Compact the current conversation into a handoff document for another agent to pick up.",
+              "name": "handoff",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/productivity/handoff"
+          },
+          "improve-codebase-architecture": {
+            "entry": "skills/engineering/improve-codebase-architecture/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.",
+              "name": "improve-codebase-architecture",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/improve-codebase-architecture"
+          },
+          "migrate-to-shoehorn": {
+            "entry": "skills/misc/migrate-to-shoehorn/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.",
+              "name": "migrate-to-shoehorn",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/misc/migrate-to-shoehorn"
+          },
+          "obsidian-vault": {
+            "entry": "skills/personal/obsidian-vault/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Search, create, and manage notes in the Obsidian vault with wikilinks and index notes. Use when user wants to find, create, or organize notes in Obsidian.",
+              "name": "obsidian-vault",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/personal/obsidian-vault"
+          },
+          "prototype": {
+            "entry": "skills/engineering/prototype/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Build a throwaway prototype to flesh out a design before committing to it. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says \"prototype this\", \"let me play with it\", \"try a few designs\".",
+              "name": "prototype",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/prototype"
+          },
+          "qa": {
+            "entry": "skills/deprecated/qa/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions \"QA session\".",
+              "name": "qa",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/deprecated/qa"
+          },
+          "request-refactor-plan": {
+            "entry": "skills/deprecated/request-refactor-plan/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Create a detailed refactor plan with tiny commits via user interview, then file it as a GitHub issue. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps.",
+              "name": "request-refactor-plan",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/deprecated/request-refactor-plan"
+          },
+          "review": {
+            "entry": "skills/in-progress/review/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".",
+              "name": "review",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/in-progress/review"
+          },
+          "scaffold-exercises": {
+            "entry": "skills/misc/scaffold-exercises/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.",
+              "name": "scaffold-exercises",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/misc/scaffold-exercises"
+          },
+          "setup-matt-pocock-skills": {
+            "entry": "skills/engineering/setup-matt-pocock-skills/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Sets up an `## Agent skills` block in AGENTS.md/CLAUDE.md and `docs/agents/` so the engineering skills know this repo's issue tracker (GitHub or local markdown), triage label vocabulary, and domain doc layout. Run before first use of `to-issues`, `to-prd`, `triage`, `diagnose`, `tdd`, `improve-codebase-architecture`, or `zoom-out` — or if those skills appear to be missing context about the issue tracker, triage labels, or domain docs.",
+              "name": "setup-matt-pocock-skills",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/setup-matt-pocock-skills"
+          },
+          "setup-pre-commit": {
+            "entry": "skills/misc/setup-pre-commit/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.",
+              "name": "setup-pre-commit",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/misc/setup-pre-commit"
+          },
+          "tdd": {
+            "entry": "skills/engineering/tdd/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions \"red-green-refactor\", wants integration tests, or asks for test-first development.",
+              "name": "tdd",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/tdd"
+          },
+          "teach": {
+            "entry": "skills/in-progress/teach/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Teach the user a new skill or concept, within this workspace.",
+              "name": "teach",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/in-progress/teach"
+          },
+          "to-issues": {
+            "entry": "skills/engineering/to-issues/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Break a plan, spec, or PRD into independently-grabbable issues on the project issue tracker using tracer-bullet vertical slices. Use when user wants to convert a plan into issues, create implementation tickets, or break down work into issues.",
+              "name": "to-issues",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/to-issues"
+          },
+          "to-prd": {
+            "entry": "skills/engineering/to-prd/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.",
+              "name": "to-prd",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/to-prd"
+          },
+          "triage": {
+            "entry": "skills/engineering/triage/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Triage issues through a state machine driven by triage roles. Use when user wants to create an issue, triage issues, review incoming bugs or feature requests, prepare issues for an AFK agent, or manage issue workflow.",
+              "name": "triage",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/triage"
+          },
+          "ubiquitous-language": {
+            "entry": "skills/deprecated/ubiquitous-language/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Extract a DDD-style ubiquitous language glossary from the current conversation, flagging ambiguities and proposing canonical terms. Saves to UBIQUITOUS_LANGUAGE.md. Use when user wants to define domain terms, build a glossary, harden terminology, create a ubiquitous language, or mentions \"domain model\" or \"DDD\".",
+              "name": "ubiquitous-language",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/deprecated/ubiquitous-language"
+          },
+          "write-a-skill": {
+            "entry": "skills/productivity/write-a-skill/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.",
+              "name": "write-a-skill",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/productivity/write-a-skill"
+          },
+          "writing-beats": {
+            "entry": "skills/in-progress/writing-beats/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Shape an article as a journey of beats, choose-your-own-adventure style. The user picks a starting beat from the raw material, you write only that beat, then offer options for where to pivot next, beat by beat, until the article reaches a natural end. Use when the user has raw material and wants to assemble it as a narrative rather than an argument.",
+              "name": "writing-beats",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/in-progress/writing-beats"
+          },
+          "writing-fragments": {
+            "entry": "skills/in-progress/writing-fragments/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Grilling session that mines the user for fragments — heterogeneous nuggets of writing (claims, vignettes, sharp sentences, half-thoughts) — and appends them to a single document as raw material for a future article. Use when the user wants to develop ideas before imposing structure, or mentions \"fragments\", \"ideate\", or \"raw material\" for writing.",
+              "name": "writing-fragments",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/in-progress/writing-fragments"
+          },
+          "writing-shape": {
+            "entry": "skills/in-progress/writing-shape/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Take a markdown file of raw material and shape it into an article through a conversational session — drafting candidate openings, growing the piece paragraph by paragraph, arguing about format (lists, tables, callouts, quotes) at each step. Use when the user has a pile of notes, fragments, or a rough draft and wants help turning it into something publishable.",
+              "name": "writing-shape",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/in-progress/writing-shape"
+          },
+          "zoom-out": {
+            "entry": "skills/engineering/zoom-out/SKILL.md",
+            "licenseFiles": [
+              "LICENSE"
+            ],
+            "metadata": {
+              "description": "Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.",
+              "name": "zoom-out",
+              "requires": [],
+              "tags": []
+            },
+            "path": "skills/engineering/zoom-out"
+          }
+        },
+        "tools": {}
+      },
+      "narHash": "sha256:e61c575015dca998709776014f52317e29b49aca42659b635dbc69fb60a7f9e1",
+      "ref": null,
+      "rev": "e3b90b5238f38cdea5996e16861dcae28ef52eda",
+      "root": ".",
+      "type": "git",
+      "url": "https://github.com/mattpocock/skills",
+      "warnings": []
+    }
+  }
+}

flake.lock

@@ -42,6 +42,23 @@
         "type": "github"
       }
     },
+    "agent-lib": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780128063,
+        "narHash": "sha256-4qfphsBI6nc+U74z2e4EMpISssDqp+20+cw8rN7G88Q=",
+        "path": "/home/m3tam3re/p/NIX/agent-lib",
+        "type": "path"
+      },
+      "original": {
+        "path": "/home/m3tam3re/p/NIX/agent-lib",
+        "type": "path"
+      }
+    },
     "agents": {
       "inputs": {
         "nixpkgs": "nixpkgs_2"
@@ -79,11 +96,11 @@
     "agents_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1777399938,
+        "lastModified": 1778518220,
-        "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
+        "narHash": "sha256-6AQs9VZ0/DuD4njPbYHRE4v+SgJc6SBrGwemTWxikVc=",
         "ref": "refs/heads/master",
-        "rev": "9a91f1ee0cf011a7eaf1f16a9e17610b0457e055",
+        "rev": "b6e1aaa6261c5056d024d8d4785659eaa4e675e6",
-        "revCount": 85,
+        "revCount": 87,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -214,16 +231,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1777369708,
+        "lastModified": 1778446047,
-        "narHash": "sha256-1xW7cRZNsFNPQD+cE0fwnLVStnDth0HSoASEIFeT7uI=",
+        "narHash": "sha256-oQvcadh2BCkrog+SGrG6YffKJrveYpjj3TdQJWaKhaM=",
         "owner": "nix-community",
         "repo": "bun2nix",
-        "rev": "e659e1cc4b8e1b21d0aa85f1c481f9db61ecfa98",
+        "rev": "f2bc12af1a6369648aac41041ceeaa0b866599c6",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "staging-2.1.0",
         "repo": "bun2nix",
         "type": "github"
       }
@@ -280,11 +296,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777713215,
+        "lastModified": 1779226674,
-        "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=",
+        "narHash": "sha256-wuOkjI6pRiN4sEn/EPBRnNW5cmcpvd7xtIM8y5LooAs=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267",
+        "rev": "65fb947964bd44fc0008faf77d1fcb7a9f40bb32",
         "type": "github"
       },
       "original": {
@@ -322,11 +338,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777988971,
+        "lastModified": 1778716662,
-        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -406,16 +422,16 @@
         "uv2nix": "uv2nix_2"
       },
       "locked": {
-        "lastModified": 1778170968,
+        "lastModified": 1778925537,
-        "narHash": "sha256-YQQUEDUim2CiYpL3uG7Wi1fWPsT2wtIqoBeJuAj9hUk=",
+        "narHash": "sha256-d9qhrTy45Q5UsmjapqMHOVi9e+gR9zE8Nq9Z0wObLmc=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "498bfc7bc12a937621b4215312049b1000726df3",
+        "rev": "a91a57fa5a13d516c38b07a141a9ce8a3daabeb0",
         "type": "github"
       },
       "original": {
         "owner": "NousResearch",
-        "ref": "v2026.5.7",
+        "ref": "v2026.5.16",
         "repo": "hermes-agent",
         "type": "github"
       }
@@ -448,11 +464,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778248595,
+        "lastModified": 1780099287,
-        "narHash": "sha256-dhFgEjoeJMYN/7OY6xfxS799YB4IjbbYXTjyGIJyLpc=",
+        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fdb2ccba9d5e1238d32e0c4a3ec1a277efa80c1d",
+        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
         "type": "github"
       },
       "original": {
@@ -577,11 +593,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1778304612,
+        "lastModified": 1779687822,
-        "narHash": "sha256-7FkBnR56KZ8RwY5kPd3ans8f68IYjF1J66gOUlLsiLA=",
+        "narHash": "sha256-WXKyZkAQqCXm+k+N5hIfnb7U67RD3S9eIwbOCiR3vCk=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "c741913095c4815f6651aa0a2c24b3ce15e414e4",
+        "rev": "ce517fef69b04f27e24dc1278f02c00ac7860f36",
         "type": "github"
       },
       "original": {
@@ -602,17 +618,14 @@
         "nur": "nur"
       },
       "locked": {
-        "lastModified": 1778520138,
+        "lastModified": 1780072492,
-        "narHash": "sha256-X58c8BUIshyUnp6XEKumFUYXqMFnrDTj+aGuGIbKwxg=",
+        "narHash": "sha256-ggZVqVLZ7EswLJLRdB8DyZnxen1rPQ5EKxj2mszrf0c=",
-        "ref": "refs/heads/master",
+        "path": "/home/m3tam3re/p/NIX/m3ta-home",
-        "rev": "a87d9510bd84f51bf93970730b8688ab7221bbdd",
+        "type": "path"
-        "revCount": 30,
-        "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
       },
       "original": {
-        "type": "git",
+        "path": "/home/m3tam3re/p/NIX/m3ta-home",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
+        "type": "path"
       }
     },
     "m3ta-nixpkgs": {
@@ -649,11 +662,11 @@
         "openspec": "openspec_2"
       },
       "locked": {
-        "lastModified": 1778518789,
+        "lastModified": 1779517896,
-        "narHash": "sha256-9WZvO2BBofC2Wp4dvP4/aQ6Jhmcxh9lEGTYj09hLXrI=",
+        "narHash": "sha256-Bf1W1LomsEu/3y/uhyij0lKXfS5lqdBq4ObQqz6bbWw=",
         "ref": "refs/heads/master",
-        "rev": "d64c581516c02702ec28e5d2304330d7b035235d",
+        "rev": "20678635f8fef419f382867c0d3a7a927a38c3f0",
-        "revCount": 295,
+        "revCount": 322,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -846,11 +859,11 @@
     },
     "nixpkgs-master_2": {
       "locked": {
-        "lastModified": 1778507606,
+        "lastModified": 1779457550,
-        "narHash": "sha256-6Yc2dIhijc8G+dbMNocyclxF19dUrjaT+EeXGrXmXlg=",
+        "narHash": "sha256-yALoy2CrvwvNfwMtGZDRdc+jqVNHulyuM5iVK12lUAI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "39a7b8d815fcc8b689d56fc4a3fa8de4ef93d169",
+        "rev": "a9c18fd234dbe4fd8de4bac53760b785c47e94ff",
         "type": "github"
       },
       "original": {
@@ -862,11 +875,11 @@
     },
     "nixpkgs-master_3": {
       "locked": {
-        "lastModified": 1778307931,
+        "lastModified": 1779689814,
-        "narHash": "sha256-GkUOqeH6tb2/K1tv3t0F/xROIAh5/zEGutzEUIrQ+u8=",
+        "narHash": "sha256-eTdYWNN3Jy7civCYpmQ154fHR901aZDRY2EisHzsbbQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8f689324e32c31a3d2c24490a19e266c3fb6508b",
+        "rev": "c03ba07ec4c5e92d79b23f237d73e02d6c1c85aa",
         "type": "github"
       },
       "original": {
@@ -878,11 +891,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1778003029,
+        "lastModified": 1779467186,
-        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
+        "narHash": "sha256-nOesoDCiXcUftqbRBMz9tt4blI5PvljMWbm3kuCA+0s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
+        "rev": "b77b3de8775677f84492abe84635f87b0e153f0f",
         "type": "github"
       },
       "original": {
@@ -894,16 +907,16 @@
     },
     "nixpkgs_10": {
       "locked": {
-        "lastModified": 1777954456,
+        "lastModified": 1780030872,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -974,11 +987,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1778124196,
+        "lastModified": 1778869304,
-        "narHash": "sha256-pYEytCNic/czazbV9r3tbQ6BZzqRBg/41x2dIC5ymOo=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "68a8af93ff4297686cb68880845e61e5e2e41d92",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
@@ -1022,11 +1035,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1777954456,
+        "lastModified": 1778869304,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
@@ -1100,11 +1113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778308643,
+        "lastModified": 1779687395,
-        "narHash": "sha256-MpJyLyJWAwOy7rVs7pWqRwH2b8/rj+B524VzdonvXBs=",
+        "narHash": "sha256-fknzaRr3dxdZ4+rgxQEUhATbkc4HToMXVDtKIyyUo7M=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "98d908741ed91101cd0649961f12d2427bdba7d3",
+        "rev": "f0588e67aca80323badc05936e2e894dc8902114",
         "type": "github"
       },
       "original": {
@@ -1143,11 +1156,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778120451,
+        "lastModified": 1779302169,
-        "narHash": "sha256-MUSPD16+hoFBfQWYahtNLN2BIFEAlFFo2KNofrc947g=",
+        "narHash": "sha256-OOSPtUXC4F2umtsZPkyWlPQxhXBsxF2vqBXLeI/lqIw=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "053d8a59d587f3c027a06ad80503a6b43d4f2a92",
+        "rev": "79303b521068c5f525ee61db06b915fc44b098f4",
         "type": "github"
       },
       "original": {
@@ -1247,6 +1260,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "agent-lib": "agent-lib",
         "agents": "agents",
         "disko": "disko",
         "hermes-agent": "hermes-agent",
@@ -1269,6 +1283,7 @@
         "skills-anthropic": "skills-anthropic",
         "skills-basecamp": "skills-basecamp",
         "skills-kestra": "skills-kestra",
+        "skills-mattpocock": "skills-mattpocock",
         "skills-superpowers": "skills-superpowers",
         "skills-vercel": "skills-vercel"
       }
@@ -1300,11 +1315,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777635550,
+        "lastModified": 1779522750,
-        "narHash": "sha256-QHknn6JYNb4+8ztMl7Ngk3Px3r2FRUPwbbrswYuHSpA=",
+        "narHash": "sha256-IhAhPWYMomohxWmh/u/x8B44hIkt3IcuL2bsKb+vl5U=",
         "owner": "rustfs",
         "repo": "rustfs-flake",
-        "rev": "efaad834053c41ac618804fb4e7612cea455848e",
+        "rev": "31e193047ef40f702261a93f47889c1b1962d10a",
         "type": "github"
       },
       "original": {
@@ -1316,11 +1331,11 @@
     "skills-anthropic": {
       "flake": false,
       "locked": {
-        "lastModified": 1778286877,
+        "lastModified": 1779199866,
-        "narHash": "sha256-jKNYFom6R+Qw7LQ8vFPBe51JpqIP0tTSY8LM4aPlnT4=",
+        "narHash": "sha256-GMXFJSePrpEvhzMQ82YI9Z10BDkuFK/lXUDELclvQ4c=",
         "owner": "anthropics",
         "repo": "skills",
-        "rev": "f458cee31a7577a47ba0c9a101976fa599385174",
+        "rev": "690f15cac7f7b4c055c5ab109c79ed9259934081",
         "type": "github"
       },
       "original": {
@@ -1332,11 +1347,11 @@
     "skills-basecamp": {
       "flake": false,
       "locked": {
-        "lastModified": 1777902228,
+        "lastModified": 1778520277,
-        "narHash": "sha256-XDsWpUhFb/gxatRFla07nwoc2y3WwaBLsiDdtCnqx38=",
+        "narHash": "sha256-gaV9eIIzOTBlL+9+e8HIgCs4pa1J8lAizRykkJVoVUM=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "b56ada1b3d42b42a9422ba39b30a223f9f960231",
+        "rev": "f948edca1dbce53640056743bf49f05cf39e736b",
         "type": "github"
       },
       "original": {
@@ -1348,11 +1363,11 @@
     "skills-kestra": {
       "flake": false,
       "locked": {
-        "lastModified": 1773046826,
+        "lastModified": 1778585472,
-        "narHash": "sha256-w1zFqfCAcu9FsaGf8uAyaaYVbSwwtUzotfDJ1jSt+q0=",
+        "narHash": "sha256-jtK4wwLE4y4vsnonSmIhlAIJ/g0zqPDt3TO+Frb6LEU=",
         "owner": "kestra-io",
         "repo": "agent-skills",
-        "rev": "b536825bf5b9213d7a7fb5ab7c47823f1044490b",
+        "rev": "cc9cd71fbada02f8ac22a1f3ae7ad5e7242bda45",
         "type": "github"
       },
       "original": {
@@ -1361,6 +1376,22 @@
         "type": "github"
       }
     },
+    "skills-mattpocock": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1779266813,
+        "narHash": "sha256-Qwuu27f95xgAJ4hdv/4TNahHhprCMIxl1H9f9ymEsno=",
+        "owner": "mattpocock",
+        "repo": "skills",
+        "rev": "b8be62ffacb0118fa3eaa29a0923c87c8c11985c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mattpocock",
+        "repo": "skills",
+        "type": "github"
+      }
+    },
     "skills-superpowers": {
       "flake": false,
       "locked": {
@@ -1380,11 +1411,11 @@
     "skills-vercel": {
       "flake": false,
       "locked": {
-        "lastModified": 1778275952,
+        "lastModified": 1779577875,
-        "narHash": "sha256-RYwgUf173N4lGalTta4HkBR7sdZwuzRoAY6M8JsT+RY=",
+        "narHash": "sha256-+1t7o4bqH95o1mDLZm73BaS4N3ZZR00NSfG9cfhlCNk=",
         "owner": "vercel-labs",
         "repo": "skills",
-        "rev": "c99a72b371b5b4da865f5afa87c5a686f3a46766",
+        "rev": "e4243fbf7d9398722024f62850ece90fa0d5c693",
         "type": "github"
       },
       "original": {

flake.nix

@@ -15,7 +15,7 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
     nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
@@ -44,7 +44,13 @@
     nix-colors.url = "github:misterio77/nix-colors";
 
     m3ta-home = {
-      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      # url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      url = "path:/home/m3tam3re/p/NIX/m3ta-home";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    agent-lib = {
+      url = "path:/home/m3tam3re/p/NIX/agent-lib";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -65,6 +71,10 @@
       url = "github:kestra-io/agent-skills";
       flake = false;
     };
+    skills-mattpocock = {
+      url = "github:mattpocock/skills";
+      flake = false;
+    };
     skills-superpowers = {
       url = "github:obra/superpowers";
       flake = false;
@@ -73,7 +83,7 @@
       url = "github:vercel-labs/skills";
       flake = false;
     };
-    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.7";
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.16";
 
     rustfs = {
       url = "github:rustfs/rustfs-flake";

hosts/common/ports.nix

@@ -39,6 +39,11 @@
       outline = 3019;
       authentik = 3023;
       tuwunel = 3024;
+      honcho = 3025;
+
+      # Agent infrastructure
+      hermes-api = 8642;
+      hermes-dashboard = 9119;
 
       # Home automation
       homarr = 7575;

hosts/m3-ares/services/hermes-agent.nix

@@ -17,10 +17,21 @@ in {
     settings = {
       # ── Model ──────────────────────────────────────────────────────────
       model = {
-        default = "glm-5.1";
+        default = "gpt-5.5";
-        provider = "zai";
+        provider = "openai-codex";
       };
 
+      fallback_providers = [
+        {
+          provider = "zai";
+          model = "glm-5.1";
+        }
+        {
+          provider = "minimax";
+          model = "MiniMax-M2.7";
+        }
+      ];
+
       credential_pool_strategies = {
         zai = "fill_first";
       };

hosts/m3-atlas/secrets.nix

@@ -3,6 +3,14 @@
     secrets = {
       baserow-env = {file = ../../secrets/baserow-env.age;};
       ghost-env = {file = ../../secrets/ghost-env.age;};
+      honcho-selfhost-db-password = {
+        file = ../../secrets/honcho-selfhost-db-password.age;
+        owner = "postgres";
+        group = "postgres";
+        mode = "400";
+      };
+      honcho-selfhost-env = {file = ../../secrets/honcho-selfhost-env.age;};
+      honcho-selfhost-jwt-secret = {file = ../../secrets/honcho-selfhost-jwt-secret.age;};
       kestra-config = {
         file = ../../secrets/kestra-config.age;
         mode = "644";

hosts/m3-atlas/services/containers/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./baserow.nix
     ./ghost.nix
+    ./honcho.nix
     ./kestra.nix
     ./littlelink.nix
     ./matomo.nix

hosts/m3-atlas/services/containers/honcho.nix

@@ -0,0 +1,209 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  serviceName = "honcho";
+  image = "ghcr.io/plastic-labs/honcho:v3.0.6";
+
+  apiIp = "10.89.0.24";
+  deriverIp = "10.89.0.25";
+  redisIp = "10.89.0.26";
+
+  postgresHost = "10.89.0.1";
+  postgresPort = config.m3ta.ports.get "postgres";
+  honchoPort = config.m3ta.ports.get "honcho";
+
+  # m3-atlas Netbird mesh address, discovered from `netbird status -d`.
+  # Binding the host port here keeps self-hosted Honcho off public interfaces.
+  netbirdBindAddress = "100.81.142.56";
+  netbirdRange = "100.64.0.0/16";
+
+  dbName = "honcho";
+  dbUser = "honcho";
+  redisName = "${serviceName}-redis";
+  runtimeDirectory = "/run/${serviceName}";
+  runtimeEnvFile = "${runtimeDirectory}/env";
+
+  # Keep auth disabled for the first deployment because Honcho clients need
+  # generated JWTs. The JWT secret is still provisioned so enabling auth later is
+  # a one-line change here plus client token generation.
+  authUseAuth = false;
+
+  sharedEnvironment = {
+    CACHE_ENABLED = "true";
+    CACHE_URL = "redis://${redisName}:6379/0?suppress=true";
+    LOG_LEVEL = "INFO";
+    TELEMETRY_ENABLED = "false";
+    VECTOR_STORE_MIGRATED = "false";
+    VECTOR_STORE_TYPE = "pgvector";
+    AUTH_USE_AUTH = lib.boolToString authUseAuth;
+  };
+
+  sharedEnvironmentFiles = [
+    runtimeEnvFile
+    config.age.secrets."${serviceName}-selfhost-env".path
+  ];
+
+  webNetwork = ip: [
+    "--add-host=postgres:${postgresHost}"
+    "--network=web:ip=${ip}"
+  ];
+
+  # The shared web network is intentionally internal. API and deriver also join
+  # this egress-only network so LLM provider calls can leave the host without
+  # exposing any extra inbound ports.
+  networksWithEgress = ip:
+    (webNetwork ip)
+    ++ [
+      "--network=${serviceName}-egress"
+    ];
+
+  apiHealthCmd = ''/app/.venv/bin/python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=2).read()"'';
+in {
+  system.activationScripts.createPodmanNetworkHonchoEgress = lib.mkAfter ''
+    if ! /run/current-system/sw/bin/podman network exists ${serviceName}-egress; then
+      /run/current-system/sw/bin/podman network create ${serviceName}-egress
+    fi
+  '';
+
+  virtualisation.oci-containers.containers = {
+    "${serviceName}-redis" = {
+      image = "docker.io/redis:8.2";
+      autoStart = true;
+      volumes = ["${serviceName}_redis_data:/data"];
+      extraOptions =
+        (webNetwork redisIp)
+        ++ [
+          "--health-cmd=redis-cli ping"
+          "--health-interval=5s"
+          "--health-timeout=5s"
+          "--health-retries=5"
+        ];
+    };
+
+    "${serviceName}-api" = {
+      inherit image;
+      autoStart = true;
+      entrypoint = "sh";
+      cmd = ["docker/entrypoint.sh"];
+      environment = sharedEnvironment;
+      environmentFiles = sharedEnvironmentFiles;
+      ports = ["${netbirdBindAddress}:${toString honchoPort}:8000"];
+      dependsOn = [redisName];
+      extraOptions =
+        (networksWithEgress apiIp)
+        ++ [
+          "--health-cmd=${apiHealthCmd}"
+          "--health-interval=5s"
+          "--health-timeout=5s"
+          "--health-retries=5"
+          "--health-start-period=10s"
+        ];
+    };
+
+    "${serviceName}-deriver" = {
+      inherit image;
+      autoStart = true;
+      entrypoint = "/app/.venv/bin/python";
+      cmd = ["-m" "src.deriver"];
+      environment = sharedEnvironment;
+      environmentFiles = sharedEnvironmentFiles;
+      dependsOn = ["${serviceName}-api" redisName];
+      extraOptions = networksWithEgress deriverIp;
+    };
+  };
+
+  systemd.services = {
+    "${serviceName}-postgres-bootstrap" = {
+      description = "Bootstrap Honcho PostgreSQL role, database, password, and pgvector";
+      after = ["postgresql.service" "agenix.service"];
+      requires = ["postgresql.service" "agenix.service"];
+      before = ["${serviceName}-env.service" "podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
+      requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
+      path = [
+        config.services.postgresql.package
+        pkgs.coreutils
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "postgres";
+        Group = "postgres";
+      };
+      script = ''
+        set -euo pipefail
+        test -s ${config.age.secrets."${serviceName}-selfhost-db-password".path}
+
+        psql -v ON_ERROR_STOP=1 --dbname=postgres <<'SQL'
+        DO $$
+        BEGIN
+          CREATE ROLE ${dbUser} LOGIN;
+        EXCEPTION WHEN duplicate_object THEN
+          NULL;
+        END
+        $$;
+
+        SELECT 'CREATE DATABASE ${dbName} OWNER ${dbUser}'
+        WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${dbName}')\gexec
+
+        ALTER DATABASE ${dbName} OWNER TO ${dbUser};
+        \set honcho_password `cat ${config.age.secrets."${serviceName}-selfhost-db-password".path}`
+        ALTER ROLE ${dbUser} WITH LOGIN PASSWORD :'honcho_password';
+        SQL
+
+        psql -v ON_ERROR_STOP=1 --dbname=${dbName} <<'SQL'
+        CREATE EXTENSION IF NOT EXISTS vector;
+        GRANT ALL PRIVILEGES ON DATABASE ${dbName} TO ${dbUser};
+        SQL
+      '';
+    };
+
+    "${serviceName}-env" = {
+      description = "Generate Honcho runtime environment file with agenix secrets";
+      after = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
+      requires = ["agenix.service" "${serviceName}-postgres-bootstrap.service"];
+      before = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
+      requiredBy = ["podman-${serviceName}-api.service" "podman-${serviceName}-deriver.service"];
+      path = [
+        pkgs.coreutils
+        pkgs.python3
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        set -euo pipefail
+        install -d -m 0750 ${runtimeDirectory}
+
+        db_password_encoded=$(
+          python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip(), safe=""))' \
+            < ${config.age.secrets."${serviceName}-selfhost-db-password".path}
+        )
+        jwt_secret=$(tr -d '\r\n' < ${config.age.secrets."${serviceName}-selfhost-jwt-secret".path})
+
+        umask 077
+        cat > ${runtimeEnvFile} <<ENV
+        DB_CONNECTION_URI=postgresql+psycopg://${dbUser}:$db_password_encoded@postgres:${toString postgresPort}/${dbName}
+        AUTH_JWT_SECRET=$jwt_secret
+        ENV
+      '';
+    };
+
+    "podman-${serviceName}-api" = {
+      after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
+      requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
+    };
+
+    "podman-${serviceName}-deriver" = {
+      after = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
+      requires = ["${serviceName}-env.service" "${serviceName}-postgres-bootstrap.service"];
+    };
+  };
+
+  networking.firewall.extraCommands = ''
+    # Self-hosted Honcho API: only Netbird mesh peers may reach ${netbirdBindAddress}:${toString honchoPort}.
+    ip46tables -A nixos-fw -p tcp --dport ${toString honchoPort} -s ${netbirdRange} -j nixos-fw-accept
+  '';
+}

hosts/m3-atlas/services/postgres.nix

@@ -28,6 +28,7 @@
       host    kestra       kestra       10.89.0.0/24    scram-sha-256
       host    netbird      netbird      10.89.0.0/24    scram-sha-256
       host    authentik    authentik    10.89.0.0/24    scram-sha-256
+      host    honcho       honcho       10.89.0.0/24    scram-sha-256
 
       # Deny all other connections
       local   all       all       reject
@@ -38,7 +39,7 @@
   services.postgresqlBackup = {
     enable = true;
     startAt = "03:10:00";
-    databases = ["baserow" "paperless" "kestra" "authentik" "netbird"];
+    databases = ["baserow" "paperless" "kestra" "authentik" "netbird" "honcho"];
   };
   networking.firewall = {
     extraCommands = ''

hosts/m3-hermes/services/hermes-agent.nix

@@ -7,14 +7,6 @@
   # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
   edgeVoice = "de-DE-SeraphinaMultilingualNeural";
 
-  # Extra Python packages from the container's writable venv layer.
-  # matrix-nio is installed via pip in /home/hermes/.venv but the hermes
-  # process uses the read-only Nix store Python, so we inject the venv's
-  # site-packages via PYTHONPATH and provide libstdc++ for libolm (e2e).
-  # NOTE: v0.13.0 upgraded to Python 3.12 — path updated accordingly.
-  venvSitePackages = "/home/hermes/.venv/lib/python3.12/site-packages";
-  gccLibPath = "${pkgs.stdenv.cc.cc.lib}/lib";
-
   # Build skills using agents flake lib for hermes user
   hermesSkills = inputs.agents.lib.mkSkills {
     inherit pkgs;
@@ -38,9 +30,9 @@ in {
   virtualisation.docker.enable = true;
 
   systemd.tmpfiles.rules = [
-    "d /home/hermes/.config 0755 hermes hermes -"
+    "d /var/lib/hermes/.config 0755 hermes hermes -"
-    "d /home/hermes/.config/tea 0755 hermes hermes -"
+    "d /var/lib/hermes/.config/tea 0755 hermes hermes -"
-    "L+ /home/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
+    "L+ /var/lib/hermes/.config/tea/yml - - - - ${pkgs.writeText "tea-yml" ''
       logins:
         - name: m3ta
           url: https://code.m3ta.dev
@@ -64,19 +56,30 @@ in {
     '';
   };
 
-  # Ensure 'uv' is in the hermes-agent service PATH so CronJobs and terminal
-  # sessions can use 'uv run' for PEP 723 scripts (e.g. garmin-daily.py).
-  systemd.services.hermes-agent.path = [pkgs.uv];
-
   services.hermes-agent = {
     enable = true;
     addToSystemPackages = true;
+    # v0.14 lazy-installs heavy optional backends by default. In the sealed
+    # Nix package, include the backends this host config actively uses so the
+    # gateway, Matrix bridge, memory, web search, TTS, and local STT work
+    # without runtime pip/uv mutation.
+    extraDependencyGroups = [
+      "matrix"
+      "honcho"
+      "exa"
+      "edge-tts"
+      "voice"
+    ];
 
     extraPackages = with pkgs; [
       docker
       git
+      curl
+      jq
       tea
       nix
+      python3Minimal
+      uv
       zellij
     ];
 
@@ -105,7 +108,7 @@ in {
       # Bind to 0.0.0.0 so the Netbird interface can reach it.
       API_SERVER_ENABLED = "true";
       API_SERVER_HOST = "0.0.0.0";
-      API_SERVER_PORT = "8642";
+      API_SERVER_PORT = toString (config.m3ta.ports.get "hermes-api");
     };
 
     # ── Container mode (podman) ──────────────────────────────────────────
@@ -113,21 +116,27 @@ in {
       enable = false;
       backend = "podman";
       extraVolumes = ["/home/m3tam3re/p:/projects:rw"];
-      extraOptions = [
+      extraOptions = [];
-        "--env"
-        "PYTHONPATH=${venvSitePackages}"
-        "--env"
-        "LD_LIBRARY_PATH=${gccLibPath}"
-      ];
     };
 
     settings = {
       # ── Model ──────────────────────────────────────────────────────────
       model = {
-        default = "glm-5.1";
+        default = "gpt-5.5";
-        provider = "zai";
+        provider = "openai-codex";
       };
 
+      fallback_providers = [
+        {
+          provider = "zai";
+          model = "glm-5.1";
+        }
+        {
+          provider = "minimax";
+          model = "MiniMax-M2.7";
+        }
+      ];
+
       credential_pool_strategies = {
         zai = "fill_first";
       };
@@ -139,6 +148,7 @@ in {
         max_turns = 90;
         gateway_timeout = 1800;
         tool_use_enforcement = "auto";
+        reasoning_effort = "high";
       };
 
       # ── Skills ─────────────────────────────────────────────────────────

hosts/m3-hermes/services/hermes-dashboard.nix

@@ -7,6 +7,8 @@
   # Netbird mesh VPN range — dashboard only accessible from mesh peers.
   # m3-atlas Traefik proxies to this port over Netbird.
   netbirdRange = "100.64.0.0/16";
+  apiPort = config.m3ta.ports.get "hermes-api";
+  dashboardPort = config.m3ta.ports.get "hermes-dashboard";
 
   # Reference the hermes-agent package from the running service config
   hermesPkg = config.services.hermes-agent.package or (inputs.hermes-agent.packages.${pkgs.stdenv.hostPlatform.system}.default or pkgs.hermes-agent);
@@ -14,10 +16,10 @@ in {
   # ── Hermes Dashboard systemd service ───────────────────────────────────
   # Web UI for managing Hermes Agent — sessions, config, kanban, cron, etc.
   #
-  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :9119
+  # Flow: Browser → dash.m3ta.dev (TLS via m3-atlas Traefik) → Netbird → :${toString dashboardPort}
   #
   # --insecure is required to bind 0.0.0.0 (hermes refuses non-localhost otherwise).
-  # Safe because firewall restricts port 9119 to Netbird mesh only.
+  # Safe because firewall restricts the dashboard/API ports to Netbird mesh only.
   systemd.services.hermes-dashboard = {
     description = "Hermes Agent Web Dashboard";
     after = ["network.target" "hermes-agent.service"];
@@ -29,7 +31,7 @@ in {
       User = "hermes";
       Group = "hermes";
 
-      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
+      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port ${toString dashboardPort} --no-open --insecure";
 
       # Environment matching the hermes-agent service
       Environment = [
@@ -51,15 +53,17 @@ in {
     };
   };
 
-  # ── Firewall: Dashboard only from Netbird mesh ─────────────────────────
+  # ── Firewall: Hermes network endpoints only from Netbird mesh ──────────
   networking.firewall = {
     extraCommands = ''
-      # Allow Hermes Dashboard (9119/tcp) only from Netbird mesh VPN
+      # Allow Hermes Dashboard and OpenAI-compatible API only from Netbird mesh VPN
-      ip46tables -A nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept
+      ip46tables -A nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept
+      ip46tables -A nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept
     '';
 
     extraStopCommands = ''
-      ip46tables -D nixos-fw -p tcp --dport 9119 -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
+      ip46tables -D nixos-fw -p tcp --dport ${toString dashboardPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
+      ip46tables -D nixos-fw -p tcp --dport ${toString apiPort} -s ${netbirdRange} -j nixos-fw-accept 2>/dev/null || true
     '';
   };
 }

hosts/m3-kratos/agent-lib.nix

@@ -0,0 +1,21 @@
+{
+  programs.agent-lib = {
+    enable = true;
+    lockFile = ../../agent-sources.lock.json;
+
+    targets.pi.enable = true;
+    targets.opencode.enable = true;
+
+    # profiles.default.sources.mattpocock.skills.all = true;
+    profiles.default = {
+      sources.mattpocock = {
+        skills = {
+          all = true;
+          # Provided by the existing shared skills set; duplicate Home Manager
+          # entries under .agents/skills cannot be installed safely.
+          exclude = ["grill-me" "caveman"];
+        };
+      };
+    };
+  };
+}

hosts/m3-kratos/configuration.nix

@@ -14,7 +14,7 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.initrd.kernelModules = ["amdgpu"];
-  boot.kernelPackages = pkgs.linuxPackages_6_18;
+  boot.kernelPackages = pkgs.linuxPackages_7_0;
   services.xserver.videoDrivers = ["amdgpu"];
   security.polkit.enable = true;
   security.pam.services.gdm.enableGnomeKeyring = true;

hosts/m3-kratos/home.nix

@@ -4,10 +4,16 @@
 # m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
 {
   config,
+  inputs,
   lib,
   ...
 }:
 with lib; {
+  imports = [
+    inputs.agent-lib.homeManagerModules.default
+    ./agent-lib.nix
+  ];
+
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
@@ -56,7 +62,6 @@ with lib; {
           ];
           windowrule = [
             "match:class dev.zed.Zed, workspace 1"
-            "match:class Msty, workspace 1"
             "match:class ^(com.obsproject.Studio)$, workspace 2"
             "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
             "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"

hosts/m3-kratos/services/default.nix

@@ -1,6 +1,7 @@
 {pkgs, ...}: {
   imports = [
     ./containers
+    ./greetd.nix
     ./mem0.nix
     # ./n8n.nix
     ./netbird.nix
@@ -29,6 +30,6 @@
         userServices = true;
       };
     };
-    displayManager.gdm.enable = true;
+    # displayManager.gdm.enable = true;
   };
 }

hosts/m3-kratos/services/greetd.nix

@@ -0,0 +1,38 @@
+# greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
+# Uses tuigreet as the greeter, launching Hyprland after authentication.
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  tuigreet = "${lib.getExe pkgs.tuigreet}";
+  # Use start-hyprland wrapper to avoid Hyprland startup warnings
+  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
+  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
+in {
+  services.greetd = {
+    enable = true;
+
+    settings = {
+      default_session = {
+        user = "greeter";
+        # Minimal config: verified supported flags only
+        # The --time and --remember are tested; power commands omitted
+        # to avoid potential quoting/parsing issues
+        command = builtins.concatStringsSep " " [
+          tuigreet
+          "--time"
+          "--remember"
+          "--asterisks"
+          "--cmd ${hyprlandCmd}"
+        ];
+      };
+    };
+  };
+
+  # Required for --remember to persist username between logins
+  systemd.tmpfiles.rules = [
+    "d /var/cache/tuigreet 0755 greeter greeter - -"
+  ];
+}

secrets.nix

@@ -38,6 +38,9 @@ in {
   "secrets/basecamp-client-id.age".publicKeys = systems ++ users;
   "secrets/basecamp-client-secret.age".publicKeys = systems ++ users;
   "secrets/gitea-runner-token.age".publicKeys = systems ++ users;
+  "secrets/honcho-selfhost-db-password.age".publicKeys = systems ++ users;
+  "secrets/honcho-selfhost-env.age".publicKeys = systems ++ users;
+  "secrets/honcho-selfhost-jwt-secret.age".publicKeys = systems ++ users;
   "secrets/outline-key.age".publicKeys = systems ++ users;
   "secrets/restreamer-env.age".publicKeys = systems ++ users;
   "secrets/searx.age".publicKeys = systems ++ users;

secrets/honcho-selfhost-db-password.age

@@ -0,0 +1,31 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDVrd2NzQSBJV1Fa
+U2gzWjJKOHlsK202dXAzVENFdmZ5ZmJsc01STnRnTWMvdjFyZ21NCjU5Q0hwbVlV
+dVlRTUZDb0JESHBaTzk5ancrTWNpLzYrMFk2QWU0Z0EvUmsKLT4gc3NoLWVkMjU1
+MTkgM0JjcjF3IEdia0tSQTZWcEE3ODE4VjU2M0ZGay9rbXlzbFNqZWxpb1lGSExw
+RW5keGsKWDlwRzcwT1BaTDByT0R6T3hqWTE1UWVyN2xhSzhSMlhBdW5FakNjZ1Ux
+NAotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgcnNJRnA2SVVkMHRXZTErc0VFbmduMDBz
+ZkQzK3dMQ2xadkMyYllhOE1rOAprWmg4T3RiaTF5QXdmRGUxVDVpVnZWdWxRYTJv
+WGVUQUhsT0VjKzl0NnJrCi0+IHNzaC1lZDI1NTE5IDROTEtydyAvc1ZTc0hRd3R4
+V2U4dEpaeEZEZlVyc2ZHSlNiVSt3T1M3bndsVXpPNkhVCmt2WlplcVcza2YxV05T
+bnRIOWpMYWpxck5jSzRtQVZ2L2ZQS3J1VjVTWDgKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBIHZCKzR5RXN2RmYvc3ZPTGJRRG1peUN6bmNuVFpSd2NPdWJwTTJYdHllRW8K
+TEo4QUI1a3ZzQ3NSQldSN1lTMlVwVGhTcTRPaHpYVHZVdHowYmZqR1czVQotPiBz
+c2gtcnNhIERRbEU3dwpvRzJjS0h3b2p4RXJrSDI1VEszQ1BvckNUS2laV3hGVVlx
+TXd0VkcvQ1hvWElNWnVNa1JoeHhMTDFUUWZnV0YxCjNHajRtZ0lmQzVXZmhyM1Nq
+SWoyVTFFdmowNTdZV0J0WHE5cXdZb2U1OVJOb1hYb1lnSjdqN09Bd2IvOUFlckMK
+d3hBc3pUK1J2Y3VnTjNSR0Q0cVJUVlluNllBazJ2L1dmOXVvZXI0WjVYbjI1RXhr
+Rm1EMzkxcStrYWRJTFNJKwo3YjZ6MEZ3RmtLZytiWGdBWWZEYU9EQWxEZWtzV3dD
+dGhJUUd0ajcvUFlxVGJqTVhlWmhSeHpkMHQyWWs5ZS9DClNEV0gzcWM2YlJTQ1lM
+bE4zTFJKSFU1VjAybFJvY1FQR2tNSFo2NFVDczBTUW9UWjY4aDVNUzlYaVlkdzJm
+dUsKckVaVld4YXpsdGYwWHVrWEtTbDJBU2cwcXlJSGY4ZEhlT2o4QlRBVGxWRHNL
+OXlMTGp5b1ZWbnJYV2pzaFFIcApQVmJzVi9kWnRpeWcyaS9weVN3SncxQjhlanBV
+dW5FU0VtL2lpS0NSTWtoOVI4akxXOUlhWW5xMkp2SUszSU9QCk1rZVdoNkI5TGRB
+L2twWWpPYVlSWUxrRElRcjhHMFczM29lcWlWWlJhbk0vcGFEQmw3UGdXWXJBNXJV
+VURYcFQKCi0+IHNzaC1lZDI1NTE5IENTTXloZyBpOEE3YUFzcytOYndXWWNreThp
+ZEdveGFlbHlPa0FwZ2xBY0lCcmIycTM4CnI0ZE1DM2d1bzZPV3diL2lZQi9SUnB1
+UWFjVVFueTFpMzRINm9Ob0pZMTQKLS0tIFJwZy9uRklOUEl0Z2hDNmx1YWsyNVov
+aHZ5VVhtMnVyYTMwbCtkaFFtR28KZzkT96InPG4YYyVKq0ZOrIBPtCJBbTXUJu+8
+9G03diIRwzYb6cSBRMtKKGl5NEfbJE7B2OnXeHPeCIPiGArKudKxFg9COHGOUP0h
+hUDDL9RGVhd4sMs8zRkxNghRwQzD
+-----END AGE ENCRYPTED FILE-----

secrets/honcho-selfhost-env.age

@@ -0,0 +1,30 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDVrd2NzQSBKZllV
+QytCeGYyVmtRMUxudm5iWmF3aWdITlRQVE53RnhFNUFabXkwbkg0CkE5Wk1mbXdm
+TzRuQTdvNklORUdSdHFIZm1zSVdvMWVnWWpRTUxDSzFBMHcKLT4gc3NoLWVkMjU1
+MTkgM0JjcjF3IDlISlRMdC9Sc2hic3JRV1o0WDNsbzByNmdFNnZDdjJSLytEa0xS
+VzRzQ2sKYXJGSjJDa2xuYThLNnhIMFhwTTNUSHJWbnFFYzZSRFQxVlVWK2xjNWgv
+dwotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgaGUweXhJZmhTOGt3VFQ2R04rQjNOckxx
+c3BCMTBWZ0lsQmU3NmlVRkRYWQp6QlMvQkZmemVjekdLVWlDTUlNRG04MTlzaHAz
+cW9xd2JjNlE0eFF4NzNvCi0+IHNzaC1lZDI1NTE5IDROTEtydyBWQ2FGUCtFQ2FZ
+Wk5uSzZyTDNBTHRPUTkvTlRWR0Q1bHdqRjBycmU0VFc0CkdpSUNZZGw1aGJwUVk0
+VnlIR2IxVTJNaFVSNHJQSDR2YWxuN2ZiSERQSUEKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBIHlDYUlJRGxabTZxSnNpTUNWUDRXWUtHa0h3Z3BYTlZkUEtkall1OUh1VzQK
+ZEQzSW5tM0xFdWd1a3hibXlxa0N2N2RlemUyMkplRW5CNFZHUCtTSEhWdwotPiBz
+c2gtcnNhIERRbEU3dwpoNE9FdlpHYXJFZVRYQnBZNFZPTUhLb3RDdWpNcWxtU2gv
+MVF5Tm1tdHBuK3NLQjBnM2JudFFwQVZnb0VpUUljCjhKQk5HQnVrY05yeU53QWhK
+MG9QUVN5M2NXUEw2eEhQajFmaHZ4cWpFaXcwd3ZrSzNRWFNRREl5bERac1Y2LzYK
+c3BDVXlvQ20xaUt4KzZVRkhiNU5TYkpsbGQraFdvM3RvSkFZRU54SUV4ZWNnVG0y
+VVR6Q2swV2RFeUZwNGZxdQoveVhYN3JXVXBpQzdxa1ZKVXROcXRDQXladml5c2ZD
+ZjFVSVRaUkZiRVlNUHA3bDg2ek9mcXJnVG9YYStza3BFCktzVXlyZHNCZ1BxYTBO
+TUt1T3ZYQmR2VjErdVpPWVBOVDlFZm14Ukp0dkdUamNxODZPNFNTMXNabzNWUzVT
+MHIKUkJocFBhNitCMzFkWUhyV29FU3RMWjkvMWNxbzJFbTBHb2NpbW9Cb1dheHhn
+Y0N6S2FIQ2NROWtqQm5ORWxtYwo1NnF2RVQybnY2Wm5CQlJZOXVTVVNLUGZIbWZh
+V2laZWFQaXhEaGdma3pIWnlSaFpjSlRqNHlRZGNiaWhsWXlYCi9UM0Z2MldUMW01
+ekZja1hLNXptaFVCVFN5UVVlRGh0L2wvekxEckNmNTJOTUdoUE9wRzFaNzhqQnpM
+dThmWDUKCi0+IHNzaC1lZDI1NTE5IENTTXloZyB5ZzV4Q1pIOGpBOEtUcG1rNVZB
+QjFPbEt0OThxNWl3V1VhRTV2RFVrUGhRCmpwSHpUTnhNdlRHMnRvYWk2emJlSlhJ
+aWwweUg5dG1rYmRMMEVDTVdHdnMKLS0tIHp6alVpN1IvQ2E5UEV0Zm1nQk53cWJQ
+WCtTN08wSXlCSktkaDlPRG9Wa0UKyLX9C4xDpcPIVFsimn4OmCWAKZ1IPxeSzgr0
+W6Shg1EWCeMm3dQVJ8O9mji4JW/SJHKwqlJvFTMPhIwcdIo=
+-----END AGE ENCRYPTED FILE-----

secrets/honcho-selfhost-jwt-secret.age

@@ -0,0 +1,31 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDVrd2NzQSBTNk5O
+dmZTRnRnOU5JMHU4QitlWWMyaXhscm1aQWNQSWJmVjU3MHdvVmowClkrVTV6VVVV
+Q0tiWXlkcGtHS3AwTUtqYmJwdnowMXFLcGNYb1dVZmpVTGcKLT4gc3NoLWVkMjU1
+MTkgM0JjcjF3IGVpdFlFTUFZQS9IMzVaRkNHSHltcHV1QlFmYk1yRitvZjhZZzI2
+ZDlTR3MKQ0RKT0tWZ0JGOUZCMTk2bitENmxnZzc1VDloNktvaVJFdGxyaVFaMjhJ
+VQotPiBzc2gtZWQyNTUxOSA5ZDRZSVEgdmw1MTg1R3lLR1NFNGUzQXpnUS9TNjRq
+czVtYlFzUmJnbmJ1c3JFRVZCQQoyYzBmQzdPbFVyU3diWlNuc1JoaHptOTFCUFBX
+RFpDZk4rWHByOGp2bkJFCi0+IHNzaC1lZDI1NTE5IDROTEtydyBIZWdsejNPVkdZ
+dkN3Z1FLTkNCVTdKSHNIOGU4UUUwdklhS0oxMlc5ekVjCnNZL0ZsV1VMU1p0eEFp
+YzBOdndIRzB3KzZXNGRFaHBpVDQ4Wm1jb2E1Z1kKLT4gc3NoLWVkMjU1MTkgYzRO
+UWxBIGFteVpubkxhcm80VEllY1llYkx4YXRTRHU4clNwK1F1SWlMTWxtMTYvRncK
+YjhvRXBod2I5dUZaWGlyOHcwa3MvWjNPOCtKendiMk9zVE5mVlpTS1RVMAotPiBz
+c2gtcnNhIERRbEU3dwpoenRXZkF2ck1LWDhxK25ldG1HVmRzVEh4TVNuaTdwQmVW
+eW80TE5kYzd5YkFpZXZhdWVSdEh4VTA2TzhnMzNsCkZud1AvTUdWSHJtOWtEZzlj
+ai9SdG1PRUtCN3VWQXlyamVpV1dWTEZkaFZpZHIxQ0c0eHIva1dzeDN6MlJla24K
+dXcrNUxUWVdMTFpaRk1YbkszazNDdFhuSVdxbE9rVHNNWDBvbDF4WGlWT0d5RTJR
+WmxCSFAzbDVVNWJneWhJZApPVnozRkRsS2J2VkFRVEpDVWJicmhhWXA0eVEvZFEz
+eWtsY3ZaNEk1MzlDYVJDb09lZGRsVk9YMXhyOWJsNmJYCk5HRTRjb0RrdlRydjNs
+T3prdXMvbnF0Y0FlL0VUbHNuVzZPNWJSK09TdEpuVU83dytiUDJRbmpFazludkkz
+d3AKUUp6TkVWSWRHMkozR0lQR1JlNmZ5Nk05WkUwbWJaODUzNmJIVkNEazVRcFFO
+ZnVZengyeFhQSlFsbUlta0tPRwo5OURlRTlPNERLWlF6aE9QaS91T0kyb2tIS0kz
+L0FYNjhWVWp1Q2xqUVRialcyWkhXbTJwU0R5VmVkbE1GeGEyCmROTFErS2VsMEo1
+VHdta2RObmtwMWtJTzRuaEhRbTFFbEE0V1RKbUk3SCtLWlE1cHR5c09ncThxbVY1
+cnRETkUKCi0+IHNzaC1lZDI1NTE5IENTTXloZyBZbW1NSStwWGd5RE1kRkk5aTZX
+alZtUWk5M3pnU1ZTSFU5UExnS0d4NkcwCjAvblBmUG5MUVVTOEpncjJjY0I1QzN1
+eVVNMlVZenJ6MzVDRXFaMVgxREUKLS0tIFIwd1ZtanJuU0Q2Ym9kN3lSS1NtQlky
+NC93UWJXa0tXTUVON3NmNVpUR0kKX71fenkAzKU3aIHFjLTpemNxsc5unQTy9f1O
+jpfhFHRPG5HuUBtmi6Fuv2n8J8Gw70D0XKs6UgAYV5GY0Db1daJZRbgF9EExbadB
+JQm3DLy8LG6KAM250ooGHKJoJSfQ
+-----END AGE ENCRYPTED FILE-----