feat: enable orchestrator + switch TTS to Edge (Katja voice)

- Enable delegation.orchestrator_enabled with max_spawn_depth=2
- Switch TTS from ElevenLabs (paid) to Edge TTS (free) with de-DE-KatjaNeural
- Katja is a warm, friendly German female voice — no API key required

.a5c/.gitignore

@@ -1,3 +0,0 @@
-node_modules/
-runs/
-*.log

.a5c/inputs/fix-eval-warnings-inputs.json

@@ -1,5 +0,0 @@
-{
-  "nixosConfigDir": "/home/m3tam3re/p/NIX/nixos-config",
-  "m3taHomeDir": "/home/m3tam3re/p/NIX/m3ta-home",
-  "specPath": "/home/m3tam3re/p/NIX/nixos-config/.a5c/inputs/fix-eval-warnings-spec.md"
-}

.a5c/inputs/fix-eval-warnings-spec.md

@@ -1,10 +0,0 @@
-Fix the following Nix/Home Manager evaluation warnings except for the gc/nh conflict warning:
-
-- `evaluation warning: 'system' has been renamed to/replaced by 'stdenv.hostPlatform.system'`
-- `evaluation warning: m3tam3re profile: programs.ssh.matchBlocks defined in /nix/store/...-users/m3tam3re/identities/private.nix is deprecated. Use programs.ssh.settings.`
-
-Do not fix or change the warning:
-
-- `evaluation warning: programs.nh.clean.enable and nix.gc.automatic are both enabled. Please use one or the other to avoid conflict.`
-
-The private identity source file is in `/home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix`.

.a5c/inputs/project-install.json

@@ -1,5 +0,0 @@
-{
-  "projectRoot": "/home/m3tam3re/p/NIX/nixos-config",
-  "isNewProject": false,
-  "additionalContext": "Install and configure babysitter for this existing NixOS flake configuration repository. Respect AGENTS.md instructions, Beads workflow, Nix conventions, and avoid interactive/destructive operations unless explicitly approved."
-}

.a5c/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "nixos-config-a5c",
-  "version": "1.0.0",
-  "private": true,
-  "type": "module",
-  "dependencies": {
-    "@a5c-ai/babysitter-sdk": "latest"
-  }
-}

.a5c/processes/fix-nix-eval-warnings.js

@@ -1,301 +0,0 @@
-/**
- * @process local/fix-nix-eval-warnings
- * @description Fix Nix/Home Manager evaluation warnings except the nh/gc conflict warning.
- * @skill systematic-debugging methodologies/superpowers/systematic-debugging.js
- * @skill verification-before-completion methodologies/superpowers/verification-before-completion.js
- * @skill root-cause-diagnosis methodologies/shared/root-cause-diagnosis.js
- */
-
-import { defineTask } from '@a5c-ai/babysitter-sdk';
-
-const q = (value) => `'${String(value).replace(/'/g, `'\\''`)}'`;
-
-export async function process(inputs, ctx) {
-  const nixosConfigDir = inputs.nixosConfigDir || '/home/m3tam3re/p/NIX/nixos-config';
-  const m3taHomeDir = inputs.m3taHomeDir || '/home/m3tam3re/p/NIX/m3ta-home';
-  const specPath = inputs.specPath || `${nixosConfigDir}/.a5c/inputs/fix-eval-warnings-spec.md`;
-
-  const spec = await ctx.task(readSpecTask, { specPath });
-
-  const inspection = await ctx.task(inspectWarningSourcesTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-  });
-
-  const implementation = await ctx.task(implementFixesTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-    spec: spec.stdout,
-    inspection: inspection.stdout,
-  });
-
-  const formatting = await ctx.task(formatChangedNixTask, {
-    m3taHomeDir,
-  });
-
-  const verification = await ctx.task(verifyWarningsTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-  });
-
-  const artifacts = await ctx.task(collectArtifactsTask, {
-    nixosConfigDir,
-    m3taHomeDir,
-    verifyStdout: verification.stdout || '',
-    verifyStderr: verification.stderr || '',
-  });
-
-  const acceptance = await ctx.task(acceptanceReviewTask, {
-    spec: spec.stdout,
-    artifacts: artifacts.stdout,
-  });
-
-  if (!acceptance.accepted) {
-    await ctx.breakpoint({
-      title: 'Warning fix acceptance review failed',
-      question: `Acceptance review did not approve the changes: ${acceptance.reason}`,
-      context: {
-        runId: ctx.runId,
-        files: [
-          { path: `${m3taHomeDir}/users/m3tam3re/identities/private.nix`, format: 'nix', label: 'Private SSH identity' },
-          { path: `${m3taHomeDir}/profiles/sets/coding/agents/agents.nix`, format: 'nix', label: 'Agent packages' },
-          { path: `${m3taHomeDir}/profiles/contexts/desktop/default.nix`, format: 'nix', label: 'Desktop packages' },
-        ],
-      },
-    });
-  }
-
-  return {
-    success: acceptance.accepted,
-    summary: implementation.summary,
-    changedFiles: implementation.changedFiles,
-    verification: {
-      formatting: formatting.stdout,
-      warnings: verification.stdout,
-      review: acceptance,
-    },
-  };
-}
-
-export const readSpecTask = defineTask('read-spec', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Read warning-fix spec',
-  shell: {
-    command: `cat ${q(args.specPath)}`,
-    expectedExitCode: 0,
-    timeout: 10000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['spec', 'shell'],
-}));
-
-export const inspectWarningSourcesTask = defineTask('inspect-warning-sources', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Inspect current warning sources',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== nixos-config status =='`,
-      `cd ${q(args.nixosConfigDir)} && git status --short`,
-      `echo`,
-      `echo '== m3ta-home status =='`,
-      `cd ${q(args.m3taHomeDir)} && git status --short`,
-      `echo`,
-      `echo '== active pkgs.system-style package selectors =='`,
-      `grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(args.nixosConfigDir)} ${q(args.m3taHomeDir)} || true`,
-      `echo`,
-      `echo '== SSH matchBlocks in m3ta-home identities =='`,
-      `grep -RIn --include='*.nix' 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities`)} || true`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 30000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['diagnosis', 'shell'],
-}));
-
-export const implementFixesTask = defineTask('implement-warning-fixes', (args, taskCtx) => ({
-  kind: 'agent',
-  title: 'Implement requested warning fixes',
-  agent: {
-    name: 'worker',
-    prompt: {
-      role: 'Nix/Home Manager maintenance engineer',
-      task: 'Edit the repositories to remove the requested evaluation warnings, excluding the nh/gc warning by request.',
-      context: {
-        nixosConfigDir: args.nixosConfigDir,
-        m3taHomeDir: args.m3taHomeDir,
-        specVerbatim: args.spec,
-        inspectionStdout: args.inspection,
-      },
-      instructions: [
-        'Execute the task fully; do not just provide a plan.',
-        'Do not invoke the babysit skill or create another babysitter run.',
-        'Read every file before editing it.',
-        'Preserve unrelated existing user changes, especially any dirty files in nixos-config such as flake.nix or flake.lock.',
-        'Fix active uses of pkgs.system/prev.system/final.system that trigger the Nixpkgs deprecation warning by using stdenv.hostPlatform.system through the appropriate package set.',
-        'Migrate /home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix from programs.ssh.matchBlocks to programs.ssh.settings.',
-        'For programs.ssh.settings, use OpenSSH directive names such as HostName, User, Port, and IdentityFile; do not keep legacy camelCase option names under settings.',
-        'Do not change programs.nh.clean.enable or nix.gc.automatic; the user explicitly excluded that warning.',
-        'Keep the change minimal and focused on the warnings in the spec.',
-        'Run a quick static check of the edited files if practical, but leave deterministic verification to the process quality gate.',
-      ],
-      outputFormat: 'JSON with summary, changedFiles, and verificationNotes.',
-    },
-    outputSchema: {
-      type: 'object',
-      required: ['summary', 'changedFiles', 'verificationNotes'],
-      properties: {
-        summary: { type: 'string' },
-        changedFiles: { type: 'array', items: { type: 'string' } },
-        verificationNotes: { type: 'array', items: { type: 'string' } },
-      },
-    },
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['implementation', 'agent', 'nix'],
-}));
-
-export const formatChangedNixTask = defineTask('format-changed-nix', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Format changed Nix files',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `cd ${q(args.m3taHomeDir)}`,
-      `if command -v alejandra >/dev/null 2>&1; then`,
-      `  alejandra users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `else`,
-      `  nix run nixpkgs#alejandra -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `fi`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 120000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['format', 'shell'],
-}));
-
-export const verifyWarningsTask = defineTask('verify-warning-removal', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Verify requested warnings are gone',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== static checks =='`,
-      `! grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(`${args.m3taHomeDir}/profiles`)} || { echo 'Found deprecated package system selector' >&2; exit 1; }`,
-      `! grep -n 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)} || { echo 'private.nix still uses matchBlocks' >&2; exit 1; }`,
-      `grep -n 'settings = {' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)}`,
-      `echo`,
-      `echo '== nix eval m3-ares =='`,
-      `cd ${q(args.nixosConfigDir)}`,
-      `eval_stdout=$(mktemp)`,
-      `eval_stderr=$(mktemp)`,
-      `set +e`,
-      `nix eval .#nixosConfigurations.m3-ares.config.system.build.toplevel.drvPath --show-trace >"$eval_stdout" 2>"$eval_stderr"`,
-      `status=$?`,
-      `set -e`,
-      `cat "$eval_stdout"`,
-      `cat "$eval_stderr" >&2`,
-      `if [ "$status" -ne 0 ]; then exit "$status"; fi`,
-      `if grep -F "'system' has been renamed" "$eval_stderr"; then echo 'Deprecated system warning still present' >&2; exit 1; fi`,
-      `if grep -F 'programs.ssh.matchBlocks' "$eval_stderr"; then echo 'Deprecated SSH matchBlocks warning still present' >&2; exit 1; fi`,
-      `if grep -F 'programs.nh.clean.enable and nix.gc.automatic' "$eval_stderr" >/dev/null; then echo 'Allowed nh/gc warning remains by request.'; fi`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 300000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['verification', 'shell', 'nix'],
-}));
-
-export const collectArtifactsTask = defineTask('collect-artifacts', (args, taskCtx) => ({
-  kind: 'shell',
-  title: 'Collect diffs and verification output',
-  shell: {
-    command: [
-      'set -euo pipefail',
-      `echo '== m3ta-home diff =='`,
-      `cd ${q(args.m3taHomeDir)} && git diff -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
-      `echo`,
-      `echo '== nixos-config diff (should not include warning fix unless needed) =='`,
-      `cd ${q(args.nixosConfigDir)} && git diff -- overlays/default.nix flake.nix flake.lock || true`,
-      `echo`,
-      `echo '== verification stdout =='`,
-      `cat <<'VERIFY_STDOUT'`,
-      args.verifyStdout || '',
-      `VERIFY_STDOUT`,
-      `echo`,
-      `echo '== verification stderr =='`,
-      `cat <<'VERIFY_STDERR'`,
-      args.verifyStderr || '',
-      `VERIFY_STDERR`,
-    ].join('\n'),
-    expectedExitCode: 0,
-    timeout: 30000,
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['artifacts', 'shell'],
-}));
-
-export const acceptanceReviewTask = defineTask('acceptance-review', (args, taskCtx) => ({
-  kind: 'agent',
-  title: 'Review changes against requested warning fixes',
-  agent: {
-    name: 'reviewer',
-    prompt: {
-      role: 'Acceptance reviewer for a Nix/Home Manager warning fix',
-      task: 'Compare SPEC to ARTIFACTS directly and decide whether the requested warnings were fixed without touching the excluded nh/gc warning.',
-      instructions: [
-        'Ignore any narrative in your context about how ARTIFACTS were built.',
-        'Do not ask for additional changes unless they are required by the SPEC.',
-        'Accept if the system deprecation warning and private SSH matchBlocks warning are addressed, and the nh/gc conflict remains untouched.',
-        '',
-        'SPEC (verbatim):',
-        '---',
-        args.spec,
-        '---',
-        '',
-        'ARTIFACTS (verbatim):',
-        '---',
-        args.artifacts,
-        '---',
-        '',
-        'Compare SPEC to ARTIFACTS directly. Ignore any narrative in your context about how ARTIFACTS were built.',
-      ],
-      outputFormat: 'JSON with accepted boolean, reason string, and checkedCriteria array.',
-    },
-    outputSchema: {
-      type: 'object',
-      required: ['accepted', 'reason', 'checkedCriteria'],
-      properties: {
-        accepted: { type: 'boolean' },
-        reason: { type: 'string' },
-        checkedCriteria: { type: 'array', items: { type: 'string' } },
-      },
-    },
-  },
-  io: {
-    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
-    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
-  },
-  labels: ['acceptance', 'agent', 'review'],
-}));

.a5c/project-profile.json

@@ -1,596 +0,0 @@
-{
-  "projectName": "nixos-config",
-  "description": "A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.",
-  "goals": [
-    {
-      "id": "goal-reliability-1",
-      "description": "Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment.",
-      "category": "reliability",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-architecture-1",
-      "description": "Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules.",
-      "category": "architecture",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-modularization-1",
-      "description": "Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate.",
-      "category": "modularization",
-      "priority": "high",
-      "status": "active"
-    },
-    {
-      "id": "goal-cicd-1",
-      "description": "CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks.",
-      "category": "automation",
-      "priority": "medium",
-      "status": "deferred"
-    }
-  ],
-  "techStack": {
-    "languages": [
-      {
-        "name": "Nix",
-        "role": "primary system, module, overlay, and package configuration language"
-      },
-      {
-        "name": "Markdown",
-        "role": "project, agent, and workflow documentation"
-      },
-      {
-        "name": "JSON/YAML",
-        "role": "tool configuration and metadata"
-      }
-    ],
-    "frameworks": [
-      {
-        "name": "Nix flakes",
-        "category": "reproducible dependency and output model"
-      },
-      {
-        "name": "NixOS modules",
-        "category": "host and service configuration"
-      },
-      {
-        "name": "Home Manager",
-        "category": "user environment management"
-      },
-      {
-        "name": "Agenix",
-        "category": "encrypted secret management"
-      },
-      {
-        "name": "Disko",
-        "category": "server disk provisioning"
-      },
-      {
-        "name": "NUR",
-        "category": "community package access"
-      },
-      {
-        "name": "llm-agents.nix",
-        "category": "LLM agent packages overlay"
-      },
-      {
-        "name": "m3ta-home",
-        "category": "external reusable Home Manager profiles"
-      },
-      {
-        "name": "m3ta-nixpkgs",
-        "category": "external custom packages/modules/overlays"
-      }
-    ],
-    "databases": [],
-    "infrastructure": [
-      {
-        "name": "m3-ares",
-        "category": "desktop NixOS host"
-      },
-      {
-        "name": "m3-kratos",
-        "category": "desktop NixOS host"
-      },
-      {
-        "name": "m3-daedalus",
-        "category": "portable laptop/Home Manager configuration"
-      },
-      {
-        "name": "m3-atlas",
-        "category": "primary server NixOS host"
-      },
-      {
-        "name": "m3-helios",
-        "category": "minimal server/AdGuard host"
-      },
-      {
-        "name": "m3-hermes",
-        "category": "secondary server/Hermes host"
-      },
-      {
-        "name": "m3-aether",
-        "category": "cloud VM/minimal server host"
-      }
-    ],
-    "buildTools": [
-      "nix",
-      "nixos-rebuild",
-      "nix build",
-      "nix flake show",
-      "alejandra",
-      "statix",
-      "deadnix"
-    ],
-    "packageManagers": [
-      "nix flakes"
-    ]
-  },
-  "architecture": {
-    "pattern": "Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.",
-    "modules": [
-      {
-        "name": "flake.nix",
-        "path": "flake.nix",
-        "description": "Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells."
-      },
-      {
-        "name": "hosts/common",
-        "path": "hosts/common",
-        "description": "Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users."
-      },
-      {
-        "name": "hosts",
-        "path": "hosts",
-        "description": "Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM."
-      },
-      {
-        "name": "modules/nixos",
-        "path": "modules/nixos",
-        "description": "Reusable NixOS modules."
-      },
-      {
-        "name": "modules/home-manager",
-        "path": "modules/home-manager",
-        "description": "Reusable Home Manager module exports."
-      },
-      {
-        "name": "overlays",
-        "path": "overlays",
-        "description": "Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages."
-      },
-      {
-        "name": "pkgs",
-        "path": "pkgs",
-        "description": "Custom package export set."
-      },
-      {
-        "name": "secrets",
-        "path": "secrets",
-        "description": "Encrypted agenix secret files and registry."
-      }
-    ],
-    "entryPoints": [
-      "flake.nix",
-      "hosts/<host>/default.nix",
-      "hosts/<host>/configuration.nix",
-      "hosts/common/default.nix",
-      "hosts/common/users/m3tam3re.nix",
-      "overlays/default.nix",
-      "pkgs/default.nix",
-      "secrets.nix"
-    ],
-    "dataFlow": "flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules."
-  },
-  "team": [
-    {
-      "name": "m3tam3re",
-      "role": "solo developer and operator",
-      "responsibilities": [
-        "architecture",
-        "implementation",
-        "host maintenance",
-        "deployments",
-        "review"
-      ]
-    },
-    {
-      "name": "m3ta-chiron",
-      "role": "agent contributor",
-      "responsibilities": [
-        "semi-autonomous implementation",
-        "validation",
-        "documentation updates",
-        "conventional commits"
-      ]
-    }
-  ],
-  "workflows": [
-    {
-      "name": "development",
-      "description": "Default feature-branch workflow for solo development with conventional commits and validation before push.",
-      "steps": [
-        "review Beads issues with bd ready --json",
-        "claim work with bd update <id> --claim when applicable",
-        "edit Nix modules or project files",
-        "run alejandra .",
-        "run statix check .",
-        "run targeted nix flake or host dry-run checks",
-        "commit with conventional commit format",
-        "pull --rebase and push"
-      ],
-      "triggers": [
-        "new feature",
-        "bug fix",
-        "refactor",
-        "agent task"
-      ]
-    },
-    {
-      "name": "nix validation",
-      "description": "Quality gate for Nix configuration changes.",
-      "steps": [
-        "alejandra .",
-        "statix check .",
-        "deadnix check or deadnix -w when appropriate",
-        "nix flake show",
-        "sudo nixos-rebuild dry-run --flake .#<host> for affected hosts"
-      ],
-      "triggers": [
-        "Nix code changes",
-        "before deployment",
-        "before commit"
-      ]
-    },
-    {
-      "name": "host deployment",
-      "description": "Manual deployment after successful dry-run validation.",
-      "steps": [
-        "sudo nixos-rebuild dry-run --flake .#<host>",
-        "sudo nixos-rebuild switch --flake .#<host>"
-      ],
-      "triggers": [
-        "manual host update"
-      ]
-    },
-    {
-      "name": "dependency/input update",
-      "description": "Controlled flake input updates without manually editing flake.lock.",
-      "steps": [
-        "use nix flake update or nixos-rebuild --update-input <input>",
-        "validate affected outputs",
-        "commit flake.nix/flake.lock changes"
-      ],
-      "triggers": [
-        "planned dependency update",
-        "security update"
-      ]
-    },
-    {
-      "name": "beads issue tracking",
-      "description": "Persistent issue tracking and session handoff workflow.",
-      "steps": [
-        "bd ready --json",
-        "bd show <id>",
-        "bd update <id> --claim",
-        "bd close <id> --reason <summary>",
-        "bd dolt push"
-      ],
-      "triggers": [
-        "start of tracked work",
-        "completion of tracked work"
-      ]
-    }
-  ],
-  "processes": [
-    {
-      "id": "cradle/project-install",
-      "name": "Babysitter project install",
-      "status": "installing",
-      "purpose": "Create and save a Babysitter project profile and setup recommendations."
-    }
-  ],
-  "tools": {
-    "formatting": [
-      {
-        "name": "alejandra",
-        "purpose": "Nix formatting",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      }
-    ],
-    "linting": [
-      {
-        "name": "statix",
-        "purpose": "Nix anti-pattern linting",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      },
-      {
-        "name": "deadnix",
-        "purpose": "Detect unused Nix code",
-        "configPaths": [
-          "flake.nix devShells.default"
-        ]
-      }
-    ],
-    "testing": [
-      {
-        "name": "nix flake show",
-        "purpose": "Evaluate flake outputs",
-        "configPaths": [
-          "flake.nix"
-        ]
-      },
-      {
-        "name": "nixos-rebuild dry-run",
-        "purpose": "Validate host configurations without applying changes",
-        "configPaths": [
-          "flake.nix",
-          "hosts/*"
-        ]
-      },
-      {
-        "name": "nix build",
-        "purpose": "Build selected outputs such as host toplevels or ISOs",
-        "configPaths": [
-          "flake.nix"
-        ]
-      }
-    ],
-    "issueTracking": [
-      {
-        "name": "Beads",
-        "command": "bd",
-        "purpose": "Persistent task tracking"
-      }
-    ]
-  },
-  "services": [
-    {
-      "name": "code.m3ta.dev",
-      "type": "git hosting",
-      "url": "git+ssh://gitea@code.m3ta.dev"
-    },
-    {
-      "name": "GitHub",
-      "type": "flake input hosting",
-      "url": "github:* flake inputs"
-    },
-    {
-      "name": "Agenix",
-      "type": "secret encryption",
-      "url": "github:ryantm/agenix"
-    },
-    {
-      "name": "Hermes Agent",
-      "type": "NixOS module/agent service",
-      "url": "github:NousResearch/hermes-agent"
-    },
-    {
-      "name": "RustFS",
-      "type": "NixOS server service flake",
-      "url": "github:rustfs/rustfs-flake"
-    }
-  ],
-  "externalIntegrations": [
-    {
-      "service": "Beads",
-      "category": "issue tracking",
-      "enabled": true
-    },
-    {
-      "service": "Dolt",
-      "category": "Beads storage/sync",
-      "enabled": true
-    },
-    {
-      "service": "Agenix",
-      "category": "secrets",
-      "enabled": true
-    },
-    {
-      "service": "Home Manager",
-      "category": "user environment",
-      "enabled": true
-    },
-    {
-      "service": "m3ta-home",
-      "category": "external home profiles",
-      "enabled": true
-    },
-    {
-      "service": "m3ta-nixpkgs",
-      "category": "external Nix modules/packages",
-      "enabled": true
-    },
-    {
-      "service": "NUR",
-      "category": "Nix packages",
-      "enabled": true
-    },
-    {
-      "service": "Disko",
-      "category": "disk provisioning",
-      "enabled": true
-    },
-    {
-      "service": "Hermes Agent",
-      "category": "LLM/agent service",
-      "enabled": true
-    }
-  ],
-  "cicd": {
-    "provider": null,
-    "enabled": false,
-    "configPaths": [],
-    "pipelines": [],
-    "notes": "CI/CD is intentionally disabled for now. If re-enabled later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.",
-    "babysitterIntegration": {
-      "enabled": false,
-      "triggerOn": [],
-      "processIds": []
-    }
-  },
-  "painPoints": [
-    {
-      "id": "pp-architecture-1",
-      "description": "The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.",
-      "severity": "high",
-      "category": "architecture",
-      "discoveredVia": "user interview",
-      "suggestedRemediation": "Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs."
-    },
-    {
-      "id": "pp-validation-1",
-      "description": "A single shared Nix change can require validating several hosts to be confident.",
-      "severity": "medium",
-      "category": "validation",
-      "discoveredVia": "repo structure and AGENTS workflow",
-      "suggestedRemediation": "Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled."
-    },
-    {
-      "id": "pp-dependency-1",
-      "description": "Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.",
-      "severity": "medium",
-      "category": "dependency management",
-      "discoveredVia": "flake and history analysis",
-      "suggestedRemediation": "Update inputs intentionally, group related updates, and validate affected host outputs."
-    },
-    {
-      "id": "pp-operations-1",
-      "description": "Service additions often need synchronized module, secret, and network/TLS changes.",
-      "severity": "medium",
-      "category": "operations",
-      "discoveredVia": "git history and tree structure",
-      "suggestedRemediation": "Use checklist-style issue templates or Babysitter processes for service changes."
-    }
-  ],
-  "bottlenecks": [
-    {
-      "id": "bn-flake-1",
-      "description": "flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once.",
-      "impact": "High; evaluation failures can block all hosts.",
-      "location": "flake.nix, flake.lock",
-      "frequency": "very frequent"
-    },
-    {
-      "id": "bn-secrets-1",
-      "description": "Secret registry and host secret modules must stay aligned with encrypted .age files.",
-      "impact": "Medium to high; missing or mismatched secrets break host deployment.",
-      "location": "secrets.nix, hosts/*/secrets.nix, secrets/*.age",
-      "frequency": "recurring"
-    },
-    {
-      "id": "bn-services-1",
-      "description": "Server service changes can span service modules, secrets, Traefik/networking, and flake inputs.",
-      "impact": "High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.",
-      "location": "hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common",
-      "frequency": "frequent"
-    },
-    {
-      "id": "bn-home-1",
-      "description": "Home Manager behavior depends on both the external m3ta-home input and local host flags.",
-      "impact": "Medium; may require coordinated updates across repositories.",
-      "location": "flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input",
-      "frequency": "frequent after migration"
-    }
-  ],
-  "conventions": {
-    "naming": {
-      "files": "hyphen-case for Nix/docs where practical; host directories use m3-* names",
-      "hosts": "m3-<greek-name>",
-      "modules": "one module per file/directory where possible",
-      "nixVariables": "camelCase"
-    },
-    "git": {
-      "branchStrategy": "default feature branches for non-trivial work; master as integration branch",
-      "commits": "conventional commits for agent work",
-      "reviews": "optional for solo development",
-      "releaseCadence": "continuous/manual as needed",
-      "remote": "code.m3ta.dev over SSH for private inputs and repo access"
-    },
-    "codeStyle": {
-      "formatter": "alejandra",
-      "indentation": "2 spaces",
-      "nixStyle": "explicit pkgs references preferred; avoid with pkgs, builtins.fetchTarball, import <nixpkgs>, builtins.getAttr/hasAttr"
-    },
-    "importOrder": [
-      "module function arguments",
-      "imports",
-      "let bindings",
-      "options/config"
-    ],
-    "errorHandling": "Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.",
-    "testingConventions": "Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.",
-    "additionalRules": [
-      "Use Beads for persistent task tracking.",
-      "Use non-interactive flags for shell file operations.",
-      "Do not modify flake.lock directly; use nix flake update.",
-      "Do not commit plaintext secrets.",
-      "Use SSH URLs for code.m3ta.dev flake inputs.",
-      "Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions."
-    ]
-  },
-  "repositories": [
-    {
-      "name": "nixos-config",
-      "path": "/home/m3tam3re/p/NIX/nixos-config",
-      "role": "primary multi-host NixOS configuration"
-    },
-    {
-      "name": "m3ta-home",
-      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home",
-      "role": "external Home Manager profiles"
-    },
-    {
-      "name": "m3ta-nixpkgs",
-      "url": "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs",
-      "role": "external custom packages/modules/overlays"
-    }
-  ],
-  "claudeMdInstructions": [
-    "Respect AGENTS.md as the source of project workflow rules.",
-    "Resolve the active Babysitter process library before using library processes.",
-    "Use cradle/project-install for project setup or profile refresh.",
-    "Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.",
-    "Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.",
-    "Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.",
-    "Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.",
-    "Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions."
-  ],
-  "installedSkills": [
-    "project-install",
-    "babysit",
-    "specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md",
-    "specializations/devops-sre-platform/skills/gitops/SKILL.md",
-    "specializations/devops-sre-platform/skills/secrets-management/SKILL.md"
-  ],
-  "installedAgents": [
-    "general-purpose",
-    "specializations/devops-sre-platform/agents/platform-engineer/AGENT.md",
-    "specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md"
-  ],
-  "installedProcesses": [
-    "cradle/project-install",
-    "methodologies/gsd/quick.js",
-    "methodologies/gsd/verify-work.js",
-    "methodologies/gsd/iterative-convergence.js",
-    "methodologies/evolutionary.js",
-    "specializations/devops-sre-platform/iac-testing.js"
-  ],
-  "preferences": {
-    "babysitterAutonomy": "semi-autonomous",
-    "breakpointTolerance": "moderate",
-    "externalIntegrationsRequested": false,
-    "cicdDesired": false,
-    "cicdNote": "Deferred for now; Gitea Actions is the preferred provider if CI/CD is added later."
-  },
-  "createdAt": "2026-05-29T15:50:48.754Z",
-  "updatedAt": "2026-05-29T16:07:19.245463Z",
-  "version": 1
-}

.a5c/project-profile.md

@@ -1,238 +0,0 @@
-# Project Profile: nixos-config
-
-A reliable, elegant, multi-system NixOS flake configuration for personal desktop, server, cloud, Home Manager, package, overlay, and secret management.
-
-> Last updated: 2026-05-29T16:02:11.092188Z | Version: 1
-
-## Goals
-
-- **reliability** [high]: Keep all managed NixOS systems reproducible, reliable, and easy to validate before deployment. (active)
-- **architecture** [high]: Maintain an elegant multi-system architecture with clear host boundaries and reusable common modules. (active)
-- **modularization** [high]: Continue breaking up the former monorepo by keeping Home Manager profiles in m3ta-home and custom packages/modules in m3ta-nixpkgs where appropriate. (active)
-- **automation** [medium]: CI/CD is not currently configured; add useful Gitea Actions validation later for formatting, linting, flake evaluation, and safe host checks. (deferred)
-
-## Tech Stack
-
-### Languages
-
-- Nix (primary system, module, overlay, and package configuration language)
-- Markdown (project, agent, and workflow documentation)
-- JSON/YAML (tool configuration and metadata)
-
-### Frameworks
-
-- Nix flakes [reproducible dependency and output model]
-- NixOS modules [host and service configuration]
-- Home Manager [user environment management]
-- Agenix [encrypted secret management]
-- Disko [server disk provisioning]
-- NUR [community package access]
-- llm-agents.nix [LLM agent packages overlay]
-- m3ta-home [external reusable Home Manager profiles]
-- m3ta-nixpkgs [external custom packages/modules/overlays]
-
-### Infrastructure
-
-- m3-ares [desktop NixOS host]
-- m3-kratos [desktop NixOS host]
-- m3-daedalus [portable laptop/Home Manager configuration]
-- m3-atlas [primary server NixOS host]
-- m3-helios [minimal server/AdGuard host]
-- m3-hermes [secondary server/Hermes host]
-- m3-aether [cloud VM/minimal server host]
-
-**Build tools:** nix, nixos-rebuild, nix build, nix flake show, alejandra, statix, deadnix
-
-**Package managers:** nix flakes
-
-## Architecture
-
-**Pattern:** Pure Nix flake-based NixOS configuration repository with host-specific modules, common shared modules, overlays, custom packages, agenix secrets, and externalized Home Manager/package inputs.
-**Data flow:** flake.nix wires inputs, overlays, packages, NixOS modules, and Home Manager. Host modules import common configuration and host-specific hardware/programs/services/secrets. Host profile flags in hosts/common/users/m3tam3re.nix feed the external m3ta-home mkHome integration. Secrets flow through agenix registry and host secret modules.
-
-### Modules
-
-| Module | Path | Description |
-|--------|------|-------------|
-| flake.nix | `flake.nix` | Top-level entry point defining inputs, packages, overlays, Home Manager modules, NixOS configurations, and dev shells. |
-| hosts/common | `hosts/common` | Shared NixOS configuration, nix settings, overlays, Home Manager setup, ports, extra services, and users. |
-| hosts | `hosts` | Per-host NixOS/Home Manager configurations for desktops, servers, and cloud VM. |
-| modules/nixos | `modules/nixos` | Reusable NixOS modules. |
-| modules/home-manager | `modules/home-manager` | Reusable Home Manager module exports. |
-| overlays | `overlays` | Nixpkgs overlays for stable, locked, pinned, master, temporary, and agent packages. |
-| pkgs | `pkgs` | Custom package export set. |
-| secrets | `secrets` | Encrypted agenix secret files and registry. |
-
-**Entry points:** `flake.nix`, `hosts/<host>/default.nix`, `hosts/<host>/configuration.nix`, `hosts/common/default.nix`, `hosts/common/users/m3tam3re.nix`, `overlays/default.nix`, `pkgs/default.nix`, `secrets.nix`
-
-## Team
-
-- **m3tam3re** (solo developer and operator): architecture, implementation, host maintenance, deployments, review
-- **m3ta-chiron** (agent contributor): semi-autonomous implementation, validation, documentation updates, conventional commits
-
-## Workflows
-
-### development
-
-Default feature-branch workflow for solo development with conventional commits and validation before push.
-**Triggers:** new feature, bug fix, refactor, agent task
-
-1. review Beads issues with bd ready --json
-2. claim work with bd update <id> --claim when applicable
-3. edit Nix modules or project files
-4. run alejandra .
-5. run statix check .
-6. run targeted nix flake or host dry-run checks
-7. commit with conventional commit format
-8. pull --rebase and push
-
-### nix validation
-
-Quality gate for Nix configuration changes.
-**Triggers:** Nix code changes, before deployment, before commit
-
-1. alejandra .
-2. statix check .
-3. deadnix check or deadnix -w when appropriate
-4. nix flake show
-5. sudo nixos-rebuild dry-run --flake .#<host> for affected hosts
-
-### host deployment
-
-Manual deployment after successful dry-run validation.
-**Triggers:** manual host update
-
-1. sudo nixos-rebuild dry-run --flake .#<host>
-2. sudo nixos-rebuild switch --flake .#<host>
-
-### dependency/input update
-
-Controlled flake input updates without manually editing flake.lock.
-**Triggers:** planned dependency update, security update
-
-1. use nix flake update or nixos-rebuild --update-input <input>
-2. validate affected outputs
-3. commit flake.nix/flake.lock changes
-
-### beads issue tracking
-
-Persistent issue tracking and session handoff workflow.
-**Triggers:** start of tracked work, completion of tracked work
-
-1. bd ready --json
-2. bd show <id>
-3. bd update <id> --claim
-4. bd close <id> --reason <summary>
-5. bd dolt push
-
-## Processes
-
-- **Babysitter project install** (`cradle/project-install`, undefined)
-
-## Tools
-
-### Linting
-
-- statix
-- deadnix
-
-### Testing
-
-- nix flake show
-- nixos-rebuild dry-run
-- nix build
-
-### Formatting
-
-- alejandra
-
-## Services
-
-- **code.m3ta.dev** (git hosting) - git+ssh://gitea@code.m3ta.dev
-- **GitHub** (flake input hosting) - github:* flake inputs
-- **Agenix** (secret encryption) - github:ryantm/agenix
-- **Hermes Agent** (NixOS module/agent service) - github:NousResearch/hermes-agent
-- **RustFS** (NixOS server service flake) - github:rustfs/rustfs-flake
-
-## CI/CD
-
-**Status:** Not configured/enabled for now.
-
-No Babysitter CI/CD workflow is currently installed. If CI/CD is added later, prefer Gitea Actions because this repository is hosted on code.m3ta.dev.
-
-## Pain Points
-
-- **high** [architecture]: The repository is transitioning away from a monorepo; boundaries with m3ta-home and m3ta-nixpkgs must remain clear.
-  - Remediation: Keep host-specific decisions local while moving reusable Home Manager profiles and package/module abstractions to their dedicated inputs.
-- **medium** [validation]: A single shared Nix change can require validating several hosts to be confident.
-  - Remediation: Use targeted affected-host validation locally for now; add a Gitea Actions validation matrix later if CI/CD is re-enabled.
-- **medium** [dependency management]: Multiple pinned, locked, stable, master, and external SSH flake inputs increase update complexity.
-  - Remediation: Update inputs intentionally, group related updates, and validate affected host outputs.
-- **medium** [operations]: Service additions often need synchronized module, secret, and network/TLS changes.
-  - Remediation: Use checklist-style issue templates or Babysitter processes for service changes.
-
-## Bottlenecks
-
-- flake.nix and flake.lock are high-churn files whose changes can affect many hosts at once. at flake.nix, flake.lock (very frequent)
-  Impact: High; evaluation failures can block all hosts.
-- Secret registry and host secret modules must stay aligned with encrypted .age files. at secrets.nix, hosts/*/secrets.nix, secrets/*.age (recurring)
-  Impact: Medium to high; missing or mismatched secrets break host deployment.
-- Server service changes can span service modules, secrets, Traefik/networking, and flake inputs. at hosts/m3-atlas/services, hosts/m3-hermes/services, hosts/common (frequent)
-  Impact: High for m3-atlas and m3-hermes changes; requires host-specific dry-runs.
-- Home Manager behavior depends on both the external m3ta-home input and local host flags. at flake.nix, hosts/common/users/m3tam3re.nix, m3ta-home input (frequent after migration)
-  Impact: Medium; may require coordinated updates across repositories.
-
-## Conventions
-
-### Naming
-
-- **files:** hyphen-case for Nix/docs where practical; host directories use m3-* names
-- **hosts:** m3-<greek-name>
-- **modules:** one module per file/directory where possible
-- **nixVariables:** camelCase
-
-### Git
-
-- **branchStrategy:** default feature branches for non-trivial work; master as integration branch
-- **commits:** conventional commits for agent work
-- **reviews:** optional for solo development
-- **releaseCadence:** continuous/manual as needed
-- **remote:** code.m3ta.dev over SSH for private inputs and repo access
-
-**Import order:** module function arguments > imports > let bindings > options/config
-
-**Error handling:** Nix configuration should fail explicitly during evaluation/build; avoid hiding errors or impure paths.
-
-**Testing:** Run alejandra, statix, deadnix as appropriate, nix flake show, and host-specific nixos-rebuild dry-run before switching.
-
-### Additional Rules
-
-- Use Beads for persistent task tracking.
-- Use non-interactive flags for shell file operations.
-- Do not modify flake.lock directly; use nix flake update.
-- Do not commit plaintext secrets.
-- Use SSH URLs for code.m3ta.dev flake inputs.
-- Operate Babysitter semi-autonomously with breakpoints for destructive, deployment, or architecture-changing decisions.
-
-## Repositories
-
-- **nixos-config** [`/home/m3tam3re/p/NIX/nixos-config`]
-- **m3ta-home** - git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home
-- **m3ta-nixpkgs** - git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs
-
-## CLAUDE.md Instructions
-
-- Respect AGENTS.md as the source of project workflow rules.
-- Resolve the active Babysitter process library before using library processes.
-- Use cradle/project-install for project setup or profile refresh.
-- Use evolutionary GSD: map affected Nix modules/hosts, make focused changes, verify, and iterate.
-- Prefer alejandra, statix, deadnix, nix flake show, and targeted host dry-runs for Nix changes.
-- Preserve boundaries between nixos-config, m3ta-home, and m3ta-nixpkgs.
-- Use breakpoints for destructive operations, deployments, architecture changes, and secret-handling decisions.
-- Babysitter CI/CD is not currently enabled; if re-added later, use Gitea Actions rather than GitHub Actions.
-
-## Installed Extensions
-
-- Skills: project-install, babysit, specializations/devops-sre-platform/skills/cicd-pipelines/SKILL.md, specializations/devops-sre-platform/skills/gitops/SKILL.md, specializations/devops-sre-platform/skills/secrets-management/SKILL.md
-- Agents: general-purpose, specializations/devops-sre-platform/agents/platform-engineer/AGENT.md, specializations/devops-sre-platform/agents/cicd-specialist/AGENT.md
-- Processes: cradle/project-install, methodologies/gsd/quick.js, methodologies/gsd/verify-work.js, methodologies/gsd/iterative-convergence.js, methodologies/evolutionary.js, specializations/devops-sre-platform/iac-testing.js

.a5c/quality-gates.json

@@ -1,53 +0,0 @@
-{
-  "qualityThreshold": 80,
-  "testCoverage": {
-    "minimum": 0,
-    "rationale": "NixOS configuration repository without a coverage-producing test suite."
-  },
-  "formatting": [
-    {
-      "name": "alejandra",
-      "command": "alejandra .",
-      "ciCommand": "alejandra --check ."
-    }
-  ],
-  "linting": [
-    {
-      "name": "statix",
-      "command": "statix check ."
-    },
-    {
-      "name": "deadnix",
-      "command": "deadnix . --fail"
-    }
-  ],
-  "evaluation": [
-    {
-      "name": "flake outputs",
-      "command": "nix flake show"
-    },
-    {
-      "name": "affected host dry-run",
-      "command": "sudo nixos-rebuild dry-run --flake .#<host>",
-      "when": "Run for affected hosts when practical and safe."
-    }
-  ],
-  "commitChecks": [
-    "alejandra .",
-    "statix check .",
-    "deadnix . --fail",
-    "nix flake show"
-  ],
-  "deployGates": [
-    "formatting passes",
-    "linting passes",
-    "flake outputs evaluate",
-    "affected host dry-run succeeds",
-    "secrets are encrypted and host secret modules remain aligned"
-  ],
-  "cicdIntegrationPoints": [],
-  "cicd": {
-    "enabled": false,
-    "notes": "No CI/CD integration is currently configured. Add Gitea Actions later if automated Babysitter or Nix validation is desired."
-  }
-}

.beads/hooks/post-checkout

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.3 ---
+# --- END BEADS INTEGRATION v1.0.2 ---

.beads/hooks/post-merge

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.3 ---
+# --- END BEADS INTEGRATION v1.0.2 ---

.beads/hooks/pre-commit

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.3 ---
+# --- END BEADS INTEGRATION v1.0.2 ---

.beads/hooks/pre-push

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.3 ---
+# --- END BEADS INTEGRATION v1.0.2 ---

.beads/hooks/prepare-commit-msg

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# --- BEGIN BEADS INTEGRATION v1.0.3 ---
+# --- BEGIN BEADS INTEGRATION v1.0.2 ---
 # This section is managed by beads. Do not remove these markers.
 if command -v bd >/dev/null 2>&1; then
   export BD_GIT_HOOK=1
@@ -21,4 +21,4 @@ if command -v bd >/dev/null 2>&1; then
   fi
   if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
 fi
-# --- END BEADS INTEGRATION v1.0.3 ---
+# --- END BEADS INTEGRATION v1.0.2 ---

.beads/issues.jsonl

@@ -1,3 +1,3 @@
-{"_type":"issue","id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-edz","title":"Create copy-hermes-skills systemd service","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:44:42Z","started_at":"2026-04-26T12:36:30Z","closed_at":"2026-04-26T12:44:42Z","close_reason":"Created systemd service in hosts/m3-hermes/services/hermes-agent.nix - copies skills to /var/lib/hermes/.agents/skills before hermes-agent starts","labels":["hermes-agent","nixos"],"dependencies":[{"issue_id":"home-profile-restructuring-edz","depends_on_id":"home-profile-restructuring-ycz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
+{"id":"home-profile-restructuring-ycz","title":"Build hermes-agent skills using mkOpencodeSkills","status":"closed","priority":1,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":2,"created_at":"2026-04-26T12:30:09Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:35:15Z","started_at":"2026-04-26T12:31:35Z","closed_at":"2026-04-26T12:35:15Z","close_reason":"Added inputs to module signature and defined hermesSkills via inputs.agents.lib.mkOpencodeSkills with basecamp, anthropic, and kestra external skills. Verified with nixos-rebuild dry-run --flake .#m3-hermes (no errors).","labels":["hermes-agent","nixos"],"dependency_count":0,"dependent_count":1,"comment_count":0}
-{"_type":"issue","id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
+{"id":"home-profile-restructuring-cxa","title":"Verify skills available at /var/lib/hermes/.agents/skills","status":"closed","priority":2,"issue_type":"task","assignee":"m3tm3re","owner":"p@m3ta.dev","estimated_minutes":1,"created_at":"2026-04-26T12:30:10Z","created_by":"m3tm3re","updated_at":"2026-04-26T12:50:58Z","started_at":"2026-04-26T12:38:15Z","closed_at":"2026-04-26T12:50:58Z","close_reason":"Manually verified - skills are present at /var/lib/hermes/.agents/skills on m3-hermes","labels":["hermes-agent","testing"],"dependencies":[{"issue_id":"home-profile-restructuring-cxa","depends_on_id":"home-profile-restructuring-edz","type":"blocks","created_at":"2026-04-26T14:30:57Z","created_by":"m3tm3re","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}

.gitignore

@@ -26,7 +26,6 @@ Thumbs.db
 opencode.json
 
 # AI agent state
-.claude/
 .sidecar/
 .sidecar-*
 .sisyphus/
@@ -40,16 +39,8 @@ opencode.json
 .pi*
 .worktrees/
 docs/plans/
-CLAUDE.md
 
 # Beads / Dolt files (added by bd init)
 .dolt/
 *.db
 .beads-credential-key
-
-# --- babysitter managed ---
-.a5c/creds.env
-.a5c/creds.env.tmp.*
-.a5c/logs/
-.a5c/runs/
-# --- end babysitter managed ---

AGENTS.md

@@ -186,8 +186,6 @@ _(Note to Pi: Your file write/edit tools run in a different directory by default
 | ---------------- | --------------------------------- |
 | **Nixpkgs**      | nixos-unstable + 25.05 stable     |
 | **Home Manager** | github:nix-community/home-manager |
-| **m3ta-home**    | code.m3ta.dev/m3tam3re/m3ta-home  |
-| **m3ta-nixpkgs** | code.m3ta.dev/m3tam3re/nixpkgs    |
 | **Agenix**       | github:ryantm/agenix              |
 | **Disko**        | github:nix-community/disko        |
 | **NUR**          | github:nix-community/NUR          |
@@ -203,33 +201,32 @@ _(Note to Pi: Your file write/edit tools run in a different directory by default
 
 ```
 nixos-config/
-├── flake.nix                    # Entry point: hosts, overlays, dev shells, m3ta-home input
+├── flake.nix                    # Entry point: hosts, overlays, dev shells
 ├── coding-rules.json            # Opencode rules configuration
 │
 ├── hosts/                        # Per-host NixOS configurations
 │   ├── common/                   # Shared across all hosts
-│   │   ├── users/
+│   │   ├── users/                # User definitions
-│   │   │   └── m3tam3re.nix     # ← Central user + m3ta-home integration
+│   │   ├── ports.nix             # Network ports config
-│   │   ├── default.nix          # Shared NixOS settings, overlays, home-manager setup
+│   │   └── extraServices/        # Common service toggles
-│   │   ├── ports.nix            # Network ports config
+│   ├── m3-ares/                  # Main desktop
-│   │   └── extraServices/       # Common service toggles
+│   ├── m3-atlas/                 # Desktop with disko
-│   ├── m3-ares/                  # TUXEDO laptop (desktop)
+│   ├── m3-helios/                # Desktop with disko
-│   │   └── home.nix             # Hyprland: eDP-1 + HDMI, XDG/MIME
+│   ├── m3-hermes/                # Desktop with disko + hermes-agent
-│   ├── m3-kratos/                # AMD desktop (desktop)
+│   └── m3-kratos/                # Server with NUR
-│   │   └── home.nix             # Hyprland: dual DP, XDG/MIME
-│   ├── m3-daedalus/              # Portable laptop (desktop, no Hyprland)
-│   │   └── home.nix             # XDG/MIME only
-│   ├── m3-atlas/                 # Primary server (server + coding)
-│   ├── m3-helios/                # AdGuard DNS server (minimal server)
-│   ├── m3-hermes/                # Secondary server (minimal server)
-│   └── m3-aether/                # Cloud VM (minimal server)
 │
-├── modules/                      # Reusable NixOS modules
+├── modules/                      # Reusable NixOS/home-manager modules
-│   └── nixos/                    # NixOS-specific modules
+│   ├── nixos/                    # NixOS-specific modules
+│   │   └── default.nix           # Imports common + service configs
+│   └── home-manager/            # Home-manager configurations
 │
-├── overlays/                    # Package overlays (stable/locked/master/pinned)
+├── home/                         # Per-user, per-host home configs
-│   ├── default.nix
+│   └── m3tam3re/
-│   └── mods/
+│       └── m3-daedalus.nix
+│
+├── overlays/                    # Package overlays
+│   ├── default.nix              # Stable/locked/master branches
+│   └── mods/                    # Package modifications
 │
 ├── pkgs/                        # Custom packages
 │
@@ -237,64 +234,13 @@ nixos-config/
 │   └── secrets.nix
 │
 ├── .opencode-rules/             # Opencode AI rules
-│   ├── concerns/
+│   ├── concerns/                 # Coding style rules
-│   ├── languages/nix.md
+│   ├── languages/nix.md         # Nix conventions
 │   └── USAGE.md
 │
 └── .pi/                         # Agent configuration
 ```
 
-### Home-Manager Integration
-
-Home-Manager configs are managed centrally in the **`m3ta-home`** repository:
-- **Repo**: `code.m3ta.dev/m3tam3re/m3ta-home`
-- **Docs**: See m3ta-home README for full documentation
-
-What lives where:
-
-| Concern | Location | Why |
-|---------|----------|-----|
-| Shell, CLI tools, editors, apps | `m3ta-home/profiles/` | Portable across all hosts |
-| User identity (git, SSH, JJ) | `m3ta-home/users/` | Switchable: private vs work |
-| Feature flags (enable/disable) | `nixos-config/hosts/common/users/m3tam3re.nix` | Per-host decisions |
-| Monitor layouts, window rules | `nixos-config/hosts/<name>/home.nix` | Hardware-specific |
-| XDG/MIME defaults | `nixos-config/hosts/<name>/home.nix` | Host-specific preferences |
-| NixOS overlays | `nixos-config/overlays/` | System-level package management |
-
-#### Host → Profile Mapping
-
-Defined in `hosts/common/users/m3tam3re.nix`:
-
-```nix
-hostProfiles = {
-  # Desktop hosts
-  m3-ares     = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
-  m3-kratos   = { context = "desktop"; sets = ["coding" "gaming" "media"]; };
-  m3-daedalus = { context = "desktop"; sets = ["coding" "media"]; };
-  # Server hosts
-  m3-atlas    = { context = "server";  sets = ["coding"]; };
-  m3-helios   = { context = "server";  sets = []; };
-  m3-hermes   = { context = "server";  sets = []; };
-  m3-aether   = { context = "server";  sets = []; };
-};
-```
-
-#### Work Identity Use Case
-
-The same `m3ta-home` repo supports a **work identity** for company machines:
-
-```nix
-# On a work NixOS machine:
-(m3ta-lib.mkHome {
-  user = "m3tam3re";
-  identity = "work";       # ← switches git to sascha.koenig, SSH to AZ hosts
-  context = "desktop";
-  sets = ["coding"];
-})
-```
-
-This provides the familiar shell/editor/CLI setup but with work git credentials and SSH configuration.
-
 ---
 
 ## Commands
@@ -365,14 +311,6 @@ config = lib.mkMerge [
 - Never commit plaintext secrets
 - Use `.nix` extension for secret files
 
-### Flake Input URLs
-
-All `code.m3ta.dev` inputs use **SSH** URLs:
-```nix
-url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/<repo>";
-```
-Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with configured keys.
-
 ---
 
 ## Key Files
@@ -380,9 +318,12 @@ Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with
 | File                               | Purpose                                                                                    |
 | ---------------------------------- | ------------------------------------------------------------------------------------------ |
 | `flake.nix`                        | Central entry point defining all hosts, overlays, packages, dev shells, and nixpkgs config |
-| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager setup (`useGlobalPkgs = true`)         |
+| `hosts/common/default.nix`         | Shared Nix settings, nixpkgs overlays, home-manager integration, user defaults             |
-| `hosts/common/users/m3tam3re.nix`  | User definition + m3ta-home mkHome integration + per-host feature flags                    |
+| `hosts/m3-ares/default.nix`        | Main desktop host configuration, imports common + service modules                          |
-| `hosts/<name>/home.nix`            | Host-specific overrides: monitors, workspaces, window rules, XDG/MIME                      |
+| `hosts/m3-ares/configuration.nix`  | Desktop environment config (Hyprland, display, audio, etc.)                                |
+| `hosts/m3-ares/programs.nix`       | CLI tools, dev tools, shell configs                                                        |
+| `hosts/m3-ares/services/`          | Service-specific configs (firewall, printing, etc.)                                        |
+| `modules/nixos/default.nix`        | Orchestrates common + configuration imports                                                |
 | `overlays/default.nix`             | Package version overrides (stable/locked/master branches)                                  |
 | `.opencode-rules/languages/nix.md` | Nix-specific conventions and patterns                                                      |
 
@@ -411,10 +352,7 @@ Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with
    - `configuration.nix` — host-specific system config
    - `hardware-configuration.nix` — from `nixos-generate-config`
    - `programs.nix`, `services/`, `secrets.nix` as needed
-3. Add entry to `hostProfiles` in `hosts/common/users/m3tam3re.nix`
+3. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
-4. Add feature flags in the `hostFlags` section
-5. Create `hosts/<name>/home.nix` if the host needs monitor/XDG overrides
-6. Run `sudo nixos-generate-config --dir ./hosts/new-host` first time
 
 ### Adding a New Package
 
@@ -422,12 +360,6 @@ Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with
 2. For complex packages: create in `pkgs/` directory
 3. For upstream packages: use NUR or add as flake input
 
-### Adding a New Home-Manager Feature
-
-1. Create the module in `m3ta-home` under the appropriate profile directory
-2. Add the import to the parent `default.nix` in m3ta-home
-3. Enable it per-host via feature flags in `hosts/common/users/m3tam3re.nix`
-
 ### Development Workflow
 
 1. Edit config files
@@ -443,3 +375,9 @@ Anonymous HTTPS git on Gitea is unreliable and prompts for auth. SSH works with
 nix copy --to ssh://user@host .#nixosConfigurations.m3-ares.config.system.build.toplevel
 ssh user@host 'sudo nixos-rebuild switch --flake /nix/store/...-closure'
 ```
+
+### Home Manager
+
+- Home configs live in `home/m3tam3re/`
+- Use `home-manager.users.m3tam3re` in host config
+- Access via `config.home-manager.users.m3tam3re`

flake.nix

@@ -15,16 +15,17 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-45570c2.url = "github:nixos/nixpkgs/45570c299dc2b63c8c574c4cd77f0b92f7e2766e";
     nixpkgs-locked.url = "github:nixos/nixpkgs/2744d988fa116fc6d46cdfa3d1c936d0abd7d121";
     nixpkgs-9e58ed7.url = "github:nixos/nixpkgs/9e58ed7ba759d81c98f033b7f5eba21ca68f53b0";
     nixpkgs-master.url = "github:nixos/nixpkgs/master";
 
-    m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
+    m3ta-nixpkgs.url = "git+https://code.m3ta.dev/m3tam3re/nixpkgs";
     llm-agents.url = "github:numtide/llm-agents.nix";
 
+    #
     nur = {
       url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,21 +39,36 @@
 
     nixos-generators = {url = "github:nix-community/nixos-generators";};
 
+    hyprpanel.url = "github:Jas-SinghFSU/HyprPanel";
     rose-pine-hyprcursor.url = "github:ndom91/rose-pine-hyprcursor";
     nix-colors.url = "github:misterio77/nix-colors";
 
-    m3ta-home = {
+    agents = {
-      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home";
+      # url = "path:/home/m3tam3re/p/AI/AGENTS";
-      # url = "path:/home/m3tam3re/p/NIX/m3ta-home";
+      url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
-
+    ## Skills
-    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.6.5";
+    skills-basecamp = {
-
+      url = "github:basecamp/basecamp-cli";
-    rustfs = {
+      flake = false;
-      url = "github:rustfs/rustfs-flake";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
+    skills-anthropic = {
+      url = "github:anthropics/skills";
+      flake = false;
+    };
+    skills-kestra = {
+      url = "github:kestra-io/agent-skills";
+      flake = false;
+    };
+    skills-superpowers = {
+      url = "github:obra/superpowers";
+      flake = false;
+    };
+    skills-vercel = {
+      url = "github:vercel-labs/skills";
+      flake = false;
+    };
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.4.30";
   };
 
   outputs = {
@@ -62,6 +78,7 @@
     nixpkgs,
     m3ta-nixpkgs,
     nur,
+    agents,
     ...
   } @ inputs: let
     inherit (self) outputs;
@@ -77,7 +94,7 @@
   in {
     packages =
       forAllSystems (system: import ./pkgs nixpkgs.legacyPackages.${system});
-    overlays = removeAttrs allOverlays ["mkLlmAgentsOverlay"];
+    overlays = builtins.removeAttrs allOverlays ["mkLlmAgentsOverlay"];
     lib.mkLlmAgentsOverlay = allOverlays.mkLlmAgentsOverlay;
     homeManagerModules = import ./modules/home-manager;
 
@@ -105,7 +122,6 @@
           inputs.disko.nixosModules.disko
           agenix.nixosModules.default
           m3ta-nixpkgs.nixosModules.default
-          inputs.rustfs.nixosModules.rustfs
         ];
       };
       m3-kratos = nixpkgs.lib.nixosSystem {
@@ -164,6 +180,11 @@
         inherit system;
         config.allowUnfree = true; # Allow unfree packages in devShell
       };
+      m3taLib = m3ta-nixpkgs.lib.x86_64-linux;
+      rules = m3taLib.coding-rules.mkCodingRules {
+        inherit agents;
+        languages = ["nix"];
+      };
     in {
       default = pkgs.mkShell {
         buildInputs = with pkgs; [
@@ -174,6 +195,7 @@
           statix
           deadnix
         ];
+        inherit (rules) instructions shellHook;
       };
     });
   };

home/base/cli-tools/bat.nix

@@ -0,0 +1,145 @@
+# Bat — cat replacement with nix-colors syntax highlighting theme.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.bat;
+  palette = config.colorScheme.palette;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.bat.enable = (mkEnableOption "enable bat with nix-colors theme") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.bat = {
+      enable = true;
+      config = {theme = "universal";};
+      themes = {
+        universal = {
+          src = pkgs.writeText "universal.tmTheme" ''
+            <?xml version="1.0" encoding="UTF-8"?>
+            <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+            <plist version="1.0">
+            <dict>
+              <key>name</key>
+              <string>Universal (nix-colors)</string>
+              <key>settings</key>
+              <array>
+                <dict>
+                  <key>settings</key>
+                  <dict>
+                    <key>background</key>
+                    <string>#${palette.base00}</string>
+                    <key>foreground</key>
+                    <string>#${palette.base05}</string>
+                    <key>caret</key>
+                    <string>#${palette.base05}</string>
+                    <key>selection</key>
+                    <string>#${palette.base02}</string>
+                    <key>selectionForeground</key>
+                    <string>#${palette.base05}</string>
+                    <key>lineHighlight</key>
+                    <string>#${palette.base01}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Comment</string>
+                  <key>scope</key>
+                  <string>comment</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base03}</string>
+                    <key>fontStyle</key>
+                    <string>italic</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>String</string>
+                  <key>scope</key>
+                  <string>string</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0A}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Number</string>
+                  <key>scope</key>
+                  <string>constant.numeric</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0E}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Keyword</string>
+                  <key>scope</key>
+                  <string>keyword</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base08}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Function</string>
+                  <key>scope</key>
+                  <string>entity.name.function</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0B}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Type</string>
+                  <key>scope</key>
+                  <string>entity.name.type, storage.type</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0D}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Variable</string>
+                  <key>scope</key>
+                  <string>variable</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base05}</string>
+                  </dict>
+                </dict>
+                <dict>
+                  <key>name</key>
+                  <string>Constant</string>
+                  <key>scope</key>
+                  <string>constant</string>
+                  <key>settings</key>
+                  <dict>
+                    <key>foreground</key>
+                    <string>#${palette.base0E}</string>
+                  </dict>
+                </dict>
+              </array>
+            </dict>
+            </plist>
+          '';
+        };
+      };
+    };
+  };
+}

home/base/cli-tools/carapace.nix

@@ -0,0 +1,21 @@
+# Carapace — multi-shell completion engine with Fish, Nushell, and Bash integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.carapace;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.carapace.enable = (mkEnableOption "enable carapace completion engine") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.carapace = {
+      enable = true;
+      enableFishIntegration = true;
+      enableNushellIntegration = true;
+      enableBashIntegration = true;
+    };
+  };
+}

home/base/cli-tools/default.nix

@@ -0,0 +1,17 @@
+# CLI tools aggregator — imports all base command-line utilities.
+{...}: {
+  imports = [
+    ./bat.nix
+    ./carapace.nix
+    ./direnv.nix
+    ./eza.nix
+    ./fzf.nix
+    ./lf.nix
+    ./nitch.nix
+    ./packages.nix
+    ./television.nix
+    ./zellij.nix
+    ./zellij-ps.nix
+    ./zoxide.nix
+  ];
+}

home/base/cli-tools/direnv.nix

@@ -0,0 +1,20 @@
+# Direnv — automatic environment loading with nix-direnv integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.direnv;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.direnv.enable = (mkEnableOption "enable direnv with nix-direnv") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.direnv = {
+      enable = true;
+      enableNushellIntegration = true;
+      nix-direnv.enable = true;
+    };
+  };
+}

home/base/cli-tools/eza.nix

@@ -0,0 +1,21 @@
+# Eza — modern ls replacement with icons, git status, and long format by default.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.eza;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.eza.enable = (mkEnableOption "enable eza modern ls replacement") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.eza = {
+      enable = true;
+      enableFishIntegration = true;
+      enableBashIntegration = true;
+      extraOptions = ["-l" "--icons" "--git" "-a"];
+    };
+  };
+}

home/base/cli-tools/fzf.nix

@@ -0,0 +1,41 @@
+# Fuzzy finder with nix-colors palette and Wayland clipboard integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.fzf;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.fzf.enable = (mkEnableOption "enable fuzzy finder") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.fzf = {
+      enable = true;
+      enableFishIntegration = true;
+      colors = {
+        "fg" = "#${config.colorScheme.palette.base05}";
+        "bg" = "#${config.colorScheme.palette.base00}";
+        "hl" = "#${config.colorScheme.palette.base0E}";
+        "fg+" = "#${config.colorScheme.palette.base05}";
+        "bg+" = "#${config.colorScheme.palette.base02}";
+        "hl+" = "#${config.colorScheme.palette.base0E}";
+        "info" = "#${config.colorScheme.palette.base09}";
+        "prompt" = "#${config.colorScheme.palette.base0B}";
+        "pointer" = "#${config.colorScheme.palette.base08}";
+        "marker" = "#${config.colorScheme.palette.base08}";
+        "spinner" = "#${config.colorScheme.palette.base09}";
+        "header" = "#${config.colorScheme.palette.base03}";
+      };
+      defaultOptions = [
+        "--preview='bat --color=always -n {}'"
+        "--bind 'ctrl-/:toggle-preview'"
+        "--header 'Press CTRL-Y to copy command into clipboard'"
+        "--bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'"
+      ];
+      defaultCommand = "fd --type f --exclude .git --follow --hidden";
+      changeDirWidgetCommand = "fd --type d --exclude .git --follow --hidden";
+    };
+  };
+}

home/base/cli-tools/lf.nix

@@ -0,0 +1,28 @@
+# Lf — terminal file manager with bat preview and Dracula theme.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.lf;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.lf.enable = (mkEnableOption "enable lf terminal file manager") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.lf];
+
+    programs.lf = {
+      enable = true;
+      settings = {
+        preview = true;
+        drawbox = true;
+        hidden = true;
+        icons = true;
+        previewer = "bat";
+      };
+    };
+  };
+}

home/base/cli-tools/nitch.nix

@@ -0,0 +1,17 @@
+# Nitch — minimal system information display tool.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.nitch;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.nitch.enable = (mkEnableOption "enable nitch") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.nitch];
+  };
+}

home/base/cli-tools/packages.nix

@@ -0,0 +1,62 @@
+# Essential CLI packages — core utilities always available on every host.
+# NOTE: `lazylib` does not exist in nixpkgs. `lazygit` is the correct package
+# (Git TUI) and is intentionally used here instead.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.essentials;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.essentials.enable = (mkEnableOption "enable essential CLI packages") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      # Core utilities
+      coreutils
+      fd
+      htop
+      jq
+      ripgrep
+
+      # Nix
+      alejandra
+      comma
+      nixd
+      nix-diff
+      nix-index
+      nix-update
+
+      # Dev tools
+      bc
+      cmake
+      devenv
+      gcc
+      gnumake
+      go
+      httpie
+      just
+      lazygit
+      progress
+      sqlite
+      sqlite-vec
+      tldr
+
+      # AI tools
+      fabric-ai
+      llm
+
+      # Misc
+      basecamp
+      hyprpaper-random
+      libnotify
+      trash-cli
+      unzip
+      yazi
+      zip
+    ];
+  };
+}

home/base/cli-tools/television.nix

@@ -0,0 +1,60 @@
+# Television — fuzzy finder with custom channels for tldr, git-diff, and git-log.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.television;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.television.enable = (mkEnableOption "enable television") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.television = {
+      enable = true;
+      channels = {
+        tldr = {
+          metadata = {
+            description = "Browse TLDR pages";
+            name = "tldr";
+            requirements = ["tldr"];
+          };
+          preview = {
+            command = "tldr '{}'";
+          };
+          source = {
+            command = "tldr --list";
+          };
+        };
+        git-diff = {
+          metadata = {
+            description = "A channel to select files from git diff commands";
+            name = "git-diff";
+            requirements = ["git"];
+          };
+          preview = {
+            command = "git diff HEAD --color=always -- '{}'";
+          };
+          source = {
+            command = "git diff --name-only HEAD";
+          };
+        };
+        git-log = {
+          metadata = {
+            description = "A channel to select from git log entries";
+            name = "git-log";
+            requirements = ["git"];
+          };
+          preview = {
+            command = "git show -p --stat --pretty=fuller --color=always '{0}'";
+          };
+          source = {
+            command = "git log --oneline --date=short --pretty=\"format:%h %s %an %cd\" \"$@\"";
+            output = "{split: :0}";
+          };
+        };
+      };
+    };
+  };
+}

home/base/cli-tools/zellij-ps.nix

@@ -0,0 +1,30 @@
+# Zellij-ps — project-aware Zellij session manager from m3ta-nixpkgs.
+# Delegates to `cli.zellij-ps` — the home-manager module namespace provided by
+# m3ta-nixpkgs (inputs.m3ta-nixpkgs.nixosModules.default). This is intentional;
+# `cli.*` is the convention used by m3ta-nixpkgs home-manager modules.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.zellijPs;
+in {
+  options.base.cliTools.zellijPs = {
+    # Enabled by default — base modules are always-on.
+    enable = (mkEnableOption "enable zellij-ps project session manager") // {default = true;};
+
+    projectFolders = mkOption {
+      type = types.listOf types.path;
+      description = "Project root folders scanned by zellij-ps.";
+      default = ["${config.home.homeDirectory}/p"];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    cli.zellij-ps = {
+      enable = true;
+      projectFolders = cfg.projectFolders;
+    };
+  };
+}

home/base/cli-tools/zellij.nix

@@ -0,0 +1,34 @@
+# Zellij terminal multiplexer with nix-colors theming.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.zellij;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.zellij.enable = (mkEnableOption "enable zellij multiplexer") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.zellij = {
+      enable = true;
+      settings = {
+        theme = "universal";
+        themes.universal = {
+          bg = "#${config.colorScheme.palette.base00}";
+          fg = "#${config.colorScheme.palette.base05}";
+          black = "#${config.colorScheme.palette.base01}";
+          red = "#${config.colorScheme.palette.base08}";
+          green = "#${config.colorScheme.palette.base0B}";
+          yellow = "#${config.colorScheme.palette.base0A}";
+          blue = "#${config.colorScheme.palette.base0D}";
+          magenta = "#${config.colorScheme.palette.base0E}";
+          cyan = "#${config.colorScheme.palette.base0C}";
+          white = "#${config.colorScheme.palette.base07}";
+          orange = "#${config.colorScheme.palette.base09}";
+        };
+      };
+    };
+  };
+}

home/base/cli-tools/zoxide.nix

@@ -0,0 +1,20 @@
+# Zoxide — smarter cd with Fish and Nushell integration.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.zoxide;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.zoxide.enable = (mkEnableOption "enable zoxide smarter cd") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.zoxide = {
+      enable = true;
+      enableFishIntegration = true;
+      enableNushellIntegration = true;
+    };
+  };
+}

home/base/default.nix

@@ -0,0 +1,9 @@
+# Base home-manager configuration — always loaded on every host.
+# Includes shell, CLI tools, and secrets modules.
+{...}: {
+  imports = [
+    ./shell
+    ./cli-tools
+    ./secrets/secrets.nix
+  ];
+}

home/base/secrets/secrets.nix

@@ -0,0 +1,24 @@
+# Password store and secrets management via pass-wayland with OTP and import extensions.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.secrets;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.secrets.enable = (mkEnableOption "enable secrets management") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.password-store = {
+      enable = true;
+      package =
+        pkgs.pass-wayland.withExtensions
+        (exts: [exts.pass-otp exts.pass-import]);
+      settings = {PASSWORD_STORE_DIR = "$XDG_DATA_HOME/password-store";};
+    };
+    home.packages = [pkgs.pinentry-gnome3];
+  };
+}

home/base/shell/default.nix

@@ -0,0 +1,8 @@
+# Shell aggregator — imports Nushell (primary), Fish, and Starship prompt.
+{...}: {
+  imports = [
+    ./nushell.nix
+    ./fish.nix
+    ./starship.nix
+  ];
+}

home/base/shell/fish.nix

@@ -0,0 +1,118 @@
+# Fish shell configuration exposed under the new base namespace.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.shell.fish;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.shell.fish.enable = (mkEnableOption "enable fish shell") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.fish = {
+      enable = true;
+      interactiveShellInit = ''
+        # Fish colors using universal nix-colors palette
+        # Text colors
+        set -g fish_color_normal ${config.colorScheme.palette.base05}      # text
+        set -g fish_color_param ${config.colorScheme.palette.base05}       # text
+        set -g fish_color_comment ${config.colorScheme.palette.base03}     # muted
+        set -g fish_color_autosuggestion ${config.colorScheme.palette.base03} # muted
+
+        # Command colors
+        set -g fish_color_command ${config.colorScheme.palette.base0D}     # accent6 (blue)
+        set -g fish_color_quote ${config.colorScheme.palette.base0A}       # accent3 (yellow)
+        set -g fish_color_redirection ${config.colorScheme.palette.base0E} # accent7 (purple)
+        set -g fish_color_end ${config.colorScheme.palette.base08}         # accent1 (red)
+        set -g fish_color_error ${config.colorScheme.palette.base08}       # accent1 (red)
+        set -g fish_color_operator ${config.colorScheme.palette.base0C}    # accent5 (cyan)
+        set -g fish_color_escape ${config.colorScheme.palette.base09}      # accent2 (orange)
+
+        # Path colors
+        set -g fish_color_cwd ${config.colorScheme.palette.base0B}         # accent4 (green)
+        set -g fish_color_cwd_root ${config.colorScheme.palette.base08}    # accent1 (red)
+        set -g fish_color_valid_path --underline
+
+        # Interactive colors
+        set -g fish_color_match ${config.colorScheme.palette.base0B}       # accent4 (green)
+        set -g fish_color_selection --background=${config.colorScheme.palette.base02} # overlay
+        set -g fish_color_search_match --background=${config.colorScheme.palette.base02} # overlay
+        set -g fish_color_history_current --bold
+        set -g fish_color_user ${config.colorScheme.palette.base0B}        # accent4 (green)
+        set -g fish_color_host ${config.colorScheme.palette.base0D}        # accent6 (blue)
+        set -g fish_color_cancel -r
+
+        # Pager colors
+        set -g fish_pager_color_completion normal
+        set -g fish_pager_color_description ${config.colorScheme.palette.base03} # muted
+        set -g fish_pager_color_prefix ${config.colorScheme.palette.base0E}      # accent7 (purple)
+        set -g fish_pager_color_progress ${config.colorScheme.palette.base0B}    # accent4 (green)
+      '';
+      loginShellInit = ''
+        set -x NIX_PATH nixpkgs=channel:nixos-unstable
+        set -x NIX_LOG info
+        set -x WEBKIT_DISABLE_COMPOSITING_MODE 1
+        set -x TERMINAL ghostty
+        set -x EDITOR nvim
+        set -x VISUAL zed
+        set -x XDG_DATA_HOME $HOME/.local/share
+        set -x FZF_CTRL_R_OPTS "
+        --preview='bat --color=always -n {}'
+        --preview-window up:3:hidden:wrap
+        --bind 'ctrl-/:toggle-preview'
+        --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort'
+        --color header:bold
+        --header 'Press CTRL-Y to copy command into clipboard'"
+        set -x FZF_DEFAULT_COMMAND fd --type f --exclude .git --follow --hidden
+        set -x FZF_CTRL_T_COMMAND "$FZF_DEFAULT_COMMAND"
+        set -x FLAKE $HOME/p/nixos/nixos-config
+        source /run/agenix/${config.home.username}-secrets
+
+        if test (tty) = "/dev/tty1"
+          exec uwsm start -F /run/current-system/sw/bin/Hyprland
+        end
+        if test (tty) = "/dev/tty2"
+          exec gamescope -O HDMI-A-1 -W 1920 -H 1080 --adaptive-sync --hdr-enabled --rt --steam -- steam -pipewire-dmabuf -tenfoot
+        end
+      '';
+      shellAbbrs = {
+        ".." = "cd ..";
+        "..." = "cd ../..";
+        b = "yazi";
+        ls = "eza";
+        l = "eza -l --icons --git -a";
+        lt = "eza --tree --level=2 --long --icons --git";
+        grep = "rg";
+        ps = "procs";
+        just = "just --unstable";
+        node = "bun";
+        npx = "bunx";
+        fs = "du -ah . | sort -hr | head -n 10";
+
+        n = "nix";
+        nd = "nix develop -c $SHELL";
+        ns = "nix shell";
+        nsn = "nix shell nixpkgs#";
+        nb = "nix build";
+        nbn = "nix build nixpkgs#";
+        nf = "nix flake";
+
+        nr = "sudo nixos-rebuild --flake .";
+        nrs = "sudo nixos-rebuild switch --flake .#(uname -n)";
+        snr = "sudo nixos-rebuild --flake .";
+        snrs = "sudo nixos-rebuild --flake . switch";
+        hm = "home-manager --flake .";
+        hms = "home-manager --flake . switch";
+        hmr = "cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch";
+
+        tsu = "sudo tailscale up";
+        tsd = "sudo tailscale down";
+
+        vi = "nvim";
+        vim = "nvim";
+      };
+    };
+  };
+}

home/base/shell/nushell.nix

@@ -0,0 +1,86 @@
+# Primary shell configuration — Nushell with environment, aliases, and integrations.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.shell.nushell;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.nushell = {
+      enable = true;
+      envFile.text = ''
+        $env.config.show_banner = false
+        $env.NIX_PATH = "nixpkgs=channel:nixos-unstable"
+        $env.NIX_LOG = "iunfo"
+        $env.WEBKIT_DISABLE_COMPOSITING_MODE = "1"
+        $env.TERMINAL = "ghostty"
+        $env.EDITOR = "nvim"
+        $env.VISUAL = "zeditor"
+        $env.FZF_DEFAULT_COMMAND = "fd --type f --exclude .git --follow --hidden"
+        $env.FZF_DEFAULT_OPTS = "--preview='bat --color=always -n {}' --bind 'ctrl-/:toggle-preview' --header 'Press CTRL-Y to copy command into clipboard' --bind 'ctrl-y:execute-silent(echo -n {2..} | wl-copy)+abort' --color bg:#282a36,bg+:#44475a,fg:#f8f8f2,fg+:#f8f8f2,header:#6272a4,hl:#bd93f9,hl+:#bd93f9,info:#ffb86c,marker:#ff79c6,pointer:#ff79c6,prompt:#50fa7b,spinner:#ffb86c"
+        $env.XDG_DATA_HOME = $"($env.HOME)/.local/share"
+        $env.SSH_AUTH_SOCK = "/run/user/1000/gnupg/S.gpg-agent.ssh"
+        $env.PATH = ($env.PATH | split row (char esep) | append $"($env.HOME)/.cache/.bun/bin" | append $"($env.HOME)/.npm-global/bin" | uniq)
+        $env.NPM_CONFIG_PREFIX = $"($env.HOME)/.npm-global"
+        $env.FLAKE = $"($env.HOME)/p/NIX/nixos-config"
+
+        # Load kestractl-env from agenix
+        if ("/run/agenix/kestractl-env" | path exists) {
+          open /run/agenix/kestractl-env
+            | lines
+            | where {($in | str trim | str length) > 0}
+            | parse "{key}={value}"
+            | update value {str trim -c '"'}
+            | transpose -r -d
+            | load-env
+        }
+      '';
+
+      configFile.text = ''
+        # Aliases
+        alias .. = cd ..
+        alias ... = cd ...
+        alias h = cd $env.HOME
+        alias b = yazi
+        alias lt = eza --tree --level=2 --long --icons --git
+        alias grep = rg
+        alias just = just --unstable
+
+        alias node = bun
+        alias npx = bunx
+
+        alias n = nix
+        alias nd = nix develop -c $nu.current-shell
+        alias ns = nix shell
+        alias nsn = nix shell nixpkgs#
+        alias nb = nix build
+        alias nbn = nix build nixpkgs#
+        alias nf = nix flake
+
+        alias nr = sudo nixos-rebuild --flake .
+        alias nrs = sudo nixos-rebuild switch --flake .#(sys host | get hostname)
+        alias snr = sudo nixos-rebuild --flake .
+        alias snrs = sudo nixos-rebuild --flake . switch
+        alias hm = home-manager --flake .
+        alias hms = home-manager --flake . switch
+        alias hmr = do { cd ~/projects/nix-configurations; nix flake lock --update-input dotfiles; home-manager --flake .#(whoami)@(hostname) switch }
+
+        alias tsu = sudo tailscale up
+        alias tsd = sudo tailscale down
+
+        alias vi = nvim
+        alias vim = nvim
+
+        if (which tv | is-not-empty) {
+          mkdir ($nu.data-dir | path join "vendor/autoload")
+          tv init nu | save -f ($nu.data-dir | path join "vendor/autoload/tv.nu")
+        }
+      '';
+    };
+  };
+}

home/base/shell/starship.nix

@@ -0,0 +1,70 @@
+# Starship cross-shell prompt with nix-colors theming.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.base.shell.starship;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.shell.starship.enable = (mkEnableOption "enable starship prompt") // {default = true;};
+
+  config = mkIf cfg.enable {
+    programs.starship = {
+      enable = true;
+      enableFishIntegration = true;
+      enableNushellIntegration = true;
+      settings = {
+        format = "$all$character";
+        palette = "universal";
+
+        palettes.universal = {
+          background = "#${config.colorScheme.palette.base00}";
+          surface = "#${config.colorScheme.palette.base01}";
+          muted = "#${config.colorScheme.palette.base03}";
+          text = "#${config.colorScheme.palette.base05}";
+          bright = "#${config.colorScheme.palette.base07}";
+          accent1 = "#${config.colorScheme.palette.base08}";
+          accent2 = "#${config.colorScheme.palette.base09}";
+          accent3 = "#${config.colorScheme.palette.base0A}";
+          accent4 = "#${config.colorScheme.palette.base0B}";
+          accent5 = "#${config.colorScheme.palette.base0C}";
+          accent6 = "#${config.colorScheme.palette.base0D}";
+          accent7 = "#${config.colorScheme.palette.base0E}";
+        };
+
+        character = {
+          success_symbol = "[❯](accent7)";
+          error_symbol = "[❯](accent1)";
+        };
+
+        directory = {
+          style = "accent6";
+          truncation_length = 3;
+          truncate_to_repo = false;
+        };
+
+        git_branch = {
+          style = "accent7";
+        };
+
+        git_status = {
+          style = "accent5";
+        };
+
+        cmd_duration = {
+          style = "accent3";
+        };
+
+        hostname = {
+          style = "accent4";
+        };
+
+        username = {
+          style_user = "accent2";
+        };
+      };
+    };
+  };
+}

home/coding/agents/agents.nix

@@ -0,0 +1,85 @@
+# AI agent system — OpenCode, Pi, and MCP server configuration.
+# Relies on coding.agents options provided by home/common/default.nix
+# (inputs.m3ta-nixpkgs.homeManagerModules.default).
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  videoDrivers ? [],
+  ...
+}: {
+  # Agent Git Identity configuration
+  # Note: Uses existing gitea SSH key (m3tam3re identity) for push auth
+  coding.agents.gitIdentity = {
+    enable = true;
+    name = "m3ta-chiron";
+    email = "m3ta-chiron@agentmail.to";
+    sshKey = "/home/m3tam3re/.ssh/gitea";
+  };
+
+  imports = [
+    # OpenCode and Pi agent configurations
+    ./opencode.nix
+    ./pi.nix
+  ];
+
+  coding.agents.skills = {
+    agentsInput = inputs.agents;
+    externalSkills = [
+      {
+        src = inputs.skills-anthropic;
+        selectSkills = ["pdf" "docx" "frontend-design"];
+      }
+      {src = inputs.skills-superpowers;}
+      {src = inputs.skills-vercel;}
+      {src = inputs.skills-basecamp;}
+      {src = inputs.skills-kestra;}
+    ];
+  };
+
+  programs.mcp = {
+    enable = true;
+    servers = {
+      DeepWiki = {
+        url = "https://mcp.deepwiki.com/mcp";
+      };
+      Ref = {
+        command = "bash";
+        args = ["-c" "REF_API_KEY=$(cat /run/agenix/ref-key) exec bunx ref-tools-mcp@latest"];
+      };
+      Exa = {
+        command = "bash";
+        args = ["-c" "EXA_API_KEY=$(cat /run/agenix/exa-key) exec bunx exa-mcp-server@latest tools=web_search_exa"];
+      };
+      Outline = {
+        url = "https://wiki.az-gruppe.com/mcp";
+      };
+      ContextMode = {
+        command = "bash";
+        args = ["-c" "exec bunx context-mode@latest"];
+      };
+      Honcho = {
+        command = "bash";
+        args = [
+          "-c"
+          ''exec bunx mcp-remote@latest https://mcp.honcho.dev --header "Authorization:Bearer $(cat /run/agenix/honcho-key)" --header "X-Honcho-User-Name:m3tam3re"''
+        ];
+      };
+    };
+  };
+
+  home.packages = with pkgs; [
+    agenix-cli
+    agent-browser
+    beads
+    pi
+    (qmd.override {
+      vulkanSupport = videoDrivers == ["amdgpu"];
+      cudaSupport = videoDrivers == ["nvidia"];
+    })
+    # opencode-desktop
+    openshell
+    openspec
+  ];
+}

home/coding/agents/opencode.nix

@@ -0,0 +1,260 @@
+{
+  inputs,
+  lib,
+  ...
+}: {
+  coding.agents.opencode = {
+    enable = true;
+    agentsInput = inputs.agents;
+  };
+
+  coding.opencode = {
+    enable = true;
+
+    ohMyOpencodeSettings = {
+      agents = {
+        sisyphus.model = "litellm/claude-opus-4-6";
+        oracle.model = "litellm/claude-sonnet-4-6";
+        librarian.model = "litellm/claude-sonnet-4-6";
+        explore.model = "litellm/claude-haiku-4-5";
+        multimodal-looker.model = "litellm/gpt-5.3-codex";
+        prometheus.model = "litellm/claude-opus-4-6";
+        metis.model = "litellm/claude-opus-4-6";
+        momus.model = "litellm/claude-opus-4-6";
+        atlas.model = "litellm/claude-sonnet-4-6";
+      };
+      categories = {
+        visual-engineering.model = "zai-coding-plan/glm-5.1";
+        ultrabrain.model = "litellm/claude-opus-4-6";
+        deep.model = "litellm/claude-sonnet-4-6";
+        artistry.model = "zai-coding-plan/glm-5.1";
+        quick.model = "litellm/claude-haiku-4-5";
+        unspecified-low.model = "litellm/claude-sonnet-4-6";
+        unspecified-high.model = "litellm/claude-opus-4-6";
+        writing.model = "zai-coding-plan/glm-5.1";
+      };
+    };
+  };
+
+  # Keep TUI settings in programs.opencode.tui to satisfy OpenCode v1.2.15+.
+  programs.opencode.tui.theme = "opencode";
+
+  # Override legacy default settings to avoid deprecated TUI keys in settings.
+  programs.opencode.settings = lib.mkForce {
+    plugin = ["oh-my-openagent"];
+    formatter = {
+      alejandra = {
+        command = ["alejandra" "-q" "-"];
+        extensions = [".nix"];
+      };
+    };
+
+    # Security: permission hardening for OpenCode
+    # Last matching rule wins. Glob patterns: * = any chars, ? = single char.
+    # ~ and $HOME are expanded to the user's home directory.
+    # external_directory gates paths outside the working directory.
+    permission = {
+      # External directory access: ask by default, allow safe paths
+      "external_directory" = {
+        "*" = "ask";
+        "/nix/store/**" = "allow";
+        "/tmp/**" = "allow";
+      };
+
+      # Read access: allow by default, deny sensitive paths
+      "read" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "~/.aws/**" = "deny";
+        "~/.kube/**" = "deny";
+        "~/.config/gh/**" = "deny";
+        "~/.config/gcloud/**" = "deny";
+        "~/.config/op/**" = "deny";
+        "~/.config/sops/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "~/.pi/agent/auth.json" = "deny";
+        "~/.pi/agent/sessions/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+        "*id_rsa*" = "deny";
+        "*id_ed25519*" = "deny";
+        "*id_ecdsa*" = "deny";
+        "*.example.env" = "allow";
+        "*.sample.env" = "allow";
+        "*.test.env" = "allow";
+        ".env.example" = "allow";
+        ".env.sample" = "allow";
+        ".env.test" = "allow";
+        "~/.ssh/*.pub" = "allow";
+        "*.pub" = "allow";
+        "*.csr" = "allow";
+      };
+
+      # Edit access: ask by default, deny sensitive paths
+      "edit" = {
+        "*" = "ask";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "~/.aws/**" = "deny";
+        "~/.kube/**" = "deny";
+        "~/.config/gh/**" = "deny";
+        "~/.config/gcloud/**" = "deny";
+        "~/.config/op/**" = "deny";
+        "~/.config/sops/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "~/.pi/agent/auth.json" = "deny";
+        "~/.pi/agent/sessions/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+        "*id_rsa*" = "deny";
+        "*id_ed25519*" = "deny";
+        "*id_ecdsa*" = "deny";
+        "~/.ssh/*.pub" = "allow";
+        "*.pub" = "allow";
+        "*.csr" = "allow";
+      };
+
+      # Glob patterns: same rules as read for file matching
+      "glob" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "*.env" = "deny";
+        "*.env.*" = "deny";
+        "*.pem" = "deny";
+        "*.key" = "deny";
+        "*.p12" = "deny";
+        "*.pfx" = "deny";
+      };
+
+      # Grep: allow search, but deny searching for secrets
+      "grep" = {
+        "*" = "allow";
+        "~/.ssh/**" = "deny";
+        "~/.gnupg/**" = "deny";
+        "/run/agenix/**" = "deny";
+        "*PASSWORD*" = "ask";
+        "*SECRET*" = "ask";
+        "*API_KEY*" = "ask";
+        "*PRIVATE_KEY*" = "ask";
+      };
+
+      # Bash: ask by default, deny dangerous and env-leak commands
+      "bash" = {
+        "*" = "ask";
+        "git status*" = "allow";
+        "git diff*" = "allow";
+        "git log*" = "allow";
+        "git branch*" = "allow";
+        "git show*" = "allow";
+        "git remote*" = "allow";
+        "nix --version" = "allow";
+        "nix eval*" = "allow";
+        "nix build*" = "allow";
+        "nix develop*" = "allow";
+        "nix shell*" = "allow";
+        "nix search*" = "allow";
+        "alejandra*" = "allow";
+        "git add*" = "allow";
+        "git commit*" = "allow";
+        "git push*" = "ask";
+        "git pull*" = "allow";
+        "rm *" = "ask";
+        "rm -rf *" = "deny";
+        "sudo *" = "ask";
+        "env" = "deny";
+        "printenv" = "deny";
+        "cat /proc/*/environ" = "deny";
+        "gpg *--export-secret*" = "deny";
+        "ssh-add -D" = "deny";
+        "docker run --privileged*" = "deny";
+        "curl *| *sh" = "deny";
+        "wget *| *sh" = "deny";
+      };
+
+      # Web fetch: ask for sensitive URLs
+      "webfetch" = {
+        "*" = "ask";
+        "https://api.github.com*" = "allow";
+        "https://search.nixos.org*" = "allow";
+      };
+
+      # Doom loop guard
+      "doom_loop" = "ask";
+    };
+
+    # AZ-Gruppe LiteLLM endpoint + available models
+    provider = {
+      litellm = {
+        npm = "@ai-sdk/openai-compatible";
+        name = "LiteLLM (AZ-Gruppe)";
+        options.baseURL = "https://llm.az-gruppe.com/v1";
+        models = {
+          "gpt-5.2" = {
+            name = "GPT-5.2";
+            limit = {
+              context = 400000;
+              output = 128000;
+            };
+          };
+          "gpt-5.3-codex" = {
+            name = "GPT-5.3 Codex";
+            limit = {
+              context = 400000;
+              output = 128000;
+            };
+          };
+          "claude-haiku-4-5" = {
+            name = "Claude Haiku 4.5";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 64000;
+            };
+          };
+          "claude-sonnet-4-6" = {
+            name = "Claude Sonnet 4.6";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 64000;
+            };
+          };
+          "claude-opus-4-6" = {
+            name = "Claude Opus 4.6";
+            options = {
+              thinking = {
+                type = "enabled";
+                budget_tokens = 16000;
+              };
+            };
+            limit = {
+              context = 200000;
+              output = 128000;
+            };
+          };
+        };
+      };
+    };
+  };
+}

home/coding/agents/pi.nix

@@ -0,0 +1,269 @@
+{inputs, ...}: {
+  coding.agents.pi = {
+    enable = true;
+    agentsInput = inputs.agents;
+
+    modelOverrides = {
+      chiron = "minimax/MiniMax-M2.7";
+      chiron-forge = "minimax/MiniMax-M2.7";
+    };
+
+    # Coding rules for Pi agent
+    # Rules sourced from AGENTS repo
+    codingRules = {
+      # Language-specific rules
+      languages = [
+        "nix" # Nix language conventions
+      ];
+
+      # Standard concerns from AGENTS repo
+      concerns = [
+        "coding-style" # General coding principles
+        "naming" # Naming conventions (camelCase, snake_case, etc.)
+        "documentation" # Documentation standards
+        "testing" # Testing guidelines (Arrange-Act-Assert)
+        "git-workflow" # Conventional commits, branch naming
+        "git-identity" # Git identity configuration for agents
+        "project-structure" # Project layout conventions
+      ];
+
+      # No framework-specific rules for NixOS config
+      frameworks = [];
+    };
+
+    settings = {
+      packages = [
+        "npm:@dreadedzombie/pi-init"
+        "npm:@plannotator/pi-extension"
+        "npm:@thesethrose/pi-zai-provider"
+        "npm:pi-agent-browser-native"
+        "npm:pi-beads-extension"
+        "npm:pi-lens"
+        "npm:pi-markdown-preview"
+        "npm:pi-mcp-adapter"
+        "npm:pi-powerline-footer"
+        "npm:pi-prompt-template-model"
+        "npm:pi-subagents"
+        "npm:pi-tool-display"
+        "npm:pi-web-access"
+        "git:github.com/hk-vk/pi-connect"
+      ];
+
+      defaultProvider = "minimax";
+      defaultModel = "MiniMax-M2.7";
+      defaultThinkingLevel = "high";
+    };
+
+    # pi-guardrails: strict security config
+    # NOTE: Path access checks are lexical (not symlink-safe).
+    # NOTE: Local project .pi/extensions/guardrails.json can override same rule IDs.
+    #       For immutable global policies, consider a wrapper or upstream patch.
+    guardrails = {
+      enable = true;
+      config = {
+        enabled = true;
+        applyBuiltinDefaults = true;
+
+        onboarding = {
+          completed = true;
+        };
+
+        features = {
+          policies = true;
+          permissionGate = true;
+          pathAccess = true;
+        };
+
+        pathAccess = {
+          mode = "ask";
+          allowedPaths = [
+            "/nix/store/"
+            "/tmp/"
+          ];
+        };
+
+        policies = {
+          rules = [
+            # ── SSH keys ───────────────────────────────────────────
+            {
+              id = "home-ssh";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.ssh/**";}
+                {pattern = "~/.ssh/*_rsa";}
+                {pattern = "~/.ssh/*_ed25519";}
+                {pattern = "~/.ssh/*.pem";}
+              ];
+              allowedPatterns = [
+                {pattern = "~/.ssh/*.pub";}
+              ];
+            }
+
+            # ── GPG keys ─────────────────────────────────────────
+            {
+              id = "home-gpg";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.gnupg/**";}
+                {pattern = "~/*.gpg";}
+                {pattern = "~/.gpg-agent.conf";}
+              ];
+            }
+
+            # ── AWS credentials ────────────────────────────────────
+            {
+              id = "home-aws";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.aws/**";}
+                {pattern = "~/.aws/credentials";}
+                {pattern = "~/.aws/config";}
+              ];
+            }
+
+            # ── Kubernetes configs ────────────────────────────────
+            {
+              id = "home-kube";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.kube/**";}
+                {pattern = "*kubeconfig*";}
+              ];
+            }
+
+            # ── Cloud CLI configs ────────────────────────────────
+            {
+              id = "home-config";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.config/gh/**";}
+                {pattern = "~/.config/gcloud/**";}
+                {pattern = "~/.config/op/**";}
+                {pattern = "~/.config/sops/**";}
+              ];
+            }
+
+            # ── agenix secrets ───────────────────────────────────
+            {
+              id = "agenix-secrets";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "/run/agenix/**";}
+              ];
+            }
+
+            # ── Pi auth and sessions ────────────────────────────
+            {
+              id = "pi-auth-sessions";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "~/.pi/agent/auth.json";}
+                {pattern = "~/.pi/agent/sessions/**";}
+              ];
+            }
+
+            # ── Environment files ─────────────────────────────────
+            {
+              id = "secret-files";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = true;
+              patterns = [
+                {pattern = ".env";}
+                {pattern = ".env.*";}
+                {pattern = ".dev.vars";}
+              ];
+              allowedPatterns = [
+                {pattern = "*.example.env";}
+                {pattern = "*.sample.env";}
+                {pattern = "*.test.env";}
+                {pattern = ".env.example";}
+                {pattern = ".env.sample";}
+                {pattern = ".env.test";}
+              ];
+            }
+
+            # ── Private keys and certificates ───────────────────
+            {
+              id = "private-keys";
+              enabled = true;
+              protection = "noAccess";
+              onlyIfExists = false;
+              patterns = [
+                {pattern = "*.pem";}
+                {pattern = "*.key";}
+                {pattern = "*.p12";}
+                {pattern = "*.pfx";}
+                {pattern = "*id_rsa*";}
+                {pattern = "*id_ed25519*";}
+                {pattern = "*id_ecdsa*";}
+              ];
+              allowedPatterns = [
+                {pattern = "*.pub";}
+                {pattern = "*.csr";}
+              ];
+            }
+          ];
+        };
+
+        permissionGate = {
+          explainCommands = false;
+          # Auto-deny patterns: env leakage and credential dumping
+          autoDenyPatterns = [
+            {
+              pattern = "\\benv\\b";
+              regex = true;
+              description = "env command (may dump environment)";
+            }
+            {
+              pattern = "\\bprintenv\\b";
+              regex = true;
+              description = "printenv command (dumps environment variables)";
+            }
+            {
+              pattern = "/proc/[0-9]+/environ";
+              regex = true;
+              description = "reading process environment files";
+            }
+            {
+              pattern = "gpg\\s+--export-secret-keys";
+              regex = true;
+              description = "GPG secret key export";
+            }
+            {
+              pattern = "gpg\\s+--export-secret-subkeys";
+              regex = true;
+              description = "GPG secret subkey export";
+            }
+            {
+              pattern = "ssh-add\\s+-D";
+              regex = true;
+              description = "delete all SSH identities";
+            }
+            {
+              pattern = "\\b(op|pass)\\s+(read|show|get)";
+              regex = true;
+              description = "password manager read operations";
+            }
+          ];
+        };
+      };
+    };
+
+    # MCP servers auto-inherited from programs.mcp in default.nix
+  };
+}

home/coding/default.nix

@@ -0,0 +1,12 @@
+# Coding environment aggregator — profile-independent development tooling.
+# Imports editors, LSP servers, git configuration, the agent system, language runtimes, and optional packages.
+{...}: {
+  imports = [
+    ./editor
+    ./lsp
+    ./git/git.nix
+    ./agents/agents.nix
+    ./languages
+    ./packages.nix
+  ];
+}

home/coding/editor/default.nix

@@ -0,0 +1,6 @@
+# Editor aggregator — delegates to m3ta-nixpkgs editor modules.
+{...}: {
+  imports = [
+    ./neovim.nix
+  ];
+}

home/coding/editor/neovim.nix

@@ -0,0 +1,7 @@
+# NeoVim base configuration via m3ta-nixpkgs coding.editors module.
+# The option `coding.editors.neovim.enable` is declared by
+# inputs.m3ta-nixpkgs.homeManagerModules.default — no re-declaration here.
+{...}: {
+  # Placeholder for host-agnostic NeoVim overrides.
+  # Set coding.editors.neovim.enable = true in per-host files to activate.
+}

home/coding/git/git.nix

@@ -0,0 +1,41 @@
+# Git configuration with signing, aliases, and global ignore.
+# Identity and host-specific SSH keys are set per-host in home/m3tam3re/.
+{
+  lib,
+  pkgs,
+  ...
+}:
+with lib; {
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        name = lib.mkDefault "m3tam3re";
+        email = lib.mkDefault "p@m3ta.dev";
+      };
+      core.excludesfile = "~/.gitignore_global";
+      init.defaultBranch = "master";
+      alias = {
+        st = "status";
+        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
+      };
+    };
+  };
+
+  programs.difftastic.enable = true;
+
+  programs.jujutsu = {
+    enable = true;
+    settings = {
+      user = {
+        email = "m@m3tam3re.com";
+        name = "Sascha Koenig";
+      };
+    };
+  };
+
+  home.packages = with pkgs; [
+    lazygit
+  ];
+}

home/coding/languages/default.nix

@@ -0,0 +1,10 @@
+# Language runtimes — Python, JavaScript, Rust, Go, TypeScript.
+{...}: {
+  imports = [
+    ./python.nix
+    ./javascript.nix
+    ./rust-toolchain.nix
+    ./go.nix
+    ./typescript.nix
+  ];
+}

home/coding/languages/go.nix

@@ -0,0 +1,19 @@
+# Go toolchain — compiler and language server.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.go;
+in {
+  options.coding.languages.go.enable = mkEnableOption "Go toolchain";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      go
+      gopls
+    ];
+  };
+}

home/coding/languages/javascript.nix

@@ -0,0 +1,25 @@
+# JavaScript/TypeScript runtime — Node.js and Bun.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.javascript;
+  npmGlobalPrefix = "${config.home.homeDirectory}/.npm-global";
+in {
+  options.coding.languages.javascript.enable = mkEnableOption "JavaScript runtime (Node.js + Bun)";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      nodejs
+      bun
+    ];
+
+    home.file.".npmrc".text = ''
+      prefix=${npmGlobalPrefix}
+    '';
+    home.sessionVariables.NPM_CONFIG_PREFIX = npmGlobalPrefix;
+  };
+}

home/coding/languages/python.nix

@@ -0,0 +1,35 @@
+# Python runtime with pip and uv.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.python;
+in {
+  options.coding.languages.python = {
+    enable = mkEnableOption "Python runtime with pip and uv";
+    extraPackages = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExpression "[ pkgs.python3Packages.numpy ]";
+      description = "Additional Python packages to include";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      (pkgs.python3.withPackages (ps:
+        with ps;
+          [
+            uv
+          ]
+          ++ cfg.extraPackages))
+      (writeShellScriptBin "pip" "exec uv pip $@")
+      (writeShellScriptBin "pip3" "exec uv pip $@")
+      pyrefly
+      ruff
+    ];
+  };
+}

home/coding/languages/rust-toolchain.nix

@@ -0,0 +1,20 @@
+# Rust toolchain — compiler, package manager, and language server.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.rustToolchain;
+in {
+  options.coding.languages.rustToolchain.enable = mkEnableOption "Rust toolchain";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      rustc
+      cargo
+      rust-analyzer
+    ];
+  };
+}

home/coding/languages/typescript.nix

@@ -0,0 +1,19 @@
+# TypeScript support — language server and type checking tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.languages.typescript;
+in {
+  options.coding.languages.typescript.enable = mkEnableOption "TypeScript support";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      typescript
+      typescript-language-server
+    ];
+  };
+}

home/coding/lsp/default.nix

@@ -0,0 +1,6 @@
+# LSP aggregator — language server protocol tooling.
+{...}: {
+  imports = [
+    ./servers.nix
+  ];
+}

home/coding/lsp/servers.nix

@@ -0,0 +1,23 @@
+# LSP server configuration — language servers for the development environment.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.lsp;
+in {
+  options.coding.lsp.enable = mkEnableOption "enable LSP servers";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      # Nix
+      nixd
+      # General
+      typescript-language-server
+      tailwindcss-language-server
+      pyrefly
+    ];
+  };
+}

home/coding/packages.nix

@@ -0,0 +1,20 @@
+# Additional coding packages — API clients and GUI development tools.
+# Opt-in since not all coding hosts need these desktop-oriented tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.coding.packages;
+in {
+  options.coding.packages.enable = mkEnableOption "additional coding packages (bruno, insomnia)";
+
+  config = mkIf cfg.enable {
+    home.packages = [
+      pkgs.bruno
+      pkgs.insomnia
+    ];
+  };
+}

home/common/default.nix

@@ -0,0 +1,56 @@
+{
+  inputs,
+  lib,
+  outputs,
+  pkgs,
+  system,
+  ...
+}: {
+  imports = [
+    inputs.nix-colors.homeManagerModules.default
+    inputs.m3ta-nixpkgs.homeManagerModules.default
+  ]; #imports = builtins.attrValues outputs.homeManagerModules;
+  nixpkgs = {
+    # You can add overlays here
+    overlays = [
+      # Add overlays your own flake exports (from overlays and pkgs dir):
+      #outputs.overlays.additions
+      #outputs.overlays.modifications
+      outputs.overlays.temp-packages
+      outputs.overlays.stable-packages
+      outputs.overlays.locked-packages
+      outputs.overlays.pinned-packages
+      outputs.overlays.master-packages
+
+      inputs.nur.overlays.default
+      inputs.m3ta-nixpkgs.overlays.default
+      inputs.m3ta-nixpkgs.overlays.modifications
+      (outputs.lib.mkLlmAgentsOverlay system)
+      # You can also add overlays exported from other flakes:
+      # neovim-nightly-overlay.overlays.default
+
+      # Or define it inline, for example:
+      # (final: prev: {
+      #   hi = final.hello.overrideAttrs (oldAttrs: {
+      #     patches = [ ./change-hello-to-hi.patch ];
+      #   });
+      # })
+    ];
+    # Configure your nixpkgs instance
+    config = {
+      # Disable if you don't want unfree packages
+      allowUnfree = true;
+      # Workaround for https://github.com/nix-community/home-manager/issues/2942
+      allowUnfreePredicate = _: true;
+    };
+  };
+
+  nix = {
+    package = lib.mkDefault pkgs.nix;
+    settings = {
+      experimental-features = ["nix-command" "flakes"];
+      warn-dirty = false;
+    };
+  };
+  colorScheme = inputs.nix-colors.colorSchemes.dracula;
+}

home/desktop/apps/crypto.nix

@@ -0,0 +1,16 @@
+# Cryptocurrency applications — Bisq, Monero GUI, and Trezor Suite.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.crypto;
+in {
+  options.desktop.apps.crypto.enable = mkEnableOption "enable crypto applications";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [bisq2 monero-gui trezor-suite];
+  };
+}

home/desktop/apps/default.nix

@@ -0,0 +1,10 @@
+# Desktop apps aggregator — Obsidian, Office, web apps, crypto tools, and productivity.
+{...}: {
+  imports = [
+    ./obsidian.nix
+    ./office.nix
+    ./webapps.nix
+    ./crypto.nix
+    ./productivity.nix
+  ];
+}

home/desktop/apps/obsidian.nix

@@ -0,0 +1,25 @@
+# Obsidian knowledge base with markdown MIME association.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.obsidian;
+in {
+  options.desktop.apps.obsidian.enable = mkEnableOption "enable Obsidian knowledge base";
+
+  config = mkIf cfg.enable {
+    programs.obsidian.enable = true;
+
+    xdg.mimeApps = {
+      enable = true;
+      associations.added = {
+        "text/markdown" = ["obsidian.desktop"];
+      };
+      defaultApplications = {
+        "text/markdown" = ["obsidian.desktop"];
+      };
+    };
+  };
+}

home/desktop/apps/office.nix

@@ -0,0 +1,16 @@
+# Office and productivity applications — LibreOffice and document tools.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.office;
+in {
+  options.desktop.apps.office.enable = mkEnableOption "install office and paperwork apps";
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.libreoffice-fresh];
+  };
+}

home/desktop/apps/productivity.nix

@@ -0,0 +1,18 @@
+# Productivity tools — Pomodoro timer and focus utilities.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.apps.productivity;
+in {
+  options.desktop.apps.productivity.enable = mkEnableOption "enable productivity tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      pomodoro-timer
+    ];
+  };
+}

home/desktop/apps/webapps.nix

@@ -0,0 +1,56 @@
+# Web application desktop entries — Teams, Outlook, Basecamp, and OpenCode launchers.
+{
+  config,
+  pkgs,
+  ...
+}: let
+  icons = {
+    teams = pkgs.fetchurl {
+      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-teams.svg";
+      sha256 = "sha256-Pr9QS8nnXJq97r4/G3c6JXi34zxHl0ps9gcyI8cN/s8=";
+    };
+    outlook = pkgs.fetchurl {
+      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/microsoft-outlook.svg";
+      sha256 = "sha256-3u8t5QNHFZvrAegxBiGicO4PjtMWhEaQSCv7MSSfLLc=";
+    };
+    opencode = pkgs.fetchurl {
+      url = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/opencode-dark.svg";
+      sha256 = "1lms4f8habamvdh2qqqz9psx4py9wx23mmlkkds44pvrbq3bkj3n";
+    };
+  };
+in {
+  xdg.desktopEntries = {
+    teams = {
+      name = "Microsoft Teams";
+      exec = "launch-webapp https://teams.microsoft.com";
+      comment = "Open Microsoft Teams as a Desktop App";
+      categories = ["Application" "Network" "Chat"];
+      terminal = false;
+      icon = icons.teams;
+    };
+    outlook = {
+      name = "Microsoft Outlook";
+      exec = "launch-webapp https://outlook.office.com/mail/";
+      comment = "Open Microsoft Outlook as a Desktop App";
+      categories = ["Application" "Network"];
+      terminal = false;
+      icon = icons.outlook;
+    };
+    basecamp = {
+      name = "Basecamp";
+      exec = "launch-webapp https://3.basecamp.com/5996442/";
+      comment = "Open Basecamp as a Desktop App";
+      categories = ["Application" "Network"];
+      terminal = false;
+      icon = "${config.home.homeDirectory}/.local/share/icons/basecamp-logo.png";
+    };
+    opencode = {
+      name = "Opencode";
+      exec = "rofi-project-opener";
+      comment = "Open Opencode Terminal App";
+      categories = ["Application" "Development"];
+      terminal = false;
+      icon = icons.opencode;
+    };
+  };
+}

home/desktop/default.nix

@@ -0,0 +1,125 @@
+# Desktop environment aggregator — only loaded when context=desktop.
+# Includes window manager, applications, theming, and desktop session config.
+{
+  config,
+  pkgs,
+  ...
+}: {
+  imports = [
+    ./wm
+    ./apps
+    ./theme
+  ];
+
+  xdg = {
+    enable = true;
+    configFile."mimeapps.list".force = true;
+    mimeApps = {
+      enable = true;
+      associations.added = {
+        "application/zip" = ["org.gnome.FileRoller.desktop"];
+        "application/csv" = ["calc.desktop"];
+        "application/pdf" = ["okularApplication_pdf.desktop"];
+      };
+      defaultApplications = {
+        "application/zip" = ["org.gnome.FileRoller.desktop"];
+        "application/csv" = ["calc.desktop"];
+        "application/pdf" = ["okularApplication_pdf.desktop"];
+        "application/md" = ["nvim.desktop"];
+        "application/text" = ["nvim.desktop"];
+        "x-scheme-handler/http" = ["io.github.zen_browser.zen"];
+        "x-scheme-handler/https" = ["io.github.zen_browser.zen"];
+      };
+    };
+    userDirs = {
+      enable = true;
+      createDirectories = true;
+      setSessionVariables = true;
+    };
+  };
+
+  home.sessionVariables = {
+    WEBKIT_DISABLE_COMPOSITING_MODE = "1";
+    NIXOS_OZONE_WL = "1";
+    TERMINAL = "ghostty";
+    QT_QPA_PLATFORM = "wayland";
+    XDG_CURRENT_DESKTOP = "Hyprland";
+    XDG_SESSION_TYPE = "wayland";
+    XDG_SESSION_DESKTOP = "Hyprland";
+  };
+
+  home.sessionPath = [
+    "\${XDG_BIN_HOME}"
+    "\${HOME}/.cargo/bin"
+    "$HOME/.npm-global/bin"
+    "$HOME/.cache/.bun/bin"
+  ];
+
+  fonts.fontconfig.enable = true;
+
+  programs.ghostty = {
+    enable = true;
+    enableFishIntegration = true;
+    enableBashIntegration = true;
+    settings = {
+      font-family = "Fira Code";
+      copy-on-select = true;
+      foreground = "#${config.colorScheme.palette.base05}";
+      background = "#${config.colorScheme.palette.base00}";
+      selection-foreground = "#${config.colorScheme.palette.base07}";
+      selection-background = "#${config.colorScheme.palette.base02}";
+      cursor-color = "#${config.colorScheme.palette.base05}";
+      palette = [
+        "0=#${config.colorScheme.palette.base01}"
+        "1=#${config.colorScheme.palette.base08}"
+        "2=#${config.colorScheme.palette.base0B}"
+        "3=#${config.colorScheme.palette.base0A}"
+        "4=#${config.colorScheme.palette.base0D}"
+        "5=#${config.colorScheme.palette.base0E}"
+        "6=#${config.colorScheme.palette.base0C}"
+        "7=#${config.colorScheme.palette.base05}"
+        "8=#${config.colorScheme.palette.base03}"
+        "9=#${config.colorScheme.palette.base08}"
+        "10=#${config.colorScheme.palette.base0B}"
+        "11=#${config.colorScheme.palette.base0A}"
+        "12=#${config.colorScheme.palette.base0D}"
+        "13=#${config.colorScheme.palette.base0E}"
+        "14=#${config.colorScheme.palette.base0C}"
+        "15=#${config.colorScheme.palette.base07}"
+      ];
+    };
+  };
+
+  home.pointerCursor = {
+    gtk.enable = true;
+    package = pkgs.bibata-cursors;
+    name = "Bibata-Modern-Ice";
+    size = 20;
+  };
+
+  home.packages = with pkgs; [
+    appimage-run
+    bemoji
+    brave
+    distrobox
+    eigent
+    (element-desktop.override {
+      commandLineArgs = "--password-store=gnome-libsecret";
+    })
+    launch-webapp
+    file-roller
+    hyprpanel
+    seahorse
+    sushi
+    ksnip
+    msty-studio
+    nwg-look
+    rose-pine-hyprcursor
+    remmina
+    slack
+    telegram-desktop
+    vivaldi
+    vivaldi-ffmpeg-codecs
+    vibetyper
+  ];
+}

home/desktop/theme/default.nix

@@ -0,0 +1,8 @@
+# Theme aggregator — fonts, GTK/Qt theming, and wallpapers.
+{...}: {
+  imports = [
+    ./fonts.nix
+    ./theme.nix
+    ./wallpapers.nix
+  ];
+}

home/desktop/theme/fonts.nix

@@ -0,0 +1,24 @@
+# Font packages — Fira Code, JetBrains Mono Nerd Font, and supporting icon fonts.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.theme.fonts;
+in {
+  options.desktop.theme.fonts.enable = mkEnableOption "install desktop fonts";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      fira-code
+      fira-code-symbols
+      nerd-fonts.fira-code
+      nerd-fonts.jetbrains-mono
+      font-manager
+      font-awesome_5
+      noto-fonts
+    ];
+  };
+}

home/desktop/theme/theme.nix

@@ -0,0 +1,24 @@
+# GTK and Qt theming — Dracula theme with matching icons and cursor.
+{
+  pkgs,
+  config,
+  ...
+}: {
+  qt = {
+    enable = true;
+    platformTheme.name = "gtk";
+  };
+
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Dracula";
+      package = pkgs.dracula-theme;
+    };
+    iconTheme = {
+      name = "Dracula";
+      package = pkgs.dracula-icon-theme;
+    };
+    gtk4.theme = config.gtk.theme;
+  };
+}

home/desktop/theme/wallpapers.nix

@@ -0,0 +1,19 @@
+# Wallpaper collection — copies wallpapers to Hyprland config directory.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.theme.wallpapers.enable;
+in {
+  options.desktop.theme.wallpapers.enable = mkEnableOption "wallpapers for Hyprland";
+
+  config = mkIf cfg {
+    xdg.configFile."hypr/wallpapers" = {
+      # Wallpapers are stored relative to the home/m3tam3re directory.
+      source = ../../m3tam3re/wallpapers;
+      recursive = true;
+    };
+  };
+}

home/desktop/wm/default.nix

@@ -0,0 +1,8 @@
+# Window manager aggregator — Hyprland, Wayland tools, and Rofi launcher.
+{...}: {
+  imports = [
+    ./hyprland.nix
+    ./wayland.nix
+    ./rofi.nix
+  ];
+}

home/desktop/wm/hyprland.nix

@@ -0,0 +1,318 @@
+# Hyprland window manager with keybindings, window rules, idle/lock, and hyprpaper.
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.wm.hyprland;
+in {
+  options.desktop.wm.hyprland.enable = mkEnableOption "Hyprland window manager";
+
+  config = mkIf cfg.enable {
+    wayland.windowManager.hyprland = {
+      settings = {
+        xwayland = {
+          force_zero_scaling = true;
+        };
+
+        exec-once = [
+          "hyprpanel"
+          "while ! hyprpaper-random; do sleep 0.5; done"
+          "wl-paste --type text --watch cliphist store"
+          "wl-paste --type image --watch cliphist store"
+          "vibetyper"
+        ];
+
+        env = [
+          "XCURSOR_SIZE,32"
+          "HYPRCURSOR_THEME,Bibata-Modern-Ice"
+          "WLR_NO_HARDWARE_CURSORS,1"
+          "GTK_THEME,Dracula"
+          "XDG_CURRENT_DESKTOP,Hyprland"
+          "XDG_SESSION_TYPE,wayland"
+          "XDG_SESSION_DESKTOP,Hyprland"
+          "XKB_DEFAULT_LAYOUT,de"
+          "NIXOS_OZONE_WL,1"
+        ];
+
+        input = {
+          kb_layout = "de,us";
+          kb_variant = "";
+          kb_model = "";
+          kb_rules = "";
+          kb_options = "ctrl:nocaps";
+          follow_mouse = 1;
+        };
+
+        general = {
+          gaps_in = 5;
+          gaps_out = 5;
+          border_size = 1;
+          "col.active_border" = "rgba(9742b5ee) rgba(9742b5ee) 45deg";
+          "col.inactive_border" = "rgba(${config.colorScheme.palette.base03}aa)";
+          layout = "dwindle";
+        };
+
+        decoration = {
+          shadow = {
+            enabled = true;
+            range = 60;
+            render_power = 3;
+            color = "rgba(${config.colorScheme.palette.base00}66)";
+            offset = "1 2";
+            scale = 0.97;
+          };
+          rounding = 8;
+          blur = {
+            enabled = true;
+            size = 3;
+            passes = 3;
+          };
+          active_opacity = 0.9;
+          inactive_opacity = 0.5;
+        };
+
+        animations = {
+          enabled = true;
+          bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
+          animation = [
+            "windows, 1, 7, myBezier"
+            "windowsOut, 1, 7, default, popin 80%"
+            "border, 1, 10, default"
+            "borderangle, 1, 8, default"
+            "fade, 1, 7, default"
+            "workspaces, 1, 6, default"
+          ];
+        };
+
+        dwindle = {
+          pseudotile = true;
+          preserve_split = true;
+        };
+
+        master = {
+          new_status = "master";
+        };
+
+        device = [
+          {
+            name = "epic-mouse-v1";
+            sensitivity = -0.5;
+          }
+          {
+            name = "zsa-technology-labs-moonlander-mark-i";
+            kb_layout = "us";
+          }
+          {
+            name = "keychron-keychron-k7";
+            kb_layout = "us";
+          }
+        ];
+
+        windowrule = [
+          "match:class file_progress, float on"
+          "match:class confirm, float on"
+          "match:class dialog, float on"
+          "match:class download, float on"
+          "match:class notification, float on"
+          "match:class error, float on"
+          "match:class splash, float on"
+          "match:class confirmreset, float on"
+          "match:title Open File, float on"
+          "match:title branchdialog, float on"
+          "match:class pavucontrol-qt, float on"
+          "match:class pavucontrol, float on"
+          "match:class class:^(espanso)$, float on"
+          "match:class wlogout, fullscreen on"
+          "match:title wlogout, float on"
+          "match:title wlogout, fullscreen on"
+          "match:class mpv, float on"
+          "match:class mpv, idle_inhibit focus"
+          "match:class mpv, opacity 1.0 override"
+          "match:title ^(Media viewer)$, float on"
+          "match:title ^(Volume Control)$, float on"
+          "match:title ^(Picture-in-Picture)$, float on"
+          "match:title ^(floating-pomodoro)$, float on"
+          "match:title ^(floating-pomodoro)$, size 250 50"
+          "match:title ^(floating-pomodoro)$, move 12 (monitor_h-150)"
+          "match:title ^(floating-pomodoro)$, pin on"
+          "match:initial_title .*streamlabs.com.*, float on"
+          "match:initial_title .*streamlabs.com.*, pin on"
+          "match:initial_title .*streamlabs.com.*, size 800 400"
+          "match:initial_title .*alert-box.*, move 100%-820 102"
+          "match:initial_title .*chat-box.*, move 100%-820 512"
+          "match:initial_title .*streamlabs.com.*, opacity 0.5 override"
+          "match:initial_title .*streamlabs.com.*, idle_inhibit focus"
+          "match:initial_title .*streamlabs.com.*, no_anim on"
+          "match:initial_title .*streamlabs.com.*, decorate off"
+          "match:initial_title .*streamlabs.com.*, no_shadow on"
+          "match:initial_title .*streamlabs.com.*, no_blur on"
+          "match:class ^vibe-typer$, match:title ^Recording Indicator$, no_blur on"
+          "border_color rgb(ffffff), match:xwayland 1"
+        ];
+
+        "$mainMod" = "SUPER";
+        "$terminal" = "ghostty";
+
+        bind = [
+          "$mainMod, return, exec, $terminal nu -c zellij-ps"
+          "$mainMod, t, exec, $terminal -e nu -c 'nitch; exec nu'"
+          "$mainMod SHIFT, t, exec, launch-timer"
+          "$mainMod, n, exec, $terminal -e nvim"
+          "$mainMod, z, exec, uwsm app -- zeditor"
+          "$mainMod, o, exec, hyprctl dispatch setprop activewindow opaque toggle"
+          "$mainMod, r, exec, hyprctl dispatch focuswindow \"initialtitle:.*alert-box.*\" && hyprctl dispatch moveactive exact 4300 102 && hyprctl dispatch focuswindow \"initialtitle:.*chat-box.*\" && hyprctl dispatch moveactive exact 4300 512"
+          "$mainMod, b, exec, uwsm app -- thunar"
+          "$mainMod SHIFT, B, exec, uwsm app -- vivaldi"
+          "$mainMod, Escape, exec, uwsm app -- wlogout -p layer-shell"
+          "$mainMod, Space, togglefloating"
+          "$mainMod, q, killactive"
+          "$mainMod, M, exit"
+          "$mainMod, F, fullscreen"
+          "$mainMod SHIFT, V, togglefloating"
+          "$mainMod, D, exec, uwsm app -- rofi -show drun -run-command \"uwsm app -- {cmd}\""
+          "$mainMod, V, exec, uwsm app -- cliphist list | rofi -dmenu | cliphist decode | wl-copy"
+          "$mainMod, C, exec, bash -c 'FILE=/tmp/screenshot_$(date +%s).png; grim -g \"$(slurp)\" \"$FILE\" && ksnip \"$FILE\"'"
+          "$mainMod SHIFT, S, exec, uwsm app -- rofi -show emoji"
+          "$mainMod, P, exec, uwsm app -- rofi-pass"
+          "$mainMod SHIFT, P, pseudo"
+          "$mainMod, R, exec, stt-ptt start"
+          "$mainMod, S, exec, stt-ptt start"
+          "$mainMod, J, togglesplit"
+          "$mainMod, h, movefocus, l"
+          "$mainMod, l, movefocus, r"
+          "$mainMod, k, movefocus, u"
+          "$mainMod, j, movefocus, d"
+          "$mainMod, 1, workspace, 1"
+          "$mainMod, 2, workspace, 2"
+          "$mainMod, 3, workspace, 3"
+          "$mainMod, 4, workspace, 4"
+          "$mainMod, 5, workspace, 5"
+          "$mainMod, 6, workspace, 6"
+          "$mainMod, 7, workspace, 7"
+          "$mainMod, 8, workspace, 8"
+          "$mainMod, 9, workspace, 9"
+          "$mainMod, 0, workspace, 10"
+          "$mainMod SHIFT, 1, movetoworkspace, 1"
+          "$mainMod SHIFT, 2, movetoworkspace, 2"
+          "$mainMod SHIFT, 3, movetoworkspace, 3"
+          "$mainMod SHIFT, 4, movetoworkspace, 4"
+          "$mainMod SHIFT, 5, movetoworkspace, 5"
+          "$mainMod SHIFT, 6, movetoworkspace, 6"
+          "$mainMod SHIFT, 7, movetoworkspace, 7"
+          "$mainMod SHIFT, 8, movetoworkspace, 8"
+          "$mainMod SHIFT, 9, movetoworkspace, 9"
+          "$mainMod SHIFT, 0, movetoworkspace, 10"
+          "$mainMod, mouse_down, workspace, e+1"
+          "$mainMod, mouse_up, workspace, e-1"
+        ];
+
+        bindr = [
+          "$mainMod, R, exec, stt-ptt stop"
+          "$mainMod, S, exec, stt-ptt format-stop"
+        ];
+
+        bindm = [
+          "$mainMod, mouse:272, movewindow"
+          "$mainMod, mouse:273, resizewindow"
+        ];
+      };
+    };
+
+    services.hypridle = {
+      enable = true;
+      settings = {
+        general = {
+          before_sleep_cmd = "hyprlock";
+          after_sleep_cmd = "hyprctl dispatch dpms on";
+          inhibit_sleep = 3;
+        };
+        listener = [
+          {
+            timeout = 300;
+            on-timeout = "hyprlock";
+          }
+          {
+            timeout = 420;
+            on-timeout = "hyprctl dispatch dpms off";
+            on-resume = "hyprctl dispatch dpms on";
+          }
+        ];
+      };
+    };
+
+    services.hyprpaper.enable = true;
+
+    programs.hyprlock = {
+      enable = true;
+      settings = {
+        "$font" = "JetBrainsMono Nerd Font";
+        "$base" = "rgb(${config.colorScheme.palette.base00})";
+        "$text" = "rgb(${config.colorScheme.palette.base05})";
+        "$textAlpha" = "${config.colorScheme.palette.base05}";
+        "$accentAlpha" = "${config.colorScheme.palette.base0D}";
+        "$red" = "rgb(${config.colorScheme.palette.base08})";
+        "$yellow" = "rgb(${config.colorScheme.palette.base0A})";
+
+        general = {
+          hide_cursor = true;
+        };
+
+        background = {
+          monitor = "";
+          path = "${config.home.homeDirectory}/.config/hypr/wallpapers/wallhaven-lmmo8r.jpg";
+          blur_passes = 0;
+          color = "rgb(${config.colorScheme.palette.base00})";
+        };
+
+        label = [
+          {
+            monitor = "";
+            text = "$TIME";
+            color = "$text";
+            font_size = 90;
+            font_family = "$font";
+            position = "30, 0";
+            halign = "left";
+            valign = "top";
+          }
+          {
+            monitor = "";
+            text = ''cmd[update:43200000] echo "$(date +"%A, %d %B %Y")"'';
+            color = "$text";
+            font_size = 25;
+            font_family = "$font";
+            position = "30, -150";
+            halign = "left";
+            valign = "top";
+          }
+        ];
+
+        input-field = [
+          {
+            monitor = "";
+            size = "300, 60";
+            outline_thickness = 4;
+            dots_size = 0.2;
+            dots_spacing = 0.2;
+            dots_center = true;
+            outer_color = "rgb(${config.colorScheme.palette.base0D})";
+            inner_color = "rgb(${config.colorScheme.palette.base00})";
+            font_color = "rgb(${config.colorScheme.palette.base05})";
+            fade_on_empty = false;
+            placeholder_text = ''<span foreground="##${config.colorScheme.palette.base05}">󰌾  Logged in as <span foreground="##${config.colorScheme.palette.base0D}">$USER</span></span>'';
+            hide_input = false;
+            check_color = "rgb(${config.colorScheme.palette.base0D})";
+            fail_color = "rgb(${config.colorScheme.palette.base08})";
+            fail_text = ''<i>$FAIL <b>($ATTEMPTS)</b></i>'';
+            capslock_color = "rgb(${config.colorScheme.palette.base0A})";
+            position = "0, -35";
+            halign = "center";
+            valign = "center";
+          }
+        ];
+      };
+    };
+  };
+}

home/desktop/wm/rofi.nix

@@ -0,0 +1,207 @@
+# Rofi application launcher with nix-colors theme, pass integration, and project opener.
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.wm.rofi;
+in {
+  options.desktop.wm.rofi.enable = mkEnableOption "enable rofi";
+
+  config = mkIf cfg.enable {
+    programs.rofi = {
+      enable = true;
+      package = pkgs.rofi.override {
+        plugins = [
+          pkgs.rofi-calc
+          pkgs.rofi-emoji
+          pkgs.stable.rofi-file-browser
+        ];
+      };
+      pass = {
+        enable = true;
+        package = pkgs.rofi-pass-wayland;
+      };
+      terminal = "${pkgs.ghostty}/bin/ghostty";
+      font = "Fira Code";
+      extraConfig = {
+        show-icons = true;
+        disable-history = false;
+        modi = "drun,calc,emoji,filebrowser";
+        kb-primary-paste = "Control+V,Shift+Insert";
+        kb-secondary-paste = "Control+v,Insert";
+      };
+      theme = let
+        inherit (config.colorScheme) palette;
+      in
+        builtins.toString (pkgs.writeText "rofi-universal-theme.rasi" ''
+          * {
+            /* Universal theme colors from nix-colors */
+            background:  #${palette.base00};
+            surface:     #${palette.base01};
+            overlay:     #${palette.base02};
+            muted:       #${palette.base03};
+            subtle:      #${palette.base04};
+            text:        #${palette.base05};
+            bright-text: #${palette.base06};
+            highlight:   #${palette.base07};
+            accent1:     #${palette.base08};
+            accent2:     #${palette.base09};
+            accent3:     #${palette.base0A};
+            accent4:     #${palette.base0B};
+            accent5:     #${palette.base0C};
+            accent6:     #${palette.base0D};
+            accent7:     #${palette.base0E};
+            accent8:     #${palette.base0F};
+
+            /* Global properties */
+            background-color: @background;
+            text-color: @text;
+            font: "Fira Code 12";
+            border: 0;
+            margin: 0;
+            padding: 0;
+            spacing: 0;
+          }
+
+          window {
+            background-color: @background;
+            border: 1px;
+            border-color: @accent7;
+            border-radius: 6px;
+            width: 40%;
+            padding: 16px;
+          }
+
+          inputbar {
+            children: [ prompt, entry ];
+            spacing: 12px;
+            padding: 8px;
+            border-radius: 4px;
+            background-color: @surface;
+          }
+
+          prompt {
+            text-color: @accent7;
+            background-color: transparent;
+          }
+
+          entry {
+            placeholder: "Search...";
+            placeholder-color: @subtle;
+            text-color: @text;
+            background-color: transparent;
+            cursor-color: @accent7;
+          }
+
+          message {
+            background-color: @surface;
+            border-radius: 4px;
+            padding: 8px;
+            margin: 8px 0;
+          }
+
+          textbox {
+            text-color: @text;
+            background-color: transparent;
+          }
+
+          listview {
+            background-color: transparent;
+            margin: 8px 0 0;
+            lines: 10;
+            columns: 1;
+            fixed-height: true;
+            scrollbar: false;
+          }
+
+          element {
+            background-color: transparent;
+            text-color: @text;
+            padding: 8px;
+            border-radius: 4px;
+            spacing: 8px;
+          }
+
+          element normal.normal {
+            background-color: transparent;
+            text-color: @text;
+          }
+
+          element selected.normal {
+            background-color: @accent7;
+            text-color: @background;
+          }
+
+          element alternate.normal {
+            background-color: transparent;
+            text-color: @text;
+          }
+
+          element-icon {
+            background-color: transparent;
+            size: 24px;
+          }
+
+          element-text {
+            background-color: transparent;
+            text-color: inherit;
+            vertical-align: 0.5;
+          }
+
+          mode-switcher {
+            spacing: 0;
+            background-color: @surface;
+            border-radius: 4px;
+            margin: 8px 0 0;
+          }
+
+          button {
+            padding: 8px 16px;
+            background-color: transparent;
+            text-color: @text;
+            border-radius: 4px;
+          }
+
+          button selected {
+            background-color: @accent7;
+            text-color: @background;
+          }
+
+          scrollbar {
+            width: 4px;
+            border: 0;
+            handle-color: @accent7;
+            handle-width: 4px;
+            padding: 0;
+          }
+        '');
+    };
+
+    cli.rofi-project-opener = {
+      enable = true;
+      projectDirs = {
+        AI = {
+          path = "~/p/AI";
+          args = "";
+        };
+        CHAT = {
+          path = "~/p/CHAT";
+          args = "--agent chiron";
+        };
+        MISC = {
+          path = "~/p/MISC";
+          args = "--agent chiron-forge";
+        };
+        NIX = {
+          path = "~/p/NIX";
+          args = "";
+        };
+      };
+      terminal = pkgs.ghostty;
+      terminalCommand = "opencode %a";
+    };
+  };
+}

home/desktop/wm/wayland.nix

@@ -0,0 +1,30 @@
+# Wayland extra tooling — screenshot, clipboard, cursor, and display utilities.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.desktop.wm.wayland;
+in {
+  options.desktop.wm.wayland.enable = mkEnableOption "wayland extra tools and config";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      grim
+      hyprcursor
+      hyprlock
+      hyprpaper
+      qt6.qtwayland
+      slurp
+      waypipe
+      wl-clipboard
+      wf-recorder
+      wl-mirror
+      wlogout
+      wtype
+      ydotool
+    ];
+  };
+}

home/lib/default.nix

@@ -0,0 +1,95 @@
+# home/lib/default.nix
+# Profile loading utilities for home-manager configurations.
+#
+# Usage:
+#   let homeLib = import ../lib { inherit lib; };
+#   in {
+#     imports = [
+#       (homeLib.mkHomeConfig { profiles = ["coding" "gaming"]; context = "desktop"; })
+#     ];
+#   }
+{lib}: let
+  # Infrastructure layer — nixpkgs overlays, nix-colors, m3ta-nixpkgs modules.
+  # Always loaded on every host.
+  commonModule = ../common;
+
+  # Base user environment — shell (nushell, starship), CLI tools, secrets.
+  # Always loaded on every host.
+  baseModule = ../base;
+
+  # Context-specific modules — desktop and server are mutually exclusive.
+  contextModuleMap = {
+    desktop = ../desktop;
+    server = ../server;
+  };
+
+  # Profile modules — freely combinable additions on top of base + context.
+  profileModuleMap = {
+    coding = ../coding;
+    gaming = ../profiles/gaming;
+    media = ../profiles/media;
+  };
+in {
+  # Generate a home-manager module with imports based on profiles and context.
+  #
+  # Args:
+  #   profiles: list of profile names (e.g. ["coding" "gaming" "media"])
+  #   context: host context, one of "desktop" | "server" | null
+  #
+  # Returns: a home-manager module attrset with imports and assertions.
+  #   Desktop and server contexts are mutually exclusive by design — passing
+  #   any value other than "desktop", "server", or null causes an assertion
+  #   failure at evaluation time.
+  mkHomeConfig = {
+    profiles ? [],
+    context ? null,
+  }: let
+    contextImport =
+      if context == "desktop"
+      then [contextModuleMap.desktop]
+      else if context == "server"
+      then [contextModuleMap.server]
+      else [];
+
+    # Partition profiles into known and unknown for assertion + safe import.
+    unknownProfiles =
+      builtins.filter
+      (profileName: ! builtins.hasAttr profileName profileModuleMap)
+      profiles;
+
+    # Only import known profiles; the assertion below catches unknowns.
+    activeProfiles =
+      builtins.filter
+      (profileName: builtins.hasAttr profileName profileModuleMap)
+      profiles;
+
+    profileImports = map (profileName: profileModuleMap.${profileName}) activeProfiles;
+
+    contextStr =
+      if context == null
+      then "null"
+      else context;
+  in {
+    imports =
+      [commonModule baseModule]
+      ++ contextImport
+      ++ profileImports;
+
+    assertions = [
+      {
+        assertion = builtins.elem context ["desktop" "server" null];
+        message =
+          "m3ta home: context must be 'desktop', 'server', or null"
+          + " (got: '${contextStr}')";
+      }
+      {
+        assertion = unknownProfiles == [];
+        message =
+          "m3ta home: unknown profiles requested:"
+          + " [ ${builtins.concatStringsSep " " unknownProfiles} ]."
+          + " Valid profiles are:"
+          + " [ ${builtins.concatStringsSep " " (builtins.attrNames profileModuleMap)} ]";
+      }
+    ];
+  };
+}

home/m3tam3re/home-server.nix

@@ -0,0 +1,121 @@
+# This is a default home.nix generated by the follwing hone-manager command
+#
+# home-manager init ./
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  # Home Manager needs a bit of information about you and the paths it should
+  # manage.
+  home.username = lib.mkDefault "your-name";
+  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
+
+  # This value determines the Home Manager release that your configuration is
+  # compatible with. This helps avoid breakage when a new Home Manager release
+  # introduces backwards incompatible changes.
+  #
+  # You should not change this value, even if you update Home Manager. If you do
+  # want to update the value, then make sure to first check the Home Manager
+  # release notes.
+  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
+
+  # The home.packages option allows you to install Nix packages into your
+  # environment.
+  home.packages = with pkgs; [
+    # # Adds the 'hello' command to your environment. It prints a friendly
+    # # "Hello, world!" when run.
+    # pkgs.hello
+
+    # # It is sometimes useful to fine-tune packages, for example, by applying
+    # # overrides. You can do that directly here, just don't forget the
+    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
+    # # fonts?
+    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
+
+    # # You can also create simple shell scripts directly inside your
+    # # configuration. For example, this adds a command 'my-hello' to your
+    # # environment:
+    # (pkgs.writeShellScriptBin "my-hello" ''
+    #   echo "Hello, ${config.home.username}!"
+    # '')
+  ];
+
+  # Home Manager is pretty good at managing dotfiles. The primary way to manage
+  # plain files is through 'home.file'.
+  home.file = {
+    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
+    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
+    # # symlink to the Nix store copy.
+    # ".screenrc".source = dotfiles/screenrc;
+
+    # # You can also set the file content immediately.
+    # ".gradle/gradle.properties".text = ''
+    #   org.gradle.console=verbose
+    #   org.gradle.daemon.idletimeout=3600000
+    # '';
+  };
+
+  # Home Manager can also manage your environment variables through
+  # 'home.sessionVariables'. If you don't want to manage your shell through Home
+  # Manager then you have to manually source 'hm-session-vars.sh' located at
+  # either
+  #
+  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
+  #
+  home.sessionVariables = {
+    # EDITOR = "emacs";
+  };
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        name = "m3tm3re";
+        email = "p@m3ta.dev";
+      };
+      core.excludesfile = "~/.gitignore_global";
+      init.defaultBranch = "master";
+      alias = {
+        st = "status";
+        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
+      };
+    };
+  };
+  # programs.zellij-ps = {
+  #   enable = true;
+  #   projectFolders = [
+  #     "${config.home.homeDirectory}/p/c"
+  #     "${config.home.homeDirectory}/p"
+  #     "${config.home.homeDirectory}/.config"
+  #   ];
+  #   layout = ''
+  #     layout {
+  #         pane size=1 borderless=true {
+  #             plugin location="zellij:tab-bar"
+  #         }
+  #         pane size="70%" command="nvim"
+  #         pane split_direction="vertical" {
+  #             pane
+  #             pane command="unimatrix"
+  #         }
+  #         pane size=1 borderless=true {
+  #             plugin location="zellij:status-bar"
+  #         }
+  #     }
+  #   '';
+  # };
+}

home/m3tam3re/home.nix

@@ -0,0 +1,262 @@
+# This is a default home.nix generated by the follwing hone-manager command
+#
+# home-manager init ./
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  # Home Manager needs a bit of information about you and the paths it should
+  # manage.
+  home.username = lib.mkDefault "your-name";
+  home.homeDirectory = lib.mkDefault "/home/${config.home.username}";
+
+  # This value determines the Home Manager release that your configuration is
+  # compatible with. This helps avoid breakage when a new Home Manager release
+  # introduces backwards incompatible changes.
+  #
+  # You should not change this value, even if you update Home Manager. If you do
+  # want to update the value, then make sure to first check the Home Manager
+  # release notes.
+  home.stateVersion = "26.05"; # Updated to adopt HM 26.05 defaults.
+
+  # The home.packages option allows you to install Nix packages into your
+  # environment.
+  home.packages = with pkgs; [
+    libgtop
+    # # Adds the 'hello' command to your environment. It prints a friendly
+    # # "Hello, world!" when run.
+    # pkgs.hello
+
+    # # It is sometimes useful to fine-tune packages, for example, by applying
+    # # overrides. You can do that directly here, just don't forget the
+    # # parentheses. Maybe you want to install Nerd Fonts with a limited number of
+    # # fonts?
+    # (pkgs.nerdfonts.override { fonts = [ "FantasqueSansMono" ]; })
+
+    # # You can also create simple shell scripts directly inside your
+    # # configuration. For example, this adds a command 'my-hello' to your
+    # # environment:
+    # (pkgs.writeShellScriptBin "my-hello" ''
+    #   echo "Hello, ${config.home.username}!"
+    # '')
+  ];
+
+  # Home Manager is pretty good at managing dotfiles. The primary way to manage
+  # plain files is through 'home.file'.
+  home.file = {
+    # # Building this configuration will create a copy of 'dotfiles/screenrc' in
+    # # the Nix store. Activating the configuration will then make '~/.screenrc' a
+    # # symlink to the Nix store copy.
+    # ".screenrc".source = dotfiles/screenrc;
+
+    # # You can also set the file content immediately.
+    # ".gradle/gradle.properties".text = ''
+    #   org.gradle.console=verbose
+    #   org.gradle.daemon.idletimeout=3600000
+    # '';
+  };
+
+  # Home Manager can also manage your environment variables through
+  # 'home.sessionVariables'. If you don't want to manage your shell through Home
+  # Manager then you have to manually source 'hm-session-vars.sh' located at
+  # either
+  #
+  #  ~/.nix-profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  ~/.local/state/nix/profiles/profile/etc/profile.d/hm-session-vars.sh
+  #
+  # or
+  #
+  #  /etc/profiles/per-user/m3tam3re/etc/profile.d/hm-session-vars.sh
+  #
+  home.sessionVariables = {
+    # EDITOR = "emacs";
+  };
+
+  # Let Home Manager install and manage itself.
+  programs.home-manager.enable = true;
+
+  services.cliphist = {
+    enable = true;
+    allowImages = true;
+  };
+
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        name = "m3tm3re";
+        email = "p@m3ta.dev";
+      };
+      core.excludesfile = "~/.gitignore_global";
+      init.defaultBranch = "master";
+      alias = {
+        st = "status";
+        logd = "log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit";
+      };
+    };
+  };
+
+  programs.difftastic.enable = true;
+
+  programs.jujutsu = {
+    enable = true;
+    settings = {
+      user = {
+        email = "m@m3tam3re.com";
+        name = "Sascha Koenig";
+      };
+    };
+  };
+
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+    matchBlocks = {
+      "AZ-CLD-1" = {
+        hostname = "152.53.186.119";
+        user = "sascha.koenig";
+        port = 2022;
+        identityFile = "~/.ssh/sascha.koenig";
+      };
+      "AZ-PRM-1" = {
+        hostname = "192.168.152.76";
+        user = "sascha.koenig";
+        port = 2022;
+        identityFile = "~/.ssh/sascha.koenig";
+      };
+      "github.com" = {
+        hostname = "github.com";
+        user = "m3tam3re";
+        port = 22;
+        identityFile = "~/.ssh/github";
+      };
+      "nikhil" = {
+        hostname = "91.99.176.80";
+        user = "nikhilmaddirala";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "code.m3ta.dev" = {
+        hostname = "code.m3ta.dev";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/gitea";
+      };
+      "git.az-gruppe.com" = {
+        hostname = "git.az-gruppe.com";
+        port = 2022;
+        user = "sascha.koenig";
+        identityFile = "~/.ssh/sascha.koenig";
+      };
+      "lkk-nix-1" = {
+        hostname = "89.58.10.189";
+        user = "lkk-admin";
+        identityFile = "~/.ssh/lkk-admin";
+      };
+      "m3-r1" = {
+        hostname = "202.61.226.110";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "lkk-prod-test" = {
+        hostname = "192.168.122.215";
+        user = "root";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "lkk-prod-1" = {
+        hostname = "192.168.0.24";
+        user = "root";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "lkk-prod-2" = {
+        hostname = "192.168.0.20";
+        user = "root";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-deck" = {
+        hostname = "192.168.178.193";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-kratos-vm" = {
+        hostname = "192.168.122.43";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-helios" = {
+        hostname = "192.168.178.210";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-ares" = {
+        hostname = "192.168.1.30";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-atlas" = {
+        hostname = "152.53.85.162";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-hermes" = {
+        hostname = "204.168.229.93";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-zelda" = {
+        hostname = "95.217.189.186";
+        user = "m3tam3re";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-skynet" = {
+        hostname = "m3-skynet";
+        user = "admin";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "m3-prox-1" = {
+        hostname = "192.168.1.110";
+        user = "root";
+        identityFile = "~/.ssh/m3tam3re";
+      };
+      "shp-old" = {
+        hostname = "95.217.3.250";
+        port = 2222;
+        user = "m3tam3re";
+        identityFile = "~/.ssh/self-host-playbook";
+      };
+      "shp-1" = {
+        hostname = "95.217.189.186";
+        port = 2222;
+        user = "m3tam3re";
+        identityFile = "~/.ssh/self-host-playbook";
+      };
+    };
+  };
+  # programs.zellij-ps = {
+  #   enable = true;
+  #   projectFolders = [
+  #     "${config.home.homeDirectory}/p/c"
+  #     "${config.home.homeDirectory}/p"
+  #     "${config.home.homeDirectory}/.config"
+  #   ];
+  #   layout = ''
+  #     layout {
+  #         pane size=1 borderless=true {
+  #             plugin location="zellij:tab-bar"
+  #         }
+  #         pane size="70%" command="nvim"
+  #         pane split_direction="vertical" {
+  #             pane
+  #             pane command="unimatrix"
+  #         }
+  #         pane size=1 borderless=true {
+  #             plugin location="zellij:status-bar"
+  #         }
+  #     }
+  #   '';
+  # };
+}

home/m3tam3re/m3-aether.nix

@@ -0,0 +1,25 @@
+# m3-aether — cloud VM.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
+  imports = [
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
+    ./home-server.nix
+  ];
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
+      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
+      fzf.enable = true;
+      nitch.enable = true;
+    };
+  };
+}

home/m3tam3re/m3-ares.nix

@@ -0,0 +1,142 @@
+# m3-ares — TUXEDO laptop desktop workstation.
+# Context: desktop | Profiles: coding, gaming, media
+{
+  config,
+  lib,
+  ...
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "gaming" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];
+
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            fish.enable = true;
+            nushell.enable = true;
+            starship.enable = true;
+          };
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
+          };
+          secrets.enable = true;
+        };
+
+        # Desktop features (new namespace)
+        desktop = {
+          wm = {
+            hyprland.enable = true;
+            rofi.enable = true;
+            wayland.enable = true;
+          };
+          apps = {
+            crypto.enable = true;
+            obsidian.enable = true;
+            office.enable = true;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = true;
+          };
+        };
+
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+          packages.enable = true;
+          languages = {
+            python.enable = true;
+            javascript.enable = true;
+            rustToolchain.enable = true;
+            go.enable = true;
+            typescript.enable = true;
+          };
+        };
+
+        # Gaming profile features
+        profiles.gaming = {
+          steam.enable = true;
+          gamescope.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = true;
+          ffmpeg.enable = true;
+          kdenlive.enable = true;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland monitor and workspace layout
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            exec-once = ["tuxedo-backlight"];
+            monitor = [
+              "eDP-1,preferred,0x0,1.25"
+              "HDMI-A-1,1920x1080@120,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:eDP-1, default:true"
+              "2, monitor:eDP-1"
+              "3, monitor:eDP-1"
+              "4, monitor:HDMI-A-1,"
+              "5, monitor:HDMI-A-1,border:false,rounding:false"
+              "6, monitor:HDMI-A-1"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, fullscreen on"
+              "match:class ^steam_app_\\d+$, workspace 5"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }

home/m3tam3re/m3-atlas.nix

@@ -0,0 +1,29 @@
+# m3-atlas — primary server, Traefik hub and container host.
+# Context: server | Profiles: coding
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
+  imports = [
+    (homeLib.mkHomeConfig {
+      profiles = ["coding"];
+      context = "server";
+    })
+    ./home-server.nix
+  ];
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
+      nushell.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
+      fzf.enable = true;
+      nitch.enable = true;
+      zellij.enable = true;
+    };
+  };
+
+  # Coding environment
+  coding.editors.neovim.enable = true;
+}

home/m3tam3re/m3-daedalus.nix

@@ -0,0 +1,127 @@
+# m3-daedalus — portable laptop (standalone home-manager).
+# Context: desktop | Profiles: coding, media
+{
+  config,
+  lib,
+  ...
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];
+
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            fish.enable = true;
+            nushell.enable = true;
+            starship.enable = true;
+          };
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
+          };
+          secrets.enable = true;
+        };
+
+        # Desktop features (new namespace)
+        desktop = {
+          wm = {
+            hyprland.enable = false;
+            rofi.enable = true;
+            wayland.enable = false;
+          };
+          apps = {
+            obsidian.enable = true;
+            office.enable = false;
+            crypto.enable = false;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = false;
+          };
+        };
+
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = false;
+          ffmpeg.enable = false;
+          kdenlive.enable = false;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland layout — only applies when hyprland is enabled
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            monitor = [
+              "eDP-1,preferred,0x0,1.25"
+              "HDMI-A-1,preferred,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:eDP-1, default:true"
+              "2, monitor:eDP-1"
+              "3, monitor:eDP-1"
+              "4, monitor:HDMI-A-1"
+              "5, monitor:HDMI-A-1,border:false,rounding:false"
+              "6, monitor:HDMI-A-1"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, fullscreen on"
+              "match:class ^steam_app_\\d+$, workspace 5"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }

home/m3tam3re/m3-helios.nix

@@ -0,0 +1,25 @@
+# m3-helios — AdGuard DNS and internal routing server.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
+  imports = [
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
+    ./home-server.nix
+  ];
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
+      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
+      fzf.enable = true;
+      nitch.enable = true;
+    };
+  };
+}

home/m3tam3re/m3-hermes.nix

@@ -0,0 +1,25 @@
+# m3-hermes — secondary server.
+# Context: server | Profiles: (none)
+{lib, ...}: let
+  homeLib = import ../lib {inherit lib;};
+in {
+  imports = [
+    (homeLib.mkHomeConfig {
+      profiles = [];
+      context = "server";
+    })
+    ./home-server.nix
+  ];
+
+  # Base CLI tools (new namespace)
+  base = {
+    shell = {
+      fish.enable = true;
+      starship.enable = true;
+    };
+    cliTools = {
+      fzf.enable = true;
+      nitch.enable = true;
+    };
+  };
+}

home/m3tam3re/m3-kratos.nix

@@ -0,0 +1,138 @@
+# m3-kratos — AMD desktop workstation.
+# Context: desktop | Profiles: coding, gaming, media
+{
+  config,
+  lib,
+  ...
+}: let
+  homeLib = import ../lib {inherit lib;};
+in
+  with lib; {
+    imports = [
+      (homeLib.mkHomeConfig {
+        profiles = ["coding" "gaming" "media"];
+        context = "desktop";
+      })
+      ./home.nix
+    ];
+
+    config = mkMerge [
+      {
+        # Base CLI tools (new namespace)
+        base = {
+          shell = {
+            nushell.enable = true;
+            starship.enable = true;
+          };
+          cliTools = {
+            fzf.enable = true;
+            nitch.enable = true;
+            television.enable = true;
+          };
+          secrets.enable = true;
+        };
+
+        # Desktop features (new namespace)
+        desktop = {
+          wm = {
+            hyprland.enable = true;
+            rofi.enable = true;
+            wayland.enable = true;
+          };
+          apps = {
+            crypto.enable = true;
+            obsidian.enable = true;
+            office.enable = true;
+          };
+          theme = {
+            fonts.enable = true;
+            wallpapers.enable = true;
+          };
+        };
+
+        # Coding environment
+        coding = {
+          editors = {
+            neovim.enable = true;
+            zed.enable = true;
+          };
+          lsp.enable = true;
+          languages = {
+            python.enable = true;
+            javascript.enable = true;
+            rustToolchain.enable = true;
+            go.enable = true;
+            typescript.enable = true;
+          };
+        };
+
+        # Gaming profile features
+        profiles.gaming = {
+          steam.enable = true;
+          gamescope.enable = true;
+        };
+
+        # Media profile features
+        profiles.media = {
+          obs.enable = true;
+          ffmpeg.enable = true;
+          kdenlive.enable = true;
+          ytDlp.enable = true;
+        };
+
+        xdg = {
+          enable = true;
+          configFile."mimeapps.list".force = true;
+          mimeApps = {
+            enable = true;
+            associations.added = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+            defaultApplications = {
+              "application/zip" = ["org.gnome.FileRoller.desktop"];
+              "application/csv" = ["calc.desktop"];
+              "application/pdf" = ["vivaldi-stable.desktop"];
+              "application/md" = ["dev.zed.Zed.desktop"];
+              "application/text" = ["dev.zed.Zed.desktop"];
+              "x-scheme-handler/http" = ["vivaldi-stable.desktop"];
+              "x-scheme-handler/https" = ["vivaldi-stable.desktop"];
+            };
+          };
+        };
+      }
+
+      # Host-specific Hyprland monitor and workspace layout (dual 1440p monitors)
+      (mkIf config.desktop.wm.hyprland.enable {
+        wayland.windowManager.hyprland = {
+          enable = true;
+          settings = {
+            monitor = [
+              "DP-1,2560x1440@144,0x0,1"
+              "DP-2,2560x1440@144,2560x0,1"
+            ];
+            workspace = [
+              "1, monitor:DP-1, default:true"
+              "2, monitor:DP-1"
+              "3, monitor:DP-1"
+              "4, monitor:DP-2"
+              "5, monitor:DP-2"
+              "6, monitor:DP-2"
+              "7, monitor:DP-2"
+            ];
+            windowrule = [
+              "match:class dev.zed.Zed, workspace 1"
+              "match:class Msty, workspace 1"
+              "match:class ^(com.obsproject.Studio)$, workspace 2"
+              "match:class ^(brave-browser)$, workspace 4, opacity 1.0"
+              "match:class ^(vivaldi-stable)$, workspace 4, opacity 1.0"
+              "match:class ^steam_app_\\d+$, idle_inhibit focus"
+            ];
+          };
+        };
+      })
+    ];
+  }

home/profiles/gaming/default.nix

@@ -0,0 +1,8 @@
+# Gaming profile aggregator — Steam platform, Gamescope session, and AMD GPU tools.
+{...}: {
+  imports = [
+    ./steam.nix
+    ./gamescope.nix
+    ./gpu.nix
+  ];
+}

home/profiles/gaming/gamescope.nix

@@ -0,0 +1,16 @@
+# Gamescope — Valve's micro-compositor for Steam gaming sessions.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.gamescope;
+in {
+  options.profiles.gaming.gamescope.enable = mkEnableOption "enable Gamescope session";
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.gamescope];
+  };
+}

home/profiles/gaming/gpu.nix

@@ -0,0 +1,21 @@
+# AMD GPU tools — ROCm runtime, monitoring, and Vulkan utilities for gaming.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.gpu;
+in {
+  options.profiles.gaming.gpu.enable = mkEnableOption "enable AMD GPU tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      rocmPackages.rocm-runtime
+      rocmPackages.rocm-smi
+      rocmPackages.rocminfo
+      vulkan-tools
+    ];
+  };
+}

home/profiles/gaming/steam.nix

@@ -0,0 +1,21 @@
+# Steam gaming platform with Steam Deck compatibility tools and gaming utilities.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.gaming.steam;
+in {
+  options.profiles.gaming.steam.enable = mkEnableOption "enable Steam gaming";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      gamemode
+      goverlay
+      mangohud
+      protonplus
+    ];
+  };
+}

home/profiles/media/default.nix

@@ -0,0 +1,10 @@
+# Media profile aggregator — OBS, FFmpeg, yt-dlp, Kdenlive, and HandBrake.
+{...}: {
+  imports = [
+    ./obs.nix
+    ./ffmpeg.nix
+    ./yt-dlp.nix
+    ./kdenlive.nix
+    ./handbrake.nix
+  ];
+}

home/profiles/media/ffmpeg.nix

@@ -0,0 +1,24 @@
+# FFmpeg — full-featured multimedia processing toolchain.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.ffmpeg;
+in {
+  options.profiles.media.ffmpeg.enable = mkEnableOption "enable FFmpeg tools";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      amf
+      ffmpeg_6-full
+      gst_all_1.gstreamer
+      gst_all_1.gst-vaapi
+      pamixer
+      pavucontrol
+      qpwgraph
+    ];
+  };
+}

home/profiles/media/handbrake.nix

@@ -0,0 +1,21 @@
+# HandBrake — open-source video transcoder.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.handbrake;
+in {
+  options.profiles.media.handbrake.enable = mkEnableOption "enable HandBrake transcoder";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      handbrake
+      gimp
+      inkscape
+      libation
+    ];
+  };
+}

home/profiles/media/kdenlive.nix

@@ -0,0 +1,16 @@
+# Kdenlive — KDE non-linear video editor.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.kdenlive;
+in {
+  options.profiles.media.kdenlive.enable = mkEnableOption "enable Kdenlive video editor";
+
+  config = mkIf cfg.enable {
+    home.packages = [pkgs.kdePackages.kdenlive];
+  };
+}

home/profiles/media/obs.nix

@@ -0,0 +1,21 @@
+# OBS Studio — open broadcaster software for streaming and recording.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.obs;
+in {
+  options.profiles.media.obs.enable = mkEnableOption "enable OBS Studio";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      v4l-utils
+    ];
+
+    # OBS is managed via NixOS programs.obs-studio at the system level.
+    # Home-manager only installs supporting tools.
+  };
+}

home/profiles/media/yt-dlp.nix

@@ -0,0 +1,32 @@
+# yt-dlp and media playback — YouTube downloader with MPV integration.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.profiles.media.ytDlp;
+in {
+  options.profiles.media.ytDlp.enable = mkEnableOption "enable yt-dlp and media playback";
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      plexamp
+      unimatrix
+      webcord
+    ];
+
+    programs.mpv = {
+      enable = true;
+      bindings = {
+        WHEEL_UP = "seek 10";
+        WHEEL_DOWN = "seek -10";
+      };
+      config = {
+        profile = "gpu-hq";
+        ytdl-format = "bestvideo+bestaudio";
+      };
+    };
+  };
+}

home/server/default.nix

@@ -0,0 +1,6 @@
+# Server context home-manager configuration — minimal headless setup.
+# Loaded on server hosts: m3-atlas, m3-helios, m3-aether.
+{...}: {
+  # Server hosts use the base and coding modules directly.
+  # No desktop environment or GUI applications.
+}

hosts/common/default.nix

@@ -18,11 +18,9 @@
   environment.pathsToLink = ["/share/xdg-desktop-portal" "/share/applications"];
 
   home-manager = {
-    useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {
-      inputs = inputs // {agents = null;};
+      inherit inputs outputs system;
-      inherit outputs system;
       videoDrivers = config.services.xserver.videoDrivers or [];
     };
   };

hosts/common/ports.nix

@@ -39,11 +39,6 @@
       outline = 3019;
       authentik = 3023;
       tuwunel = 3024;
-      honcho = 3025;
-
-      # Agent infrastructure
-      hermes-api = 8642;
-      hermes-dashboard = 9119;
 
       # Home automation
       homarr = 7575;