@sebastienrousseau/dotfiles 0.2.468 → 0.2.481

package/docs/README.md

@@ -0,0 +1,269 @@
+# Dotfiles Documentation
+
+<div align="center">
+
+**A modern, cross-platform shell environment built for developers.**
+
+[Quick Start](#quick-start) · [Features](#features) · [Architecture](#architecture) · [Security](#security) · [Contributing](#contributing)
+
+</div>
+
+---
+
+## Overview
+
+Welcome to the dotfiles documentation. This guide will help you install, configure, and customize your development environment across macOS, Linux, and WSL.
+
+### What You'll Get
+
+| Feature | Description |
+|---------|-------------|
+| 🚀 **Fast Shell** | Zsh with lazy loading, <500ms startup |
+| 🔧 **Modern Tools** | Neovim, tmux, starship, fzf, ripgrep |
+| 🔐 **Security First** | Encrypted secrets, credential management |
+| 🎨 **Beautiful UI** | Nerd Fonts, themes, consistent styling |
+| 📦 **Cross-Platform** | macOS, Linux, WSL2 support |
+
+---
+
+## Table of Contents
+
+### Getting Started
+- [Installation Guide](INSTALL.md) — Set up your environment in minutes
+- [Walkthrough](WALKTHROUGH.md) — Interactive tour of key features
+- [Features Overview](FEATURES.md) — Complete feature list
+
+### Core Documentation
+- [Architecture](ARCHITECTURE.md) — System design and structure
+- [Operations Guide](OPERATIONS.md) — Daily usage and maintenance
+- [Troubleshooting](TROUBLESHOOTING.md) — Common issues and solutions
+
+### Configuration
+- [Aliases Reference](ALIASES.md) — Shell aliases and shortcuts
+- [Keybindings](KEYS.md) — Keyboard shortcuts catalog
+- [Tools Reference](TOOLS.md) — Installed tools and utilities
+- [Utilities](UTILS.md) — Helper scripts and functions
+
+### Customization
+- [Fonts Guide](FONTS.md) — Nerd Fonts installation
+- [Screenshots](SCREENSHOTS.md) — Visual gallery
+- [Neovim IDE Guide](NEOVIM_IDE_GUIDE.md) — Editor configuration
+
+### Security
+- [Security Overview](SECURITY.md) — Security model and practices
+- [Security Checklist](SECURITY_CHECKLIST.md) — Hardening guide
+- [Secrets Management](SECRETS.md) — Encrypted credentials
+
+### Development
+- [Testing Guide](TESTING.md) — Test framework and coverage
+- [Compliance](COMPLIANCE.md) — Standards and policies
+- [Architecture Decisions](adr/) — ADRs for key decisions
+
+### Platform-Specific
+- [WSL2 + Nix Guide](WSL2_NIX_TROUBLESHOOTING.md) — Windows Subsystem for Linux
+
+### Reference
+- [Roadmap](ROADMAP.md) — Future plans and priorities
+- [Legacy Roadmap](LEGACY_ROADMAP.md) — Historical context
+
+---
+
+## Quick Start
+
+### Prerequisites
+
+- macOS 12+, Ubuntu 22.04+, or Windows 11 with WSL2
+- Git 2.30+
+- curl or wget
+
+### Installation
+
+```bash
+# One-line install
+curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh | bash
+```
+
+Or clone and install manually:
+
+```bash
+git clone https://github.com/sebastienrousseau/dotfiles.git ~/.dotfiles
+cd ~/.dotfiles && ./install.sh
+```
+
+### First Steps
+
+After installation, run these commands to explore:
+
+```bash
+dot help          # Show all available commands
+dot doctor        # Check system health
+dot learn         # Interactive tour
+dot keys          # View keybindings
+```
+
+---
+
+## Features
+
+### Shell Environment
+
+The shell configuration provides a fast, feature-rich experience:
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Startup Time: <500ms  │  Plugin Manager: Zinit            │
+│  Prompt: Starship      │  Completions: Lazy-loaded         │
+│  History: Shared       │  Syntax: fast-syntax-highlighting │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Key Features:**
+- Intelligent command suggestions with autosuggestions
+- Fuzzy finding with fzf for files, history, and git
+- Git integration with delta for beautiful diffs
+- Directory jumping with zoxide
+
+### Development Tools
+
+Pre-configured toolchains for modern development:
+
+| Language | Tools |
+|----------|-------|
+| **Rust** | rustup, cargo, clippy, rustfmt |
+| **Go** | go, golangci-lint |
+| **Node.js** | nvm, npm, pnpm |
+| **Python** | pyenv, pipx, uv |
+
+### AI Integration
+
+Built-in support for AI coding assistants:
+
+- **aider** — AI pair programming
+- **Claude** — Anthropic's assistant
+- **GitHub Copilot** — Code suggestions
+- **git-ai-commit** — AI-powered commit messages
+
+---
+
+## Architecture
+
+The dotfiles follow a modular architecture:
+
+```
+~/.dotfiles/
+├── dot_config/           # XDG config files
+│   ├── nvim/             # Neovim configuration
+│   ├── zsh/              # Zsh configuration layers
+│   └── git/              # Git configuration
+├── dot_local/bin/        # User scripts and tools
+├── install/              # Installation scripts
+│   └── provision/        # Tool provisioning
+├── scripts/              # Operational scripts
+│   ├── dot/commands/     # CLI command modules
+│   ├── diagnostics/      # Health checks
+│   ├── security/         # Security tools
+│   └── tuning/           # Performance tuning
+└── docs/                 # Documentation (you are here)
+```
+
+### Shell Layer System
+
+Zsh configuration uses numbered layers for predictable loading:
+
+| Range | Purpose | Examples |
+|-------|---------|----------|
+| 00-19 | Core | Environment, history, options |
+| 20-49 | Middleware | Zinit, completions, plugins |
+| 50-89 | Toolchain | Languages, package managers |
+| 90-99 | UX | Prompt, aliases, keybindings |
+
+### CLI Architecture
+
+The `dot` CLI uses modular command dispatch:
+
+```bash
+dot <command> [args]
+     │
+     ├── core.sh        # apply, sync, update, diff
+     ├── diagnostics.sh # doctor, heal, benchmark
+     ├── tools.sh       # tools, new, packages
+     ├── appearance.sh  # theme, fonts, wallpaper
+     ├── secrets.sh     # secrets-init, secrets
+     ├── security.sh    # firewall, backup, encrypt
+     └── meta.sh        # upgrade, docs, learn
+```
+
+---
+
+## Security
+
+Security is a core principle, not an afterthought.
+
+### Secrets Management
+
+```bash
+dot secrets-init    # Initialize age encryption
+dot secrets         # Edit encrypted secrets
+dot ssh-key         # Encrypt SSH keys
+```
+
+Secrets are encrypted with [age](https://age-encryption.org/) and never stored in plaintext.
+
+### Credential Management
+
+Supported credential stores:
+- **macOS** — Keychain integration
+- **Linux** — libsecret / GNOME Keyring
+- **Git** — git-credential-manager
+
+### Security Hardening (Opt-in)
+
+```bash
+dot firewall      # Configure firewall rules
+dot telemetry     # Disable OS telemetry
+dot dns-doh       # Enable DNS-over-HTTPS
+dot encrypt-check # Verify disk encryption
+```
+
+All security modifications require explicit consent.
+
+---
+
+## Contributing
+
+We welcome contributions! Please see our guidelines:
+
+1. **Fork** the repository
+2. **Create** a feature branch
+3. **Test** your changes with `dot doctor`
+4. **Submit** a pull request
+
+### Code Style
+
+- Shell scripts: Follow ShellCheck recommendations
+- Templates: Use `.chezmoitemplates/` for reusable logic
+- Documentation: Use UPPERCASE.md naming convention
+
+### Testing
+
+```bash
+./scripts/tests/framework/test_runner.sh        # Unit tests
+RUN_INTEGRATION=1 ./scripts/tests/framework/test_runner.sh  # Integration
+```
+
+---
+
+## Support
+
+- **Issues**: [GitHub Issues](https://github.com/sebastienrousseau/dotfiles/issues)
+- **Discussions**: [GitHub Discussions](https://github.com/sebastienrousseau/dotfiles/discussions)
+
+---
+
+<div align="center">
+
+**[Back to Top](#dotfiles-documentation)**
+
+Made with ❤️ by [Sebastien Rousseau](https://github.com/sebastienrousseau)
+
+</div>

package/docs/REPO_AUDIT.md

@@ -0,0 +1,23 @@
+# Repo Audit
+
+## Source of truth
+- `~/.dotfiles` (chezmoi source directory)
+
+## Key directories
+- `.chezmoitemplates/` - templated aliases, functions, paths
+- `dot_config/` - configs mapped into `~/.config`
+- `dot_local/` - binaries and local data (e.g., `dot` CLI)
+- `scripts/` - diagnostics, tests, tooling
+- `tests/` - sandbox Dockerfile
+- `nix/` - optional Nix toolchain
+
+## Notable dependencies
+- `chezmoi`
+- `zsh`, `starship`
+- `neovim`
+- `ripgrep`, `fd`, `bat`, `fzf`, `zoxide`
+- `lazygit`
+
+## Notes
+- Repo-only files excluded via `.chezmoiignore`.
+- Secrets are handled via `age` + `dot secrets` (see `docs/SECRETS.md`).

package/docs/ROADMAP.md

@@ -0,0 +1,148 @@
+# Roadmap
+
+This roadmap steers the project from a "feature-rich dotfiles repo" to an **Enterprise-Grade Shell Distribution**. The structure is organized by strategic pillars (**Trust**, **Predictability**, **Observability**) rather than linear phases, though the original 100-Phase vision is preserved within these categories.
+
+---
+
+## Reproducibility
+**Goal:** "Reproducible Shell Environments".
+> *This distribution aims for deterministic rebuilds: the same tag yields the same environment across machines.*
+
+- [ ] **Pinned Formulae**: Strict version locking for Homebrew bundle and Apt packages.
+- [ ] **Binary Locking**: Future versions may replace bootstrap download helpers with checksum-verified artifacts once a portable verification strategy is finalized.
+- [ ] **State Capture**: `chezmoi` templates that capture host-specific state for idempotence.
+- [ ] **Manifests**: Optional `Brewfile.lock` or equivalent for Linux.
+- [ ] **Cloud-Init (Phase 28)**: Generate `user-data` scripts for AWS/GCP bootstrapping.
+- [ ] **Container Native (Phase 28)**: Base Docker image for devcontainers.
+- [ ] **Terraform Provider (Phase 28)**: Custom provider to provision dotfiles state.
+
+## Observability
+**Goal:** "Observable Shell Lifecycle".
+> *The shell is instrumented: failures, timing, and lifecycle events are visible by design.*
+
+- [ ] **Audit Structuring**: JSON-structured logging for bootstrap and provisioning events.
+- [ ] **Debug Modes**: First-class support for `DOTFILES_DEBUG=1` and `DOTFILES_TRACE=1`.
+- [ ] **Telemetry (Local)**: Granular startup timing breakdown (init vs plugins vs prompt).
+- [ ] **Health Dashboard (Phase 39)**: CLI view of system "health" metrics.
+- [ ] **System Status (Phase 39)**: Real-time resource usage, battery, and network stats.
+- [ ] **Update Manager (Phase 39)**: Visual interface for tool updates and migration.
+
+## Secrets
+**Goal:** "Explicit Secrets Model".
+> *Secrets are never committed; sensitive state is encrypted or host-local by default.*
+
+- [ ] **Secret Driver**: Native integration with 1Password/Bitwarden CLI via `chezmoi`.
+- [ ] **Encryption**: Promoted use of `age` encryption for all private config files.
+- [ ] **Leak Prevention (Phase 29)**: Pre-commit hooks (TruffleHog/Gitleaks) for high-entropy detection.
+- [ ] **Vault Integration (Phase 29)**: Native HashiCorp Vault support.
+- [ ] **Hardware Enclaves (Phase 29)**: Support for Secure Enclave/TPM key storage.
+- [ ] **OIDC Auth (Phase 29)**: Keyless authentication via GitHub OIDC.
+
+## Toolchain
+**Goal:** "Composable Shell Layers".
+> *The distribution is layered: core safety is mandatory, advanced features are opt-in.*
+
+- [ ] **Core Layer**: XDG, PATH, Safety (`set -euo pipefail`). (Zero external deps).
+- [ ] **UX Layer**: Prompt (Starship), Aliases, Completions.
+- [ ] **Toolchain Layer**: Rust replacements (`eza`, `bat`, `ripgrep`).
+- [ ] **Cross-Compiler Toolchain (Phase 34)**:
+    - [ ] **Multi-Arch**: `qemu-user-static` for ARM64/AMD64.
+    - [ ] **Wasm Target**: WebAssembly toolchain setup.
+    - [ ] **Embedded Dev**: Presets for Arduino/ESP32.
+
+## Opt-in features
+**Goal:** "Explicit Feature Flags".
+> *Advanced features are gated behind explicit opt-in flags.*
+
+- [ ] **Feature Toggles**: Environment variables (e.g., `ENABLE_AI=0`, `ENABLE_HISTORY_SYNC=0`).
+- [ ] **Lazy Loading**: Strict lazy-loading for all non-core plugins.
+- [ ] **Plugin Ecosystem (Phase 35)**:
+    - [ ] **Module Registry**: Public index of dotfiles modules.
+    - [ ] **Dependency Solving**: Semantic versioning for modules.
+    - [ ] **Verified Publishers**: Cryptographic signing for "Official" modules.
+
+## Safety
+**Goal:** "Documented Threat Model".
+> *Security decisions are driven by an explicit, documented threat model.*
+
+- [ ] **Threat Model Doc**: A lightweight document defining the trust boundary (Local Machine).
+- [ ] **Supply Chain**: Verification steps for upstream dependencies.
+- [ ] **Identity & Access (Phase 40)**:
+    - [ ] **SSH Certs**: Short-lived SSH Certificates.
+    - [ ] **YubiKey Bio**: Biometric enforcement for `sudo`.
+    - [ ] **PAM Modules**: Custom auth modules.
+    - [ ] **Auditd Rules**: Pre-configured audit rules.
+
+## Validation
+**Goal:** "Self-Validating Environment".
+> *The environment can validate itself after installation or update.*
+
+- [ ] **Smoke Tests**: Automated verification of key aliases (`ls`, `git`, `docker`).
+- [ ] **CI Validation**: GitHub Actions workflow to boot and verify the shell syntax.
+- [ ] **Chaos Engineering (Phase 41)**:
+    - [ ] **Config Chaos**: Randomly corrupt config files to test recovery.
+    - [ ] **Network Simulation**: Simulate high latency/packet loss.
+    - [ ] **Permission Fuzzing**: Verify strict umask behavior.
+
+## Distribution
+**Goal:** "Supported Platforms Matrix".
+> *Only listed platforms are guaranteed to work; others are best-effort.*
+
+- [ ] **Support Matrix**: Explicit table of OS/Version support (macOS 14+, Ubuntu 24.04+, WSL2).
+- [ ] **Windows Deep Integration (Phase 53)**:
+    - [ ] **PowerShell Profile**: Mirror Zsh functionality.
+    - [ ] **WinGet**: Declarative package management.
+    - [ ] **WSL Bridge**: Seamless interop.
+- [ ] **Linux Deep Integration (Phase 55)**:
+    - [ ] **Systemd User Units**: User service management.
+    - [ ] **Desktop Envs**: GNOME/KDE/Sway configs.
+
+---
+
+## Future
+
+### Domain-Specific Environments
+- [ ] **Data Science (Phase 38)**: Conda/Mamba, GPU Config, Jupyter.
+- [ ] **Network Topologies (Phase 56)**: Mesh Networks, Tor, Private VPNs.
+- [ ] **Build Systems (Phase 57)**: Bazel, Maven/Gradle, CMake.
+- [ ] **Financial Operations (Phase 63)**: Cost CLI, Ledger, Stock Tickers.
+- [ ] **Game Development (Phase 64)**: Unity/Unreal CLI, Godot, Blender.
+- [ ] **Scientific Computing (Phase 68)**: Latex, R/Julia, Pandoc.
+- [ ] **Quantum Computing (Phase 69)**: Qiskit, Simulators.
+- [ ] **Bio-Informatics (Phase 70)**: Genomics, PDB, FASTA.
+
+### Enterprise & Operations
+- [ ] **Collaborations (Phase 45)**: Pair Programming, Team Sync, ChatOps.
+- [ ] **Database DevOps (Phase 46)**: DB Clients, Local Docker DBs, Migrations.
+- [ ] **Serverless (Phase 47)**: Lambda, Edge Workers, Wasm.
+- [ ] **Enterprise Fleet (Phase 30)**: MDM Profiles, Policy as Code.
+- [ ] **Legal & Procurement (Phase 93)**: RFP Templates, Vendor Management.
+- [ ] **Recruiting & HR (Phase 94)**: Resume Generators, coding interview sets.
+
+### Accessibility & Legacy
+- [ ] **Accessibility (Phase 36)**: Screen Reader optimization, High Contrast.
+- [ ] **Legacy Modernization (Phase 42)**: Mainframe/Unix support, PowerShell Core.
+
+---
+
+## Completed
+
+### Core Foundations
+- [x] **Universal Config (Chezmoi) (Phase 1)**
+- [x] **Shell Environment (Phase 2)**
+- [x] **Tool Modernization (Phase 3)**
+- [x] **Performance Optimization (Phase 4)**
+
+### Hardened Security
+- [x] **Security & Validation (Phase 5)**
+- [x] **Package Management (Phase 6)**
+- [x] **Hardened Security (Phase 21)**
+- [x] **Enterprise Core (Phase 23)**: SLSA, SBOM, Signed Releases.
+- [x] **Legal & Licensing (Phase 92)**: FOSSology, Headers, CLA.
+
+### Experience
+- [x] **Documentation (Phase 25)**: DocSite, Interactive Tour.
+- [x] **Self-Healing (Phase 27)**: Doctor, Auto-Repair.
+- [x] **OS Bundling (Phase 26)**: XDG Compliance, Vendor Hooks.
+- [x] **Predictive Shell (Phase 32)**: Autosuggest, Local LLM.
+- [x] **Visual Layer (Phase 34)**: Yazi, Zellij, Ghostty.

package/docs/SCREENSHOTS.md

@@ -0,0 +1,116 @@
+# Screenshots gallery
+
+See how the dotfiles look across different themes and configurations.
+
+## Theme gallery
+
+### Catppuccin Mocha (default)
+
+The default theme, Catppuccin Mocha, gives you a dark palette with warm, muted colors.
+
+```
+Terminal: Ghostty / WezTerm / Alacritty
+Font: JetBrains Mono Nerd Font
+Theme: Catppuccin Mocha
+```
+
+Key colors:
+- Background: `#1e1e2e`
+- Foreground: `#cdd6f4`
+- Accent Blue: `#89b4fa`
+- Accent Red: `#f38ba8`
+
+### Catppuccin Latte (light)
+
+A light theme option for daytime use.
+
+```
+Terminal: Ghostty / WezTerm / Alacritty
+Font: JetBrains Mono Nerd Font
+Theme: Catppuccin Latte
+```
+
+Key colors:
+- Background: `#eff1f5`
+- Foreground: `#4c4f69`
+- Accent Blue: `#1e66f5`
+- Accent Red: `#d20f39`
+
+## Terminal configurations
+
+### Ghostty
+
+Modern, native terminal with GPU acceleration.
+
+Features:
+- Native macOS integration
+- Fast rendering
+- Ligature support
+- Custom key bindings
+
+### WezTerm
+
+Cross-platform terminal with Lua configuration.
+
+Features:
+- GPU acceleration
+- Multiple windows/tabs
+- Hyperlinks
+- Image protocol support
+
+### Alacritty
+
+Minimal, fast terminal.
+
+Features:
+- Fast rendering
+- Simple YAML config
+- Vi mode
+- Cross-platform
+
+### Kitty
+
+Feature-rich terminal.
+
+Features:
+- GPU rendering
+- Ligatures
+- Image support
+- Keyboard protocol
+
+## Prompt (Starship)
+
+Your Starship prompt displays:
+- Current directory
+- Git branch and status
+- Language versions (when relevant)
+- Command duration
+- Exit status
+
+## Neovim
+
+Your Neovim configuration includes:
+- Catppuccin theme
+- Treesitter syntax highlighting
+- LSP integration
+- Telescope fuzzy finder
+- File tree (nvim-tree)
+
+## tmux
+
+Your tmux status bar displays:
+- Session name
+- Current window
+- Host name
+- Date and time
+
+## Adding screenshots
+
+To contribute screenshots:
+
+1. Take a screenshot of your terminal
+2. Save as PNG in `docs/themes/`
+3. Add reference in this file
+4. Submit a PR
+
+Recommended screenshot size: 1920x1080 or 2560x1440

package/docs/SECRETS.md

@@ -0,0 +1,76 @@
+# Secrets
+
+You can encrypt secrets using `age` with `chezmoi`.
+
+## Get started
+
+```bash
+dot secrets-init
+```
+
+The command creates `~/.config/chezmoi/key.txt` and prints your public key. It also updates `~/.config/chezmoi/chezmoi.toml` with the `age` backend settings.
+
+> [!IMPORTANT]
+> Verify that `age` is installed before running this command. You can install it through `brew`, `apt`, or your preferred toolchain.
+
+## Enable encryption
+
+Edit `~/.config/chezmoi/chezmoi.toml` (local only):
+
+```toml
+encryption = "age"
+
+[age]
+identity = "~/.config/chezmoi/key.txt"
+recipient = "age1..."
+```
+
+You can also re-run:
+
+```bash
+chezmoi init --apply --promptDefaults
+```
+
+## Edit secrets
+
+```bash
+dot secrets
+```
+
+The command opens `~/.config/chezmoi/encrypted_secrets.age` for editing and applies changes when you save.
+
+## Create secrets
+
+```bash
+dot secrets-create
+```
+
+Then edit:
+
+```bash
+dot secrets
+```
+
+## Encrypt an SSH key
+
+```bash
+dot ssh-key ~/.ssh/id_ed25519
+```
+
+The command creates a local encrypted file at:
+`~/.config/chezmoi/encrypted_id_ed25519.age`
+
+If you want it tracked (encrypted) in your dotfiles, run:
+
+```bash
+chezmoi add --encrypt ~/.config/chezmoi/encrypted_id_ed25519.age
+```
+
+## Important notes
+
+> [!WARNING]
+> Keep `~/.config/chezmoi/key.txt` private. Never commit this file to a public repository.
+
+- You can share the public key freely for encrypting data.
+- Consider rotating keys yearly (or after any potential leak).
+  To rotate: generate a new key, update `chezmoi.toml`, re-encrypt your secrets, and delete the old key.

package/docs/SECURITY.md

@@ -0,0 +1,30 @@
+# Security
+
+Learn how Dotfiles handles security and system modifications.
+
+## Principles
+
+- **Opt-In Only**: No hardening is applied unless the `DOTFILES_` variables are set to `1`.
+- **Local Logging**: Actions are logged to `~/.local/share/dotfiles.log`. No telemetry.
+- **No Hidden Sudo**: Sudo is only requested for system managers (apt, etc) and never cached indefinitely.
+
+## Hardening
+
+| Feature | Env Var | Action (macOS) | Action (Linux) |
+|---|---|---|---|
+| Firewall | `DOTFILES_FIREWALL` | Enables `socketfilterfw` + Stealth Mode | Configures UFW |
+| Telemetry | `DOTFILES_TELEMETRY` | Disables Diagnostic plists | Disables `whoopsie`/`apport` |
+| DNS-over-HTTPS | `DOTFILES_DOH` | Browser-level settings | Configures `resolvectl` |
+| Idle Security | `DOTFILES_LOCK` | Sets screensaver idle time | Sets GNOME/KDE idle-delay |
+
+## Secrets
+
+Dotfiles uses **age** for encryption.
+
+- **Initialization**: `dot secrets-init` creates a key at `~/.config/chezmoi/key.txt`.
+- **Storage**: Secrets are stored as `.age` encrypted files.
+- **Protection**: Private keys are never committed to the repo.
+
+## Report an issue
+
+If you discover a security vulnerability, please do not open a public issue. Follow the instructions in the Security Policy.

package/docs/SECURITY_CHECKLIST.md

@@ -0,0 +1,25 @@
+# Security Release Checklist
+
+Use this checklist before cutting any new release (e.g., `v0.x.x`) to ensure supply-chain integrity.
+
+## 1. Supply Chain & Installer
+- [ ] **Pinned Version**: Update `install.sh` `VERSION` variable to match the release tag.
+- [ ] **Docs Sync**: Ensure `README.md` and `.github/PULL_REQUEST_TEMPLATE.md` installer URLs point to the new tag (not `main`).
+- [ ] **Clean Build**: Verify `install.sh` does not curl random scripts from third parties without pinning.
+
+## 2. Secrets & Leak Prevention
+- [ ] **SSH Keys**: Scan `dot_ssh/` to ensure no private keys (`id_rsa`, `id_ed25519`) are committed.
+- [ ] **Env Vars**: Check for hardcoded API tokens in `dot_config/` (use `age` encryption or environment variables instead).
+- [ ] **Git History**: Run `git secrets` or similar to scan for accidental commits of credentials.
+
+## 3. Platform Safety
+- [ ] **WSL Check**: Verify `install.sh` detects WSL and does not try to install systemd services or macOS defaults.
+- [ ] **Root usage**: Ensure no script requires `sudo` unnecessarily (Principle of Least Privilege).
+
+## 4. Toolchain
+- [ ] **Binary Integrity**: Check that `dot_local/bin/` scripts are pure shell/executable and match expected checksums (no binary blobs).
+- [ ] **Dependency Scan**: Run `npm audit` / `cargo audit` if applicable (currently Node.js legacy is removed).
+
+## 5. Final Verification
+- [ ] **Docker Test**: Run `docker build -f Dockerfile.test .` to verify clean install.
+- [ ] **Doctor**: Run `dot doctor` locally.