@sebastienrousseau/dotfiles 0.2.481 → 0.2.499

package/docs/PR_DESCRIPTION.md

@@ -1,149 +1,150 @@
-# Release notes — v0.2.480
+# PR Title
+feat(core): Rel v0.2.471 - Universal Config, Security & Performance
 
-## Release overview
+# PR Description
 
-This release transforms the dotfiles into a high-performance, cross-platform system managed by **chezmoi**.
+## 🚀 v0.2.471 Release: Universal Configuration
 
-### Architecture
-v0.2.480 is a portable **shell distribution** managed by `chezmoi` (source of truth in `~/.dotfiles`).
+This release transforms the dotfiles into a high-performance, universally compatible system managed by **chezmoi**.
 
-- **XDG-first**: Configs strictly mapped to `~/.config/` (no `~/.foo` sprawl).
-- **Single entrypoint**: `dot_zshenv` acts as an XDG bootloader for instant environment setup.
-- **Modern toolchain**: Replaces classic Unix tools with high-performance Rust alternatives:
+### 🏗️ Technical Architecture
+v0.2.471 is not just "dotfiles" but a portable **Shell Distribution** managed by `chezmoi` ("source of truth" in `~/.local/share/chezmoi`).
+
+- **XDG-First**: Configs strictly mapped to `~/.config/` (No `~/.foo` sprawl).
+- **Single Entrypoint**: `dot_zshenv` acts as an XDG bootloader for instant environment setup.
+- **Modern Toolchain**: Replaces classic Unix tools with high-performance Rust alternatives:
   - `ls` → `eza`
   - `cat` → `bat`
   - `grep` → `ripgrep`
-  - `cd` → `zoxide` (smart directory jumping)
-  - `history` → `atuin` (syncable, encrypted SQLite history)
-- **Predictive shell**:
-  - **AI strategy**: Context-aware autosuggestions coupled with optional local LLM integration (`ai_core`).
-  - **Error analysis**: Wrappers analyze command failures through `gh copilot` or local models.
-
-### Non-goals
-- **Not a framework**: This is a curated distribution, not a plugin manager like Oh-My-Zsh.
-- **Not POSIX-pure**: Prioritizes modern Zsh/Rust features over strict POSIX compliance.
-- **Not minimal**: Optimizes for functionality and speed, not line-count minimalism.
-
-### Security
-- **Hardened by default**: Scripts run with `set -euo pipefail` to fail fast on errors.
-- **Supply chain safety**:
-  - **Pinned install**: Installation commands pin to the specific release tag (`v0.2.480`) to prevent drift.
-  - **Zero-trust**: No implicit reliance on `main` branch code in production.
-- **Threat model**: This project assumes a **trusted local machine** and focuses on supply-chain (pinned versions) and configuration safety (immutable history).
-- **Audit logging**: Dotfiles logs all `chezmoi` mutations to `~/.local/share/dotfiles.log` for day-2 operations review.
-
-### Changes
+  - `cd` → `zoxide` (Smart Directory Jumping)
+  - `history` → `atuin` (Syncable, Encrypted SQlite history)
+- **Predictive Shell**:
+  - **AI Strategy**: Context-aware autosuggestions coupled with optional local LLM integration (`ai_core`).
+  - **Error Analysis**: Smart wrappers to analyze command failures via `gh copilot` or local models.
+
+### 🚫 Non-Goals
+- **Not a Framework**: This is a curated distribution, not a plugin manager like Oh-My-Zsh.
+- **Not POSIX-Pure**: Prioritizes modern Zsh/Rust features over strict POSIX compliance.
+- **Not Minimal**: Optimizes for functionality and speed, not line-count minimalism.
+
+### 🛡️ Security Posture
+- **Hardened by Default**: Scripts run with `set -euo pipefail` to fail fast on errors.
+- **Supply Chain Safety**:
+  - **Pinned Install**: Installation commands are pinned to the specific release tag (`v0.2.471`) to prevent drift.
+  - **Zero-Trust**: No implicit reliance on `main` branch code in production.
+- **Threat Model**: This project assumes a **trusted local machine** and focuses on supply-chain (pinned versions) and configuration safety (immutable history).
+- **Audit Logging**: All `chezmoi` mutations are logged to `~/.dotfiles_audit.log` for day-2 operations review.
+
+### 🛠️ Changes
 - **Migrated**:
   - Shell: `~/.zshrc` now sources generated templates from `~/.config/shell`.
-  - Neovim: `~/.config/nvim` fully managed through Lua/Lazy.nvim.
-  - Tmux: Modular config consolidated to `~/.dotfiles/dot_tmux.conf`.
+  - Shell: `~/.zshrc` now sources generated templates from `~/.config/shell`.
+  - Neovim: `~/.config/nvim` fully managed via Lua/Lazy.nvim.
+  - Tmux: Modular config consolidated to `~/.local/share/chezmoi/dot_tmux.conf`.
 - **Packaging**:
   - `Brewfile` (macOS) and `apt-get` (Linux) handled automatically.
 - **Structural**:
   - **Renamed**: `dot_config/dotfiles` → `dot_config/shell` for semantic clarity.
   - **Moved**: `bin/` → `dot_local/bin/` for automatic path integration.
-  - **Separated**: Install scripts split by OS (Darwin/Linux) for cleaner logic.
-- **Layered architecture**: Refactored shell config into explicit layers:
+  - **Segregated**: Install scripts split by OS (Darwin/Linux) for cleaner logic.
+- **Layered Architecture**: Refactored shell config into explicit layers:
   - `00-core`: Safety/Paths
   - `50-logic`: Functions/Toolchain
   - `90-ux`: Aliases/Theme
-- **Trust and reproducibility**:
-  - **Pinned formulae**: Generated `Brewfile.lock.json` for strictly reproducible macOS builds.
-  - **Binary pinning**: `install.sh` now enforces specific version tags for initial bootstrap.
-### Quality
-- **Conflict resolution**: Detected and resolved **46 namespace collisions** across all alias modules (Git, Go, Archives, etc.) to ensure zero overlap.
-- **Git safety**: Renamed colliding Go aliases (for example, `gr` -> `gor`) to protect core Git commands.
+- **Trust & Reproducibility**:
+  - **Pinned Formulae**: Generated `Brewfile.lock.json` for strictly reproducible macOS builds.
+  - **Binary Pinning**: `install.sh` now enforces specific version tags for initial bootstrap.
+### 🔒 Security & Quality
+- **Conflict Resolution**: Detected and resolved **46 namespace collisions** across all alias modules (Git, Go, Archives, etc.) to ensure zero overlap.
+- **Git Safety**: Renamed colliding Go aliases (e.g., `gr` -> `gor`) to protect core Git commands.
 - **Modernization**: Merged `list` into `modern` for a cohesive Rust-based toolchain experience (`eza`, `bat`).
 - **Standardization**: Removed duplicate logging functions in favor of a shared utility.
-- **Documentation**: All 30+ component READMEs now reflect current functionality.
+- **Documentation**: All 30+ component READMEs are now 100% accurate and verified.
 
-### Toolchain
+### 🛠️ Start-of-Art Toolchain
 - **Kubernetes**: Added `kubectl`, `helm`, `k9s` aliases.
 - **IaC**: Added `terraform`, `opentofu`, `ansible`.
 - **Languages**: Added ecosystem support for `go`, `yarn`, `uv` (modern Python).
-- **AI integration**: Added wrappers for `gh copilot`, `fabric`, and local LLMs.
-- **Smart help**: Added `dothelp` to search and index custom functions.
+- **AI Integration**: Added wrappers for `gh copilot`, `fabric`, and local LLMs.
+- **Smart Help**: Introduced `dothelp` to strictly search and index custom functions.
 
-### Testing
+### 🤖 CI/CD & Testing
 
-- **Automated testing**
-  - Docker CI (`ci-docker.yml`) runs on Ubuntu/Fedora/Arch.
-  - Integration tests validate alias syntax (`test-aliases.sh`).
+- **Automated Testing**
+  - Docker CI (`ci-docker.yml`) running on Ubuntu/Fedora/Arch.
+  - Integration tests for alias syntax (`test-aliases.sh`).
 
-- **Enterprise core and security (the trust layer)**
-  - **SLSA and SBOM**: `security-release.yml` generates SPDX SBOMs and SLSA Level 3 Provenance.
+- **Enterprise Core & Security (The Trust Layer)**
+  - **SLSA & SBOM**: `security-release.yml` generates SPDX SBOMs and SLSA Level 3 Provenance.
   - **Signing**: `enable-signing` wizard for GPG/SSH git signing.
-  - **Immutability**: `lock-configs` / `unlock-configs` protect critical dotfiles (`chflags`/`chattr`).
+  - **Immutability**: `lock-configs` / `unlock-configs` to protect critical dotfiles (`chflags`/`chattr`).
 
-- **Legal and licensing**
+- **Legal & Licensing**
   - **Compliance**: `scan-licenses` (FOSSology/Trivy), `check-cla` (GitHub checks).
   - **Attribution**: `add-headers` automation and `gen-notice` generation.
 
-- **Self-healing and diagnostics**
-  - **Health**: `dot doctor` diagnoses environment (dependencies, XDG, paths).
+- **Self-Healing & Diagnostics**
+  - **Health**: `dot doctor` script diagnoses environment (Dependencies, XDG, Paths).
   - **Repair**: `dot heal` / `dot drift` aliases for auto-repair and drift detection.
 
-- **Regulatory compliance**
+- **Regulatory Compliance**
   - **Documentation**: `COMPLIANCE.md` maps features to **SOC2 Type II** and **ISO 27001**.
   - **Privacy**: `privacy-mode` alias disables CLI telemetry for 7+ frameworks.
 
-- **macOS deep integration**
-  - **Hardening**: `defaults` script hardens screensaver, firewall, and Finder settings.
-  - **Optimization**: Configures Safari for development, removes Dock clutter.
+- **macOS Deep Integration**
+  - **Hardening**: `defaults` script secures screensaver, firewall, and finder settings.
+  - **Optimization**: Configures Safari for dev, removes Dock clutter.
 
-- **Font typography**
+- **Font Typography**
   - **Fonts**: Auto-installs `JetBrainsMono Nerd Font` and `Symbols Nerd Font`.
   - **Rendering**: Linux `fontconfig` XML for sub-pixel antialiasing.
 
-- **Phase 58: Editor unification** (implemented)
+- **Phase 58: Editor Unification (The Grand Vim)** (Implemented)
   - **Neovim IDE**: Full VS Code feature parity (Noice, Lualine, Gitsigns, Indent-Blankline).
-  - **Language support**: Optimized for Rust (Rustaceanvim) and Python (BasedPyright/Ruff).
+  - **Language Support**: Optimized for Rust (Rustaceanvim) and Python (BasedPyright/Ruff).
   - **Performance**: Lazy-loading architecture with `<30ms` startup.
-  - **CI/CD fixes**: Resolved CodeQL alerts (removed legacy Node.js) and fixed Docker builds.
+  - **CI/CD Fixes**: Resolved CodeQL alerts (removed legacy Node.js) and fixed Docker builds.
 
-- **OS bundling and compliance**
+- **OS Bundling & Compliance**
   - **Packaging**: `scripts/package.sh` generates versioned distribution tarballs.
   - **Enterprise**: `/etc/dotfiles/defaults.d` hooks for site-local config overrides.
   - **Standards**: Strict **XDG Base Directory** enforcement in `paths.sh`.
 
-- **The universal installer (zero-dep)**
-  - **Bootstrap**: `install.sh` runs through `curl | sh` with no dependencies.
-  - **Teleport**: `dot teleport user@host` deploys configs ephemerally through SSH.
+- **The Universal Installer (Zero-Dep)**
+  - **Bootstrap**: `install.sh` running via `curl | sh` with no dependencies.
+  - **Teleport**: `dot teleport user@host` to ephemerally deploy configs via SSH.
 
-### Verification
+### 🧪 Verification
 - **Performance**: Benchmark script `scripts/benchmark.sh` confirms <20ms startup.
-- **Integration**: `test-aliases.sh` validates syntax of all 32 alias modules.
-- **Security**: **Zero critical vulnerabilities** (CodeQL and Dependabot clean).
-- **Functionality**: Local migration tested on macOS, Linux, and WSL.
+- **Integration**: `test-aliases.sh` verified syntax of all 32 alias modules.
+- **Security**: **Zero Critical Vulnerabilities** (CodeQL & Dependabot clean).
+- **Functionality**: Local migration verified on macOS, Linux, and WSL.
 
 
-### Install and migrate
+### 📦 Installation & Migration
 
-#### Option A: Fresh install (new machines)
-To set up a new machine, run the universal installer:
+#### Option A: Fresh Install (New Machines)
+If you are setting up a new machine, simply run the universal installer:
 ```bash
-sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.480/install.sh)"
+sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.471/install.sh)"
 ```
 
-#### Option B: Migration (upgrade from earlier versions)
-
-> [!IMPORTANT]
-> This release changes the architecture from direct symlinks to `chezmoi` templates. Back up your configuration first.
-
-Existing `chezmoi` users can run `chezmoi apply` to upgrade, but the full installer works better for major version jumps.
+#### Option B: Migration (Upgrade from `master` / v1)
+⚠️ **Important**: This release changes the architecture from direct symlinks to `chezmoi` templates. Functional backups are recommended.
+**Compatibility Note**: Existing `chezmoi` users can simply run `chezmoi apply` to upgrade, but the full installer is recommended for major version jumps.
 
-1. **Back up legacy configs**:
+1. **Backup Legacy Configs**:
    ```bash
    mv ~/.zshrc ~/.zshrc.bak
    mv ~/.config/nvim ~/.config/nvim.bak
    ```
-2. **Run the installer**:
+2. **Run Installer**:
    ```bash
-   sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.480/install.sh)"
+   sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.471/install.sh)"
    ```
-3. **Resolve conflicts**:
-   - If `chezmoi` prompts you to overwrite files (for example, `.zshrc`), select **overwrite** (or diff to check) because this release uses a new sourcing strategy.
-4. **Restart shell**:
+3. **Resolve Conflicts**:
+   - If prompted by `chezmoi` to overwrite files (e.g., `.zshrc`), select **overwrite** (or diff to check) as this release uses a new sourcing strategy.
+4. **Restart Shell**:
    ```bash
    exec zsh
    ```

package/docs/ROADMAP.md

@@ -1,10 +1,10 @@
-# Roadmap
+# Product Roadmap: The Trusted Shell Platform
 
 This roadmap steers the project from a "feature-rich dotfiles repo" to an **Enterprise-Grade Shell Distribution**. The structure is organized by strategic pillars (**Trust**, **Predictability**, **Observability**) rather than linear phases, though the original 100-Phase vision is preserved within these categories.
 
 ---
 
-## Reproducibility
+## 🏗️ Pillar 1: Reproducibility & Determinism (Highest ROI)
 **Goal:** "Reproducible Shell Environments".
 > *This distribution aims for deterministic rebuilds: the same tag yields the same environment across machines.*
 
@@ -16,7 +16,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
 - [ ] **Container Native (Phase 28)**: Base Docker image for devcontainers.
 - [ ] **Terraform Provider (Phase 28)**: Custom provider to provision dotfiles state.
 
-## Observability
+## 👁️ Pillar 2: First-Class Observability
 **Goal:** "Observable Shell Lifecycle".
 > *The shell is instrumented: failures, timing, and lifecycle events are visible by design.*
 
@@ -27,7 +27,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
 - [ ] **System Status (Phase 39)**: Real-time resource usage, battery, and network stats.
 - [ ] **Update Manager (Phase 39)**: Visual interface for tool updates and migration.
 
-## Secrets
+## 🔐 Pillar 3: Secrets & Trust Boundaries
 **Goal:** "Explicit Secrets Model".
 > *Secrets are never committed; sensitive state is encrypted or host-local by default.*
 
@@ -38,7 +38,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
 - [ ] **Hardware Enclaves (Phase 29)**: Support for Secure Enclave/TPM key storage.
 - [ ] **OIDC Auth (Phase 29)**: Keyless authentication via GitHub OIDC.
 
-## Toolchain
+## 🧱 Pillar 4: Layered Architecture & Toolchain
 **Goal:** "Composable Shell Layers".
 > *The distribution is layered: core safety is mandatory, advanced features are opt-in.*
 
@@ -50,7 +50,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
     - [ ] **Wasm Target**: WebAssembly toolchain setup.
     - [ ] **Embedded Dev**: Presets for Arduino/ESP32.
 
-## Opt-in features
+## ⚙️ Pillar 5: Controlled Opt-In Features
 **Goal:** "Explicit Feature Flags".
 > *Advanced features are gated behind explicit opt-in flags.*
 
@@ -61,7 +61,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
     - [ ] **Dependency Solving**: Semantic versioning for modules.
     - [ ] **Verified Publishers**: Cryptographic signing for "Official" modules.
 
-## Safety
+## 🛡️ Pillar 6: Threat Model & Safety
 **Goal:** "Documented Threat Model".
 > *Security decisions are driven by an explicit, documented threat model.*
 
@@ -73,7 +73,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
     - [ ] **PAM Modules**: Custom auth modules.
     - [ ] **Auditd Rules**: Pre-configured audit rules.
 
-## Validation
+## 🧪 Pillar 7: Self-Test & Validation
 **Goal:** "Self-Validating Environment".
 > *The environment can validate itself after installation or update.*
 
@@ -84,7 +84,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
     - [ ] **Network Simulation**: Simulate high latency/packet loss.
     - [ ] **Permission Fuzzing**: Verify strict umask behavior.
 
-## Distribution
+## 📦 Pillar 8: Distribution Guarantees & Platform Support
 **Goal:** "Supported Platforms Matrix".
 > *Only listed platforms are guaranteed to work; others are best-effort.*
 
@@ -99,7 +99,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
 
 ---
 
-## Future
+## 🔮 Future Horizons (Legacy Roadmap)
 
 ### Domain-Specific Environments
 - [ ] **Data Science (Phase 38)**: Conda/Mamba, GPU Config, Jupyter.
@@ -125,7 +125,7 @@ This roadmap steers the project from a "feature-rich dotfiles repo" to an **Ente
 
 ---
 
-## Completed
+## 📜 Completed Milestones
 
 ### Core Foundations
 - [x] **Universal Config (Chezmoi) (Phase 1)**