@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/docs/security/THREAT_MODEL.md

@@ -0,0 +1,120 @@
+# Threat Model
+
+Security analysis of the dotfiles distribution. Covers trust boundaries, threat actors, attack surfaces, and mitigations.
+
+## Trust Boundary
+
+The primary trust boundary is the **local machine**. Dotfiles are deployed to and executed on the user's own system. All configuration files, scripts, and templates run with the user's privileges.
+
+```text
+┌─────────────────────────────────────────────────┐
+│ Local Machine (trusted zone)                    │
+│  ┌─────────────────┐  ┌──────────────────────┐  │
+│  │ ~/.dotfiles/     │  │ ~/.config/ (deployed)│  │
+│  │ (source repo)    │──│ Shell configs, nvim  │  │
+│  └─────────────────┘  └──────────────────────┘  │
+│                                                  │
+│  ┌─────────────────┐  ┌──────────────────────┐  │
+│  │ ~/.local/bin/    │  │ ~/.cache/shell/      │  │
+│  │ (user scripts)   │  │ (cached eval output) │  │
+│  └─────────────────┘  └──────────────────────┘  │
+└─────────────────────────────────────────────────┘
+         │
+    ─────┼──────── Trust boundary ────────
+         │
+┌─────────────────────────────────────────────────┐
+│ External (untrusted zone)                        │
+│  GitHub (repo hosting), Homebrew, Nix,           │
+│  Zinit plugins, Neovim plugins, npm, pip         │
+└─────────────────────────────────────────────────┘
+```
+
+## Threat Actors
+
+| Actor | Motivation | Capability |
+|-------|-----------|------------|
+| Supply chain attacker | Inject malicious code via dependency | Compromise upstream packages (Homebrew, npm, Zinit plugins) |
+| Secrets harvester | Steal API keys, SSH keys, tokens | Scrape git history, shell history, env vars |
+| Privilege escalation | Gain root access | Exploit `sudo` aliases, writable scripts in PATH |
+| Network attacker | Intercept credentials | MITM on install scripts, curl-pipe-bash |
+
+## Attack Surfaces
+
+### 1. Shell Startup Scripts
+
+**Risk:** Malicious code in sourced files executes with user privileges on every shell start.
+
+**Mitigations:**
+- All shell scripts pass `shellcheck --severity=error`
+- `set -euo pipefail` enforced in all operational scripts
+- `eval` usage hardened with process substitution (`. /dev/stdin`)
+- Input validation on dynamic function generation
+- `DOTFILES_ULTRA_FAST=1` bypasses all non-core sourcing
+
+### 2. Secrets Exposure
+
+**Risk:** API keys, tokens, and SSH keys leaked via git history, shell history, or environment.
+
+**Mitigations:**
+- [Gitleaks](https://github.com/gitleaks/gitleaks) pre-commit hook blocks secrets in commits
+- Atuin `history_filter` excludes sensitive patterns
+- Age encryption for local secret storage
+- `dot secrets set` uses secure prompts (no shell history)
+- `.gitignore` excludes `key.txt`, `.env`, credential files
+
+### 3. Supply Chain Dependencies
+
+**Risk:** Compromised upstream packages injected into the toolchain.
+
+**Mitigations:**
+- Nix Flakes provide reproducible, pinned dependencies
+- Zinit plugin versions pinned (`ver"0.8.0"`)
+- Neovim plugin versions locked via `lazy-lock.json`
+- `install.sh` uses HTTPS for all downloads
+- Homebrew formula integrity via bottle checksums
+
+### 4. Path Manipulation
+
+**Risk:** Attacker places malicious binary in a PATH directory that shadows legitimate tools.
+
+**Mitigations:**
+- PATH construction is deterministic (template-generated)
+- `~/.local/bin` is user-controlled and checked for writability
+- No world-writable directories in PATH
+- `prependpath` function validates directory existence
+
+### 5. Template Injection
+
+**Risk:** Chezmoi template variables could inject shell code if not properly quoted.
+
+**Mitigations:**
+- Template variables come from `.chezmoidata.toml` (user-controlled)
+- No external/network data used in templates
+- Template validation via `chezmoi apply --dry-run` in CI
+
+### 6. Cached Eval Files
+
+**Risk:** Stale or tampered cache files in `~/.cache/shell/` sourced at startup.
+
+**Mitigations:**
+- `_cached_eval` validates cache against binary mtime
+- Cache files are user-owned (0644)
+- Cache directory is under `$XDG_CACHE_HOME` (user-controlled)
+- Cache can be cleared with `rm -rf ~/.cache/shell/`
+
+## Residual Risks
+
+| Risk | Likelihood | Impact | Status |
+|------|-----------|--------|--------|
+| Zinit plugin compromise | Low | High | Mitigated by version pinning |
+| Shell history leak | Medium | Medium | Mitigated by Atuin filter |
+| Stale Nix closure | Low | Low | Accepted (manual `nix flake update`) |
+| macOS Keychain access | Low | Medium | Accepted (OS-level protection) |
+
+## Recommendations
+
+1. Run `gitleaks detect` before every push (pre-commit hook enforced)
+2. Rotate secrets on a 90-day schedule
+3. Audit `lazy-lock.json` diffs when updating Neovim plugins
+4. Pin Homebrew versions for security-critical tools
+5. Use `DOTFILES_ULTRA_FAST=1` in CI to minimize attack surface

package/docs/security/VERIFICATION_VALIDATION.md

@@ -0,0 +1,224 @@
+# Verification and Validation Report
+
+## Document Control
+
+| Field | Value |
+|-------|-------|
+| Document ID | VV-DOT-001 |
+| Version | 0.2.500 |
+| Date | 2026-03-20 |
+| Author | Repository Maintainer |
+| Status | Active |
+| Classification | Internal |
+| Standard | ISO 13485:2016 Sections 7.3.6 / 7.3.7 (adapted) |
+
+---
+
+## Purpose
+
+This document constitutes the formal Verification and Validation (V&V) report for the chezmoi-managed dotfiles repository, adapted from ISO 13485:2016 Sections 7.3.6 (Design and Development Verification) and 7.3.7 (Design and Development Validation) for infrastructure-as-code.
+
+**Verification** confirms that each design output meets its corresponding design input requirement through inspection, analysis, and testing. **Validation** confirms that the deployed system satisfies its intended use under representative operating conditions (Linux, macOS, WSL).
+
+All verification activities are executed through automated CI pipelines, pre-commit hooks, and the repository test framework. Evidence is retained in CI logs, test output, and this document.
+
+---
+
+## Verification Matrix
+
+| Req ID | Requirement | Verification Method | Test File(s) | Result |
+|--------|-------------|---------------------|--------------|--------|
+| VR-01 | Shell scripts pass ShellCheck (severity=error) | Static analysis via `shellcheck --severity=error -e SC1091 -e SC2030 -e SC2031` | `ci.yml`, `ci-enforced.yml`, pre-commit hook | Pass |
+| VR-02 | All scripts have `set -euo pipefail` | Pattern scan across all `.sh` files; CI enforcement | `ci-enforced.yml`, `compliance-guard.yml` | Pass |
+| VR-03 | No secrets in source control (gitleaks clean) | Gitleaks scan with `config/gitleaks.toml` ruleset | Pre-commit hook, `security-enhanced.yml` | Pass |
+| VR-04 | Cross-platform compatibility (BSD + GNU) | Dual-platform CI matrix (ubuntu-latest, macos-latest) | `cross-platform-test.yml` | Pass |
+| VR-05 | TLS enforcement (no insecure curl/wget) | Pattern blocking for `curl -k`, `--insecure`, `wget --no-check-certificate` | Pre-commit hook, `compliance-guard.yml` | Pass |
+| VR-06 | Permission controls (no chmod 777/666) | CI pattern scan blocks world-writable permissions | Pre-commit hook, `compliance-guard.yml` | Pass |
+| VR-07 | Signed commits enforced | Pre-push hook verifies `git verify-commit` for all commits in range | `scripts/git-hooks/pre-push`, `compliance-guard.yml` | Pass |
+| VR-08 | Conventional commit format | Pre-commit hook validates `feat:`, `fix:`, `docs:` prefixes | Pre-commit hook (conventional-commits) | Pass |
+| VR-09 | Template rendering correctness | `chezmoi apply --dry-run` on Linux and macOS CI runners | `ci.yml` (Linux + macOS matrix), `tests/unit/test_*.sh` | Pass |
+| VR-10 | Alias system functional | Unit tests source alias files and verify command availability | `tests/unit/aliases/test_*.sh` (104 files) | Pass |
+| VR-11 | Neovim config loads without errors | Headless Neovim launch with error detection | `tests/unit/neovim/test_*.sh` (15 files) | Pass |
+| VR-12 | Fish/Zsh/Nushell configs valid | Syntax validation and functional tests per shell | `tests/unit/fish/` (33), `tests/unit/shell/` (12), `tests/unit/nushell/` (5) | Pass |
+| VR-13 | CI pipelines execute successfully | GitHub Actions workflow status across all triggers | `ci.yml`, `ci-enforced.yml`, `compliance-guard.yml`, `cross-platform-test.yml`, `security-enhanced.yml`, `codeql.yml` | Pass |
+| VR-14 | Pre-commit hooks functional | Hook execution via `pre-commit run --all-files` | `config/pre-commit-config.yaml` | Pass |
+| VR-15 | Age encryption operational | Chezmoi age-encrypted file decryption during apply | `chezmoi apply --dry-run` (encrypted targets), integration tests | Pass |
+
+---
+
+## Validation Summary
+
+### Coverage Metrics
+
+| Metric | Value | Threshold | Status |
+|--------|-------|-----------|--------|
+| Total test files | 430 | N/A | Measured |
+| Total assertions | 2,217 | N/A | Measured |
+| Pass rate | 100% | 100% | Pass |
+| Module coverage | 100% | >= 95% | Pass |
+
+### Category Breakdown
+
+| Category | Test Files | Status |
+|----------|-----------|--------|
+| Alias files | 104 | Tested |
+| Function files | 76 | Tested |
+| Fish functions + conf.d | 33 | Tested |
+| Misc / compliance | 34 | Tested |
+| Dot CLI | 30 | Tested |
+| Diagnostics | 28 | Tested |
+| Shell configs | 20 | Tested |
+| Ops | 18 | Tested |
+| Install | 17 | Tested |
+| Security | 16 | Tested |
+| Neovim Lua configs | 15 | Tested |
+| Theme | 11 | Tested |
+| Tools | 7 | Tested |
+| Nushell configs | 6 | Tested |
+| Secrets | 5 | Tested |
+| Integration tests | 10 | Tested |
+| **Total** | **430** | **All pass** |
+
+### Validation Environments
+
+| Environment | OS | Shell | Bash Version | Status |
+|-------------|-----|-------|--------------|--------|
+| CI (Linux) | Ubuntu latest | Bash | 5.x | Validated |
+| CI (macOS) | macOS latest | Zsh | 3.2 (system) | Validated |
+| Local (Linux) | CachyOS / Arch | Fish, Zsh, Bash | 5.x | Validated |
+| Local (WSL) | Ubuntu | Bash | 5.x | Validated |
+
+---
+
+## Test Framework Architecture
+
+### Directory Structure
+
+```
+tests/
+├── framework/
+│   ├── test_runner.sh     # Test executor — discovers and runs all test_*.sh files
+│   ├── assertions.sh      # 16 assertion functions (assert_equals, assert_contains, etc.)
+│   └── mocks.sh           # Mock utilities for isolating external dependencies
+├── unit/
+│   ├── aliases/           # Alias and command-surface tests
+│   ├── functions/         # Function behavior tests
+│   ├── dot-cli/           # `dot` command workflow tests
+│   ├── shell/             # Shell integration and completion tests
+│   ├── fish/              # Fish function and completion tests
+│   ├── nushell/           # Nushell configuration tests
+│   ├── nvim/              # Neovim configuration tests
+│   └── test_*.sh          # 425 unit test files total
+├── integration/
+│   └── test_*.sh          # 11 integration test files
+└── performance/
+    └── benchmark_runner.sh # Performance regression benchmarks
+```
+
+### Execution Model
+
+1. `test_runner.sh` recursively discovers all `test_*.sh` files under `tests/`.
+2. Each test file is executed in a subshell with `assertions.sh` sourced.
+3. Tests source bash files directly from the repository (not Go templates).
+4. `mocks.sh` provides stubs for external tools (`chezmoi`, `git`, `brew`, etc.).
+5. Exit codes and assertion counts are aggregated into a final report.
+
+### Assertion Library
+
+| Function | Purpose |
+|----------|---------|
+| `assert_equals` | Exact string equality |
+| `assert_not_equals` | String inequality |
+| `assert_contains` | Substring match |
+| `assert_not_contains` | Substring absence |
+| `assert_starts_with` | Prefix match |
+| `assert_ends_with` | Suffix match |
+| `assert_matches` | Regex match |
+| `assert_file_exists` | File presence |
+| `assert_file_not_exists` | File absence |
+| `assert_directory_exists` | Directory presence |
+| `assert_command_exists` | Command availability |
+| `assert_exit_code` | Process exit code |
+| `assert_empty` | Empty string |
+| `assert_not_empty` | Non-empty string |
+| `assert_true` | Boolean truth |
+| `assert_false` | Boolean false |
+
+---
+
+## Traceability Matrix
+
+This matrix maps compliance controls from COMPLIANCE.md to verification requirements defined in this document.
+
+### SOC 2 Type II Traceability
+
+| SOC 2 Control | Description | Verification Requirement(s) |
+|---------------|-------------|----------------------------|
+| CC6.1 | Logical Access Security | VR-06 (Permission controls), VR-15 (Age encryption) |
+| CC6.8 | Unauthorized Code Protection | VR-07 (Signed commits), VR-03 (No secrets) |
+| CC7.1 | System Operations | VR-05 (TLS enforcement), VR-13 (CI pipelines) |
+| CC7.2 | Change Detection | VR-14 (Pre-commit hooks), VR-08 (Conventional commits) |
+| CC8.1 | Change Management | VR-07 (Signed commits), VR-08 (Conventional commits), VR-13 (CI pipelines) |
+| A1.2 | Audit Logs | VR-13 (CI pipelines — logs retained in GitHub Actions) |
+
+### ISO 27001 Traceability
+
+| ISO Control | Description | Verification Requirement(s) |
+|-------------|-------------|----------------------------|
+| A.9.1.1 | Access Control Policy | VR-06 (Permission controls), VR-15 (Age encryption) |
+| A.9.4.1 | Information Access Restriction | VR-06 (No chmod 777/666) |
+| A.12.1.2 | Change Management | VR-07 (Signed commits), VR-08 (Conventional commits) |
+| A.12.6.1 | Technical Vulnerability Management | VR-03 (Gitleaks), VR-05 (TLS enforcement) |
+| A.13.1.1 | Network Controls | VR-05 (TLS enforcement) |
+| A.14.2.5 | Secure Engineering | VR-01 (ShellCheck), VR-02 (set -euo pipefail), VR-04 (Cross-platform) |
+| A.14.2.8 | System Security Testing | VR-09 (Template rendering), VR-10 (Aliases), VR-11 (Neovim), VR-12 (Shell configs) |
+
+### GDPR / Privacy Traceability
+
+| Requirement | Description | Verification Requirement(s) |
+|-------------|-------------|----------------------------|
+| Data Minimization | Limit data collection | VR-03 (No secrets in source) |
+| Integrity | Protect against tampering | VR-07 (Signed commits), VR-14 (Pre-commit hooks) |
+| Encryption | Protect data at rest | VR-15 (Age encryption operational) |
+
+---
+
+## Acceptance Criteria
+
+All of the following criteria must be satisfied for this V&V report to remain valid.
+
+| Criterion | Verification Method | Required Outcome |
+|-----------|---------------------|------------------|
+| All unit and integration tests pass | `./tests/framework/test_runner.sh` | Exit code 0, 0 failures |
+| ShellCheck clean | `shellcheck --severity=error` on all `.sh` files | Zero findings |
+| Gitleaks clean | `gitleaks detect --config config/gitleaks.toml` | Zero findings |
+| Chezmoi dry-run clean | `chezmoi apply --dry-run` on Linux and macOS | Exit code 0, no errors |
+| Pre-commit hooks pass | `pre-commit run --all-files` | Exit code 0 |
+| Cross-platform CI green | `cross-platform-test.yml` on ubuntu-latest and macos-latest | All jobs pass |
+| Module coverage at threshold | Test runner coverage report | >= 95% (currently 100%) |
+| No world-writable permissions | `compliance-guard.yml` pattern scan | Zero `chmod 777` or `chmod 666` matches |
+| No insecure TLS patterns | `compliance-guard.yml` pattern scan | Zero `curl -k` or `wget --no-check-certificate` matches |
+| All commits signed | `git verify-commit` on HEAD~50..HEAD range | All commits verified |
+
+---
+
+## Sign-off
+
+| Role | Name | Date | Signature |
+|------|------|------|-----------|
+| Repository Owner | | | |
+| Security Reviewer | | | |
+| Quality Assurance | | | |
+| Release Manager | | | |
+
+---
+
+## References
+
+- [ISO 13485:2016](https://www.iso.org/standard/59752.html) — Medical devices, Quality management systems
+- [ISO 27001:2022](https://www.iso.org/standard/27001) — Information security management
+- [SOC 2 Type II](https://www.aicpa.org/soc2) — Trust Services Criteria
+- [SLSA Framework](https://slsa.dev/) — Supply chain Levels for Software Artifacts
+- [ShellCheck](https://www.shellcheck.net/) — Static analysis for shell scripts
+- [Gitleaks](https://gitleaks.io/) — Secrets detection
+- [Chezmoi](https://www.chezmoi.io/) — Dotfiles manager

package/docs/themes/README.md

@@ -0,0 +1,6 @@
+# Theme Gallery
+
+Themes are auto-generated from your wallpapers — the available set depends on what's present on your system. Run `dot theme list` to see what's discovered.
+
+See [Theme Reference](../reference/THEMES.md) for the wallpaper-driven engine.
+See [Theming Guide](../guides/THEMING.md) for setup, switching, and the K-Means CIELAB pipeline.

package/docs/themes/VISUAL_INTEGRITY_REPORT.md

@@ -0,0 +1,26 @@
+# Visual Integrity Report
+
+Generated: 2026-04-08
+Scope: terminal theme SSOT, shell first-paint path, font rendering, and cross-platform template intent.
+
+| Metric | Current | Target | Status |
+| :--- | :--- | :--- | :--- |
+| Contrast (APCA) | `macos-monterey-dark` body text `Lc 90+`, critical UI `Lc 95+` | `Lc 75+` body, `Lc 90+` critical | Pass |
+| Startup Time | `bash 25ms`, `zsh 35ms`, `fish 25ms` | `< 100ms` | Pass |
+| Color DeltaE | SSOT palette unified across Ghostty/Kitty/Alacritty/WezTerm; no runtime probe yet | `< 2.0` | Needs instrumentation |
+
+## Findings
+
+- Theme colors are already centralized in `.chezmoidata/themes.toml`, but accessibility intent was implicit. The active theme now carries explicit OKLCH/APCA metadata.
+- First-prompt Fish initialization still performed live CLI work when cache artifacts were present. The prompt path now sources prewarmed cache files first and only regenerates on cache miss.
+- Terminal templates were palette-consistent, but rendering policy was inconsistent. macOS now prefers Display P3 and CoreText-friendly metrics; Linux/Wayland templates prefer more conservative opacity and FreeType-safe fallbacks.
+
+## Edge Cases
+
+- Wayland fontconfig now sets `rgba` declaratively from feature flags to avoid color fringing on mixed-density Linux panels.
+- Ghostty, Kitty, Alacritty, and WezTerm now share the same terminal ramp while allowing platform-specific font fallback and window-compositor behavior.
+- WSL parity is still template-capable, but DeltaE validation is not yet automated against Windows Terminal serialization.
+
+## Next Step
+
+Implement a small palette audit utility that computes APCA and DeltaE from `.chezmoidata/themes.toml` so the report can become test-backed rather than declarative.

package/docs/themes/hero-shot.svg

@@ -0,0 +1,78 @@
+<svg width="800" height="450" viewBox="0 0 800 450" xmlns="http://www.w3.org/2000/svg">
+  <!-- Background Shadow -->
+  <rect x="10" y="10" width="780" height="430" rx="12" fill="rgba(0,0,0,0.3)" filter="blur(10px)" />
+
+  <!-- Terminal Window -->
+  <rect x="20" y="20" width="760" height="410" rx="10" fill="#1e1e2e" stroke="#313244" stroke-width="1" />
+
+  <!-- Window Title Bar -->
+  <path d="M20 30 a10 10 0 0 1 10 -10 h740 a10 10 0 0 1 10 10 v20 h-760 z" fill="#181825" />
+
+  <!-- macOS Buttons -->
+  <circle cx="40" cy="35" r="6" fill="#f38ba8" />
+  <circle cx="60" cy="35" r="6" fill="#fab387" />
+  <circle cx="80" cy="35" r="6" fill="#a6e3a1" />
+
+  <!-- Title -->
+  <text x="400" y="38" font-family="JetBrains Mono, monospace" font-size="12" fill="#bac2de" text-anchor="middle">~/.dotfiles — zsh</text>
+
+  <!-- Mock Terminal Content -->
+  <g font-family="JetBrains Mono, monospace" font-size="13">
+    <!-- Prompt + command -->
+    <text x="40" y="75" fill="#a6e3a1">&#10148;</text>
+    <text x="60" y="75" fill="#cdd6f4">dot doctor</text>
+
+    <!-- Section: Dotfiles Core -->
+    <text x="40" y="105" fill="#89b4fa" font-weight="bold">Dotfiles Core</text>
+    <text x="40" y="125" fill="#a6e3a1">  &#10003; chezmoi</text>
+    <text x="220" y="125" fill="#585b70">2.47.1 (mise)</text>
+    <text x="40" y="145" fill="#a6e3a1">  &#10003; git</text>
+    <text x="220" y="145" fill="#585b70">2.49.0 (system)</text>
+    <text x="40" y="165" fill="#a6e3a1">  &#10003; age encryption</text>
+    <text x="220" y="165" fill="#585b70">key present</text>
+
+    <!-- Section: Shell Environment -->
+    <text x="40" y="195" fill="#89b4fa" font-weight="bold">Shell Environment</text>
+    <text x="40" y="215" fill="#a6e3a1">  &#10003; zsh</text>
+    <text x="220" y="215" fill="#585b70">5.9.0 (system)</text>
+    <text x="40" y="235" fill="#a6e3a1">  &#10003; starship</text>
+    <text x="220" y="235" fill="#585b70">1.22.1 (mise)</text>
+    <text x="40" y="255" fill="#a6e3a1">  &#10003; zoxide</text>
+    <text x="220" y="255" fill="#585b70">0.9.7 (mise)</text>
+
+    <!-- Section: CLI Tools -->
+    <text x="420" y="105" fill="#89b4fa" font-weight="bold">CLI Tools</text>
+    <text x="420" y="125" fill="#a6e3a1">  &#10003; rg (ripgrep)</text>
+    <text x="600" y="125" fill="#585b70">14.1.1</text>
+    <text x="420" y="145" fill="#a6e3a1">  &#10003; bat</text>
+    <text x="600" y="145" fill="#585b70">0.25.0</text>
+    <text x="420" y="165" fill="#a6e3a1">  &#10003; fzf</text>
+    <text x="600" y="165" fill="#585b70">0.60.3</text>
+
+    <!-- Section: Security -->
+    <text x="420" y="195" fill="#89b4fa" font-weight="bold">Security</text>
+    <text x="420" y="215" fill="#a6e3a1">  &#10003; SSH keys</text>
+    <text x="600" y="215" fill="#585b70">ed25519</text>
+    <text x="420" y="235" fill="#a6e3a1">  &#10003; GPG signing</text>
+    <text x="600" y="235" fill="#585b70">configured</text>
+    <text x="420" y="255" fill="#a6e3a1">  &#10003; secrets (age)</text>
+    <text x="600" y="255" fill="#585b70">encrypted</text>
+
+    <!-- Performance line -->
+    <text x="40" y="290" fill="#89b4fa" font-weight="bold">Performance</text>
+    <text x="40" y="310" fill="#a6e3a1">  &#10003; zsh startup</text>
+    <text x="220" y="310" fill="#585b70">12ms</text>
+
+    <!-- Score -->
+    <text x="40" y="350" fill="#a6e3a1" font-weight="bold">Score: 95/100 — Excellent</text>
+    <text x="40" y="370" fill="#585b70">18 passed, 0 errors, 1 warning</text>
+
+    <!-- New prompt -->
+    <text x="40" y="405" fill="#a6e3a1">&#10148;</text>
+    <text x="60" y="405" fill="#cdd6f4">~/.dotfiles</text>
+    <text x="170" y="405" fill="#f5c2e7">on master</text>
+    <rect x="275" y="393" width="8" height="16" fill="#cdd6f4">
+      <animate attributeName="opacity" values="1;0;1" dur="1s" repeatCount="indefinite" />
+    </rect>
+  </g>
+</svg>

package/dot_config/.module-manifest.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "Module manifest for dot_config/ — logical grouping of flat directories",
+  "groups": {
+    "shell": {
+      "description": "Shell environments and startup",
+      "modules": ["shell", "zsh", "fish", "nushell"]
+    },
+    "terminal": {
+      "description": "Terminal emulators",
+      "modules": ["alacritty", "ghostty", "kitty", "wezterm"]
+    },
+    "editor": {
+      "description": "Text editors and IDEs",
+      "modules": ["nvim", "vscode", "micro", "nano"]
+    },
+    "git": {
+      "description": "Version control",
+      "modules": ["git", "lazygit", "gh"]
+    },
+    "container": {
+      "description": "Containers and orchestration",
+      "modules": ["docker", "containers", "lazydocker", "k9s", "minikube"]
+    },
+    "ai": {
+      "description": "AI tools and assistants",
+      "modules": ["ai", "aider", "claude", "goose"]
+    },
+    "languages": {
+      "description": "Language toolchains",
+      "modules": ["go", "pip", "pypoetry", "gem", "bun", "yarn", "dlv"]
+    },
+    "system": {
+      "description": "System monitoring and management",
+      "modules": ["btop", "htop", "fastfetch", "topgrade", "systemd", "ncdu", "duf"]
+    },
+    "security": {
+      "description": "Security and secrets",
+      "modules": ["gnupg", "sops"]
+    },
+    "network": {
+      "description": "Network and HTTP tools",
+      "modules": ["curl", "wget"]
+    },
+    "data": {
+      "description": "Databases and data tools",
+      "modules": ["redis", "mongosh", "mycli", "ipython"]
+    },
+    "tools": {
+      "description": "CLI utilities",
+      "modules": ["bat", "fzf", "yazi", "just", "mise", "task", "tmux", "pueue", "atuin", "emoji"]
+    },
+    "desktop": {
+      "description": "Desktop environment and appearance",
+      "modules": ["gtk-3.0", "gtk-4.0", "fontconfig", "flatpak", "zellij"]
+    },
+    "macos": {
+      "description": "macOS-specific modules",
+      "modules": ["karabiner", "mas", "duti", "raycast"]
+    },
+    "infra": {
+      "description": "Infrastructure and cloud",
+      "modules": ["ansible", "tflint"]
+    },
+    "dotfiles": {
+      "description": "Dotfiles internal config",
+      "modules": ["dotfiles"]
+    }
+  }
+}

package/dot_config/ai/identity.md

@@ -0,0 +1,20 @@
+# AI Identity & Preferences
+
+## Profile
+- **User**:
+- **Role**: Senior Software Engineer / Architect
+- **Expertise**: Rust, TypeScript, Go, DevOps (Nix, Kubernetes), Shell Scripting.
+
+## Coding Style
+- **Principles**: Clean code, SOLID, DRY, KISS.
+- **Preferences**:
+  - Prefer TypeScript over JavaScript.
+  - Prefer functional programming patterns where appropriate.
+  - Use Vitest or Jest for testing.
+  - Use Prettier and ESLint for formatting/linting.
+- **Documentation**: Use JSDoc/TSDoc for code and GitHub-flavored Markdown for docs.
+
+## Workspace Context
+- **Environment**: Linux (CachyOS/Arch), macOS.
+- **Shells**: Zsh (primary), Fish, Nushell, Bash.
+- **Dotfiles**: Managed by Chezmoi, optimized for performance and security.

package/dot_config/ai/patterns/architect.md

@@ -0,0 +1,14 @@
+# Identity: Dotfiles Architect
+
+You are an expert Shell Infrastructure Architect specializing in the 2026 developer stack.
+
+## Core Directives
+- **Subtlety**: Propose changes that integrate seamlessly without adding unnecessary complexity.
+- **Performance**: Prioritize shell startup speed and binary efficiency (e.g., _cached_eval).
+- **Architecture**: Adhere to the modular "rc.d" structure and XDG Base Directory standards.
+- **Tools**: Leverage Mise for runtimes, Nix for declarative environments, and Chezmoi for state management.
+
+## Environment Context
+- OS: Arch/CachyOS (optimized for x86-64-v4) or macOS.
+- Shells: Zsh (primary), Fish, Nushell, Bash.
+- Security: Age/SOPS for secrets, GPG signing enforced.

package/dot_config/ai/patterns/hardener.md

@@ -0,0 +1,13 @@
+# Identity: Shell Security Hardener
+
+You are a security engineer specializing in high-compliance Fintech environments and Post-Quantum Cryptography (PQC).
+
+## Core Directives
+- **Zero Trust**: Assume all external scripts are compromised until verified.
+- **Encryption**: Enforce Age/SOPS for all sensitive data.
+- **Compliance**: Adhere to 2026 security baselines (GPG signing, SSH certificate authorities).
+- **Privacy**: Disable all non-essential telemetry at the OS and application level.
+
+## Verification Logic
+- Every proposal must include a "Verification" step (e.g., dot verify --security).
+- Prioritize hardware enclave (TPM/Secure Enclave) integrations.

package/dot_config/ai/patterns/refactor.md

@@ -0,0 +1,13 @@
+# Identity: POSIX & Shell Optimizer
+
+You are an expert in shell script optimization and POSIX compliance.
+
+## Core Directives
+- **Portability**: Ensure scripts work across Zsh, Bash, and Dash unless specifically optimized for a feature shell (like Fish/Nushell).
+- **Indempotency**: Scripts must be safe to run multiple times without side effects.
+- **Linting**: Adhere to ShellCheck best practices and strict error handling (set -euo pipefail).
+- **Latency**: Minimize subshell calls and external binary forks.
+
+## Optimization Strategy
+- Use built-in shell features over external commands where possible.
+- Implement caching mechanisms for heavy computations.

package/dot_config/aider/aider.conf.yml

@@ -0,0 +1,32 @@
+# Aider configuration
+# https://aider.chat/docs/config/options.html
+
+# Model settings
+model: claude-opus-4-6
+edit-format: diff
+
+# Git settings
+auto-commits: true
+dirty-commits: false
+attribute-author: true
+attribute-commit-message: true
+
+# UI settings
+dark-mode: true
+pretty: true
+stream: true
+
+# Code settings
+auto-lint: true
+lint-cmd: "npm run lint"
+auto-test: false
+
+# File handling
+gitignore: true
+aiderignore: true
+
+# History
+restore-chat-history: true
+
+# Voice (if enabled)
+# voice-language: en