@sebastienrousseau/dotfiles 0.2.511 → 0.2.513

package/CHANGELOG.md

@@ -2,6 +2,96 @@
 
 This file documents all notable changes to this project.
 
+## v0.2.513 — 2026-08-06
+
+- **Verified module registry installation.** `dot registry install` now validates the v1 index, verifies immutable archive SHA-256 digests, rejects traversal and link-bearing archives, previews with chezmoi by default, and applies only with explicit `--yes`. CI validates the published registry contract and JSON Schema.
+- **Native PowerShell daily workflow.** `dot.ps1` now handles core chezmoi operations, status, doctor, mise inventory, agent checks/listing, and local fleet status without bash. Windows CI exercises the cmdlets directly, and the parity matrix now distinguishes native behavior from bash bridges.
+- **Checksum-verified self-healing tools.** Nushell, Pueue, Wasmtime, SOPS, Yazi, and Zellij recovery now uses exact mise/aqua pins instead of mutable GitHub release URLs and unverified executable downloads.
+- **Reproducible toolchain lock.** The development toolchain now ships a cross-platform `mise.lock` covering Linux, macOS, and Windows with exact download URLs and available SHA-256 checksums. Font archives, distro signing keys, and binary archives now fail closed on integrity or unsafe archive structure.
+
+### Security
+
+- Enforce signed commits, linear history, required merge/reliability/DCO/PR
+  signature checks, conversation resolution, and up-to-date branches on
+  `main`.
+- Default GitHub Actions tokens to read-only, disable workflow PR approvals,
+  enable secret push protection, and pin the SLSA reusable workflow to its
+  immutable commit.
+- Verify every remotely executed installer against a committed SHA-256
+  allowlist. CI rejects direct download-to-shell execution and verifier
+  bypasses.
+
+### Fixed
+
+- Make CLI snapshots hermetic across hosts by normalizing platform facts,
+  installed-tool paths, versions, health counts, and timing measurements.
+- Keep `dot health` best-effort when an interactive zsh startup probe fails or
+  omits timing output, so macOS diagnostics still reach the health summary.
+- Measure both unit and mandatory regression tests in Bash coverage, retain
+  function-probe xtrace, and cache source normalization. Measured line
+  coverage rises to 59.32%, the enforced floor rises to 58%, and aggregation
+  now completes in seconds instead of minutes.
+- Run the reliability audit's integration phase without repeating the full
+  unit and regression suites.
+- Keep `master` as a verified, fast-forward-only compatibility mirror of
+  `main` for historical raw-content install URLs.
+- Package a self-contained `dot` distribution including command modules,
+  operational scripts, policies, schemas, help data, and the verified-download
+  manifest. Previously published archives omitted the command modules required
+  by most subcommands.
+- Add `make install PREFIX=... DESTDIR=...` and `make uninstall` using the
+  same tested staging path as release archives. Published releases now run a
+  provenance-verified clean-install smoke test on Linux and macOS.
+- Store CLI benchmark baselines under `XDG_CACHE_HOME` instead of requiring a
+  writable source checkout.
+- Make focused help work for `apply`, `agents`, and `registry`.
+- Make an explicit version-sync target update `package.json` atomically and
+  distinguish historical roadmap versions from current-version references.
+- Correct documentation that conflated 100% executable-module mapping with
+  measured Bash line coverage.
+
+## v0.2.512 — 2026-07-21
+
+### Added
+
+- **`dot-ui`** — a shared Bubble Tea (Go) renderer for the `dot` CLI: themed
+  tables across all list/table commands, a unified `dot-ui pick` that replaces
+  fzf in the theme picker, and a step-runner façade. Degrades gracefully when
+  Go is absent, so it never fails a `chezmoi apply`.
+- **AI CLIs** — Kimi Code CLI support, with a Kiri compatibility shim.
+- **Themes** — regenerated the full theme set from the updated wallpaper
+  library; system wallpapers are now opt-in (only discovered themes are
+  assembled); `bloom-light` is the new default theme.
+- **`corralctl`** — scheduled daily repo sync.
+- Symlink iCloud Drive folders into home.
+
+### Changed
+
+- **Theme engine overhaul** — terminals always use the dark palette with an
+  AAA light ramp; Apple-consistent light ANSI ramp; accurate wallpaper counts
+  and dominant-colour tracking; `dot-theme-sync` now drives through the shared
+  UI.
+- **mise** — folded `~/mise.toml` overrides into the managed base layer; bumped
+  topgrade to 17.4.0 and dropped the typos pin.
+- Bumped GitHub Actions pins (minor-patch group plus setup-go/node/python,
+  codeql-action, and action-gh-release), folding Dependabot #977 and #978.
+
+### Fixed
+
+- **Themes / terminals** — readable light-mode palettes (fixed bg/fg with
+  AA/AAA ANSI contrast); kitty now renders light themes, is opaque in light
+  mode, and gets a runtime reloader; tmux client redraw across all servers so
+  existing sessions refresh immediately; regen-proof fallback themes; correct
+  macOS accent mapping and per-mode HEIC frame resolution; no workspace freeze
+  or WallpaperAgent restart on apply.
+- **git** — render `allowed_signers` and guard it on a missing key / unset
+  email.
+- **CI / reliability** — portable `timeout` shim for macOS (real `gtimeout`);
+  reliability tests made portable and environment-tolerant; diagnostics
+  scorecard to 100; copyright and coverage gate fixes.
+- **aliases** — the CD-completion load-once guard now actually gates.
+- Push the AUR package to `master`, not `main`.
+
 ## v0.2.511 — 2026-07-08
 
 Bug-fix release: restore shell aliases that were silently dropped after the CD-completion fragment.

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=githubactions&logoColor=white" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.511-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.513-blue?style=for-the-badge&logo=semanticrelease&logoColor=white" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge&logo=github&logoColor=white" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github&logoColor=white" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&logo=linuxfoundation&logoColor=white&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,7 +52,7 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.511/install.sh
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.513/install.sh
 echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh

package/docs/AI.md

@@ -120,6 +120,7 @@ These tools are not installed for you. Install what you want with `dot ai instal
   - `amp` — Sourcegraph's agentic coder
   - `cursor-agent` — Cursor's terminal agent
   - `grok` — xAI's terminal coding agent (Grok Build; needs a SuperGrok / X Premium+ plan)
+  - `kimi` — Moonshot AI's Kimi Code CLI; installed natively to `~/.kimi-code/bin/kimi` and supports native interactive use and one-shot prompts
 
 - **Coding (interactive)** — focused pair-programming assistants:
   - `aider` — Git-aware AI pair programmer
@@ -152,7 +153,7 @@ The old command shapes still work, but print a one-line hint pointing at the new
 | Deprecated | Use instead |
 |------------|-------------|
 | `dot cl` | `dot ai claude` |
-| `dot codex` / `dot copilot` / `dot agy` / `dot goose` | `dot ai codex` / `dot ai copilot` / `dot ai agy` / `dot ai goose` |
+| `dot codex` / `dot copilot` / `dot kimi` / `dot agy` / `dot goose` | `dot ai codex` / `dot ai copilot` / `dot ai kimi` / `dot ai agy` / `dot ai goose` |
 | `dot kiro` / `dot sgpt` / `dot ollama` / `dot opencode` | `dot ai kiro` / `dot ai sgpt` / `dot ai ollama` / `dot ai opencode` |
 | `dot aider` / `dot autohand` / `dot vibe` / `dot qwen` / `dot zai` | `dot ai aider` / `dot ai autohand` / `dot ai vibe` / `dot ai qwen` / `dot ai zai` |
 | `dot ai status` | `dot ai tools` |

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.511) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.513) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/architecture/AI_COST_OPTIMIZATION.md

@@ -114,6 +114,7 @@ Providers tracked today:
 | Copilot CLI | `copilot` | yes | no |
 | Gemini CLI | `gemini` | yes | no |
 | Goose | `goose` | yes | no |
+| Kimi CLI | `kimi` | yes | no |
 | Aider | `aider` | yes | no |
 | OpenCode | `opencode` | yes | no |
 | Autohand | `autohand` | yes | no |

package/docs/archive/LEGACY_ROADMAP.md

@@ -1,160 +1,6 @@
----
-render_with_liquid: false
----
-
-# The Ultimate Developer Environment Roadmap
-
-This roadmap outlines the path to a high-performance, super-efficient development machine designed for Rust, Python, and AI on Linux (Zorin OS / T2 Mac hardware).
-
-## Phase 1: Foundation (Completed)
-
-- **Core Shell**: Zsh + Oh My Zsh.
-- **Modern Prompt**: Starship (hooked & active).
-- **Language Managers**: `rustup` (Rust) and `fnm` (Node.js).
-- **Ultra-Fast Python**: `uv` installed.
-- **Basic Modern Tools**: `eza` (ls), `bat` (cat), `fd` (find), `ripgrep` (grep).
-- **Git Enhancements**: `lazygit` (TUI) and `delta` (Diffs).
-- **Multiplexer**: `zellij` installed.
-- **AI**: `ollama` installed locally.
-- **Security**: Firewall (`ufw`) enabled.
-
----
-
-## Phase 2: Speed & Navigation (Completed)
-
-Focus: Reduce friction in filesystem navigation and build times.
-
-### 1. Navigation
-
-- [x] **Zoxide**: Smarter `cd` command that learns your habits (`z directory`).
-- [x] **FZF**: Command-line fuzzy finder. Essential for search history, files, and replacing standard completion.
-- [x] **Yazi**: Blazing fast terminal file manager (Rust-based).
-
-### 2. Rust Optimization
-
-- [x] **Mold**: Use the `mold` linker to speed up Rust compile times by 3x-10x.
-- [x] **Sccache**: Shared compilation cache to speed up recompilations across projects.
-- [x] **Bacon**: Background rust compiler that gives instant feedback on errors.
-
-### 3. Python Optimization
-
-- [x] **Ruff**: Extremely fast Python linter and formatter (replace flake8/black).
-- [x] **Global Config**: Set `uv` to use system Python or managed Python preferences.
-
-### 4. Code Search
-
-- [x] **Ripgrep-all (rga)**: Search inside PDFs, E-Books, zip files, etc.
-
----
-
-## Phase 3: AI Power User (Completed)
-
-Focus: Integrate AI deeply into the workflow.
-
-- [x] **Fabric**: Open-source framework for augmenting humans using AI (installed via `cmd` path).
-- [x] **Open WebUI**: A beautiful web interface for `ollama` (requires Docker).
-- [x] **GitHub Copilot CLI**: Integrate AI assistance directly into the terminal commands.
-- [x] **Local RAG**: Setup tools to chat with your own documents locally (Open WebUI).
-
----
-
-## Phase 4: System Tuning & Hardening (Completed)
-
-Focus: Squeeze every ounce of performance and security from the hardware.
-
-- [x] **Kernel Tuning**: Increase file descriptor limits and optimize TCP stack for lower latency.
-- [x] **Swap Optimization**: Configure `zram` for memory compression (improves performance on 16GB RAM).
-- [x] **Flatpak Overrides**: Secure Flatpak permissions using `Flatseal`.
-- [x] **Automated Updates**: Configure `unattended-upgrades` for security patches.
-
----
-
-## Phase 5: Final Polish (Completed)
-
-- [x] **Global UV Config**: Created `~/.config/uv/uv.toml` for managed python preference.
-- [x] **Roadmap Completion**: Verified all items are 100% complete.
-
----
-
-## Maintenance & Updates
-
-- **Update System**: `sudo apt update && sudo apt upgrade`
-- **Update Rust**: `rustup update`
-- **Update Node**: `fnm install --lts`
-- **Update UV**: `uv self update`
-- **Update Firmware**: `fwupdmgr get-updates`
-
----
-
-## Phase 6: Desktop Environment (Completed)
-
-Focus: Clean, bloat-free, and supercharged GNOME/Zorin experience.
-
-- [x] **Bloatware Removal**: Removed games (`aisleriot`, `mines`, etc.) and media apps (`rhythmbox`, `totem`).
-- [x] **Menu Cleanup**: Created `hide_menu_entries.sh` to deduplicate and hide unwanted entries.
-- [x] **GNOME Extensions**: Installed productivity boosters via `gnome-extensions-cli`:
-  - [x] `Clipboard Indicator`: History management.
-  - [x] `Caffeine`: Prevent auto-suspend.
-  - [x] `Impatience`: Speed up animations.
-  - [x] `Vitals`: System monitoring in top bar.
-- [x] **Memory Tuning**: Optimize GNOME Shell performance.
-
----
-
-## Phase 7: Browser Optimization (Completed)
-
-Focus: Chrome tuned for development and memory efficiency.
-
-- [x] **Settings**: Enable "Memory Saver" and "Energy Saver" via Managed Policies.
-- [x] **Extensions**: Automated installation of developer stack (uBlock, JSON Viewer, React DevTools, Vimium, Refined GitHub).
-- [x] **Profile Separation**: Separate Personal and Work profiles (Manual setup recommendation).
-
----
-
-## Phase 8: Neovim IDE (Completed)
-
-Focus: Building a terminal-based IDE that rivals VS Code for Rust, Python, and AI.
-
-- [x] **Latest Version**: Installed Neovim v0.12.0-dev (Nightly) to resolve plugin stability issues.
-- [x] **Plugin Manager**: Setup `lazy.nvim` with modular config (Restored from **PR #62**).
-- [x] **Core Plugins**:
-  - [x] `Telescope`: Fuzzy finding.
-  - [x] `Treesitter`: Syntax highlighting.
-  - [x] `Harpoon`: Fast file switching.
-  - [x] `Neo-tree`: File explorer.
-- [x] **UI/UX Menus**: Added `dressing.nvim` and `telescope-ui-select.nvim` for modern, searchable selection lists and floating inputs.
-- [x] **LSP & Autocomplete**:
-  - [x] `Mason`: Managing LSPs (rust-analyzer, pyright, ruff).
-  - [x] `Cmp`: Autocompletion engine.
-- [x] **Language Specifics**:
-  - [x] **Rust**: `rustaceanvim` configured.
-  - [x] **Python**: `pyright` + `ruff`.
-- [x] **AI Integration**:
-  - [x] `Copilot.lua`: Enabled (needs `:Copilot auth`).
-  - [x] `CopilotChat.nvim`: Sidebar chat (VS Code style).
-  - [ ] `Avante.nvim`: Skipped (Removed due to complexity/instability).
-- [x] **VS Code Parity Pack**:
-  - [x] `Trouble`: Problems panel.
-  - [x] `Spectre`: Search/Replace.
-  - [x] `Autopairs`: Auto-close brackets.
-  - [x] `Todo-Comments`: TODO/FIXME highlighting.
-  - [x] `Persistence`: Session management.
-
----
-
-## Phase 9: Repository Polish & PR #62 (In Progress)
-
-Focus: Finalize the `dotfiles` repository for public consumption and sync the local "Gold Standard" environment.
-
-- [x] **Repository Sync**:
-  - [x] Clone official repo to `~/dotfiles`.
-  - [ ] Sync validated configuration (Neovim, scripts, tuning) into repository.
-- [ ] **Documentation Update**:
-  - [ ] Refactor `README.md` for the modern architecture.
-  - [ ] Add "Easy Setup" and "Troubleshooting" guides.
-- [ ] **Final PR Submission**:
-  - [ ] Verify clean diff against original PR #62.
-  - [ ] Push updates to PR #62 branch.
-
+# Legacy Roadmap
 
+Legacy roadmap material has been consolidated into the canonical
+[`../../ROADMAP.md`](../../ROADMAP.md).
 
+This archive path is retained only for compatibility with older links.

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.511 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.513 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/docs/manual/01-concepts/02-trust-model.md

@@ -160,7 +160,8 @@ See [Fleet Architecture](04-fleet.md) for the full model.
 | Shellcheck zero-warnings | `ci.yml` | Yes |
 | Gitleaks scan | `ci.yml` | Yes |
 | Copyright headers | `ci-enforced.yml` | Yes |
-| 100% unit test coverage | `ci-enforced.yml` | Yes |
+| 100% executable module mapping | `ci-enforced.yml` | Yes |
+| Measured Bash line coverage | `coverage.yml` | Ratcheted floor; see `docs/operations/COVERAGE.md` |
 | Reliability (macOS + Linux) | `ci-enforced.yml` | Yes |
 | Checkov infrastructure scan | `ci-enforced.yml` | On severity MEDIUM+ |
 | SBOM (CycloneDX) | `ci.yml` | No (informational) |

package/docs/manual/02-tutorials/02-add-wallpaper.md

@@ -126,10 +126,10 @@ Output:
 ```
 NAME                        SOURCE     PATH
 ----                        ------     ----
-big-sur-graphic-dark        system     /System/Library/Desktop Pictures/.thumbnails/Big Sur Graphic Dark.heic
-big-sur-graphic-light       system     /System/Library/Desktop Pictures/.thumbnails/Big Sur Graphic Light.heic
-dome-dark                   system     /System/Library/Desktop Pictures/.thumbnails/Dome Dark.heic
-dome-light                  system     /System/Library/Desktop Pictures/.thumbnails/Dome Light.heic
+monterey-dark               system     /System/Library/Desktop Pictures/.thumbnails/Monterey Dark.heic
+monterey-light              system     /System/Library/Desktop Pictures/.thumbnails/Monterey Light.heic
+tahoe-dark                  system     /System/Library/Desktop Pictures/.thumbnails/Tahoe Dark.heic
+tahoe-light                 system     /System/Library/Desktop Pictures/.thumbnails/Tahoe Light.heic
 sonoma-dark                 system     /System/Library/Desktop Pictures/.thumbnails/Sonoma Dark.heic
 ...
 Total: 152 wallpapers
@@ -138,10 +138,10 @@ Total: 152 wallpapers
 Switch to any system wallpaper:
 
 ```sh
-dot theme dome-dark
+dot theme monterey-dark
 ```
 
-The engine extracts Dome Dark's dominant colors, generates a palette, and applies it to every surface.
+The engine extracts Monterey Dark's dominant colors, generates a palette, and applies it to every surface.
 
 ## Verifying the Result
 

package/docs/manual/02-tutorials/03-create-profile.md

@@ -48,7 +48,7 @@ Edit `~/.config/chezmoi/chezmoi.toml`:
 ```toml
 [data]
 machine = "surface-pro"      # choose from .chezmoidata/hardware.toml
-theme = "dome-dark"
+theme = "monterey-dark"
 default_shell = "fish"
 terminal_font_family = "JetBrainsMono Nerd Font"
 terminal_font_size = 11       # larger for HiDPI, smaller for dense screens

package/docs/manual/02-tutorials/05-deploy-fleet.md

@@ -146,7 +146,7 @@ Each host has its own `~/.config/chezmoi/chezmoi.toml` — use it for things tha
 # surface-pro's chezmoi.toml
 [data]
 machine = "surface-pro"
-theme = "dome-dark"           # per-host default
+theme = "monterey-dark"       # per-host default
 default_shell = "fish"
 terminal_font_size = 11       # smaller for HiDPI
 ```

package/docs/manual/03-reference/02-config-files.md

@@ -122,7 +122,7 @@ sourceDir = "/Users/you/.dotfiles"
 
 [data]
 machine = "surface-pro"      # selects preset from hardware.toml
-theme = "dome-dark"          # overrides .chezmoidata.toml default
+theme = "monterey-dark"      # overrides .chezmoidata.toml default
 default_shell = "fish"
 terminal_font_size = 11
 email = "you@example.com"

package/docs/manual/03-reference/03-environment.md

@@ -75,7 +75,7 @@ Variables relevant in GitHub Actions.
 | `CI` | Set to `true` in CI; disables prompts |
 | `GITHUB_ACTIONS` | GHA-specific; enables step summary output |
 | `CHEZMOI_VERSION` | Pinned chezmoi version for CI |
-| `COVERAGE_THRESHOLD` | Test coverage threshold (100 in enforced CI) |
+| `COVERAGE_THRESHOLD` | Executable module-mapping threshold (100 in enforced CI; not line coverage) |
 | `DOTFILES_TEST_MODE` | Skip network-dependent tests |
 
 ## Secret-Related

package/docs/manual/04-cookbook/03-faq.md

@@ -25,7 +25,7 @@ Only via WSL2. Native Windows PowerShell support exists for baseline parity (ali
 
 ### Is it production-ready?
 
-Yes — it's the author's daily driver across multiple hosts and receives regular releases (see `CHANGELOG.md`). CI enforces 100% test coverage, zero-warning linting, WCAG AAA for themes, SBOM + CVE scanning, and signed commits on every merge.
+Yes — it's the author's daily driver across multiple hosts and receives regular releases (see `CHANGELOG.md`). CI enforces 100% executable-module mapping and a ratcheted measured Bash line-coverage floor, plus zero-warning linting, WCAG AAA for themes, SBOM + CVE scanning, and signed-commit verification. The current measured coverage and exclusions are documented in `docs/operations/COVERAGE.md`.
 
 ### Can I fork it and use it without attribution?
 

package/docs/manual/05-appendices/B-security-checklist.md

@@ -71,7 +71,8 @@ Every PR to main must pass:
 - [x] Detect-secrets baseline diff
 - [x] TruffleHog verified scan
 - [x] Copyright headers present
-- [x] 100% unit test coverage
+- [x] 100% executable module mapping
+- [ ] 100% measured line and branch coverage (current ratchet is documented in `docs/operations/COVERAGE.md`)
 - [x] Reliability tests (macOS + Ubuntu)
 - [x] Checkov infra scan
 - [x] Version sync (bumped across all files)

package/docs/manual/command-index.md

@@ -77,6 +77,7 @@ job `lint/command-index` fails when this file is stale.
 | `dot history` | Shell history analysis |
 | `dot keys` | Keybindings (sign-check: verify git signing) |
 | `dot keys` | sign-check Verify git commit-signing configuration and key availability |
+| `dot kimi` | Kimi CLI with context patterns |
 | `dot kiro` | Kiro CLI with context patterns |
 | `dot learn` | Start the interactive tour of your new tools |
 | `dot lint` | Lint shell scripts (--fix |

package/docs/operations/ARCHITECTURE_ROADMAP.md

@@ -1,145 +1,7 @@
----
-title: "Architecture & Roadmap — cross-shell consistency, performance, decoupling"
-date: 2026-07-01
-status: living document
----
+# Architecture Roadmap
 
-# Architecture & Roadmap
+Historical architecture planning has been consolidated into the canonical
+[`../../ROADMAP.md`](../../ROADMAP.md).
 
-This document captures a deep-dive across four fronts — cross-shell
-consistency, real startup performance, the 2026 competitive/research
-landscape, and a plan to decouple optional subsystems (`dot ai`, MCP, LSP)
-into companion repos around a stable core. It is the source of truth for
-the multi-phase program tracked below.
-
-> Honesty policy: every performance number here is **measured** with
-> `hyperfine` (warmed up), reproducible with the harness in
-> `tests/performance/bench.sh` (interactive sessions, all installed shells)
-> and `dot benchmark`. Estimates are labelled as such. The
-> built-in `dot doctor` perf readout historically **understated** real
-> startup because it timed a narrower slice — Phase 0 reconciles that.
-
-## 1. Measured performance baseline (2026-07-01, Apple Silicon)
-
-Method: `hyperfine -N --warmup 5` on the deployed config; `exit`-on-launch.
-
-| Shell   | Startup (mean) | rc cost over ~7ms spawn | vs <30ms target |
-|---------|----------------|-------------------------|-----------------|
-| nushell | 24.8 ms        | —                       | meets           |
-| bash    | 51.1 ms        | +43.6 ms                | 1.7× over       |
-| zsh     | 66.3 ms        | +59.6 ms                | 2.2× over       |
-| fish    | 128.8 ms       | bash-bridge tax         | 4.3× over       |
-
-Baselines (pure process spawn, no rc): `zsh -fc exit` 6.7 ms,
-`bash --norc` 7.5 ms.
-
-Cost attribution (uncached tool-init subprocess cost, what `_cached_eval`
-caches away): `mise activate` 17.7 ms, `atuin init` 7.1 ms,
-`starship init` 4.0 ms, `zoxide init` 2.4 ms. `_cached_eval` **is**
-working (cache files fresh; `zcompdump` is `zcompile`d), which is why zsh
-is 66 ms and not ~97 ms.
-
-**<30ms verdict (honest):** not reachable for the *full eager stack*
-(mise + starship + atuin + zoxide + fzf + zinit + ~97 alias files + ~53
-functions + compinit) on zsh/bash without tradeoffs. It **is** reachable
-as a tunable "fast profile" + first-prompt deferral. nushell already
-meets it; fish (bash-bridge) is the worst and the biggest opportunity.
-
-## 2. Cross-shell consistency
-
-- bash/zsh are native + single-source; **fish and nushell are bash
-  *bridges*** — they filter aliases and wrap functions via `bash -c`
-  subshells, adding a runtime bash dependency and silent parity loss.
-- Parity gap: bash/zsh ~53 functions; fish 27 native; nushell 0 native;
-  ~26 functions have no native impl; behaviour drifts (e.g. `goto` loses
-  directory grouping in fish/nu).
-- Duplication: eza-detection logic in bash + 7 fish files + nu wrappers;
-  `_cached_eval` reimplemented four times.
-- Direction: a **manifest-driven single source of truth** (one
-  alias/function spec → per-shell generators). This also removes the
-  class of parse-time collision that produced the zsh alias-shim bug.
-
-## 3. Decoupling architecture
-
-```
-                     dotfiles (CORE)
-   dot CLI · lib/dot/ui.sh · utils.sh · chezmoi base · plugin API
-        |               |                 |             |
-   dotfiles-ai     dotfiles-mcp      dotfiles-lsp    (future)
-   dot ai,          registry,         dot/alias/
-   cockpit,         policy,           chezmoi-template
-   gateway          mcp-doctor        completions
-```
-
-Readiness (from the coupling audit):
-
-| Subsystem | Coupling | Effort | Notes |
-|-----------|----------|--------|-------|
-| MCP | low (declarative JSON + one `cmd_mcp`) | low | isolated by design |
-| LSP | none (one nvim plugin file) | trivial | already a lazy.nvim plugin |
-| `dot ai` | high (ui.sh, utils.sh, dispatcher, chezmoi hooks) | high | needs the two contracts below |
-
-Two foundational contracts must exist before AI can move cleanly:
-
-1. **Extract `lib/dot/ui.sh` into a versioned shared lib** — AI *and* MCP
-   depend on it; without this, decoupling means duplication.
-2. **A `dot` plugin/extension API** — manifest-registered subcommands so
-   companion repos add `dot ai` / `dot mcp` without forking the
-   dispatcher.
-
-## 4. 2026 landscape — gaps worth adopting (highest value first)
-
-- **`dotfiles-mcp` with a secrets-redaction + allowlist policy layer** — a
-  genuine gap no existing dotfiles-MCP fills; reuses the gitleaks / Atuin
-  `history_filter` posture. Expose introspection via MCP **Resources**,
-  actions via **Tools**.
-- **`dotfiles-lsp`** = `dot` subcommand completions + alias awareness +
-  **chezmoi-template-data-aware** completions → a novel *combination*
-  (weekend-scale MVP using just-lsp / tcl-lsp patterns).
-- Password-manager templating (1Password/Bitwarden), SOPS for shared
-  secrets, **Bats** tests (reviewer lingua franca), devcontainer/Codespaces
-  fast install path.
-
-Context: chezmoi has won the dotfiles category; mise is baseline; Starship
-has overtaken Powerlevel10k (maintenance-only); MCP spec 2025-11-25 is
-under the Linux Foundation and safe to build on.
-
-## 5. Staged roadmap
-
-Each phase ships as its own reviewed PR with before/after benchmarks.
-
-| Phase | Work | Risk | Target payoff |
-|-------|------|------|---------------|
-| **0** | Honest benchmark harness in-repo; make `dot doctor` report real numbers | low | truth in metrics |
-| **1** | Perf quick-wins audit (deferral, compinit, zcompile, mise ordering) | low | verify + record baseline |
-| **2** | Extract `lib/dot/ui.sh` → versioned shared lib | med | unblocks decoupling |
-| **3** | `dot` plugin API + carve out `dotfiles-mcp` (lowest-risk repo) | med | proves the model |
-| **4** | Cross-shell manifest (single source → per-shell generators); de-bash-bridge fish | high | consistency + fish speed |
-| **5** | `dotfiles-ai` as a plugin repo | high | the decoupling goal |
-| **6** | `dotfiles-lsp` MVP | low | differentiation |
-| **7** | Docs + `examples/` + published honest benchmarks | med | completeness |
-
-### Status
-
-- **Phase 0 — done** (`feat/v0.2.509`): `tests/performance/bench.sh` now times
-  every shell *interactively* (fish was measured non-interactively, faking
-  ~12ms vs the real ~118ms) and includes nushell; `dot doctor` reports the
-  real medians.
-- **Phase 1 — done (audit)** (`feat/v0.2.509`): the documented quick-wins are
-  **already implemented** in the deployed config, verified:
-  - `compinit` deferred to first prompt, `-C` + daily-audit cache
-    (`~/.config/zsh/rc.d/30-options.zsh`).
-  - Eagerly-sourced hub files are `zcompile`d (`.zwc` present).
-  - Plugins turbo-deferred (`zinit ice wait lucid`), fzf backgrounded, and
-    mise/atuin/starship/zoxide inits deferred to post-prompt hydration and
-    cached via `_cached_eval`.
-  - `mise activate` ordering is a non-issue here: zsh uses `add-zsh-hook`
-    (appends, no overwrite) and bash manages `PROMPT_COMMAND` explicitly.
-  - Net: `zsh -ic exit` (which runs before the prompt, so it excludes the
-    deferred inits) is ~66ms of *eager* rc — dominated by sourcing the large
-    aggregated alias/function hubs. No safe further quick-win remains.
-  - **Consequence:** sub-30ms is not reachable by tuning; it needs Phase 4
-    (manifest → cut the eager alias/function volume) or a lean profile.
-    fish (~118ms) is the biggest single opportunity (bash-bridge), also
-    Phase 4.
-- Phases 2–7 — planned; sequencing subject to review.
+Current architecture decisions belong in `docs/architecture/`; future roadmap
+items belong in the root roadmap or in GitHub issues and milestones.

package/docs/operations/COVERAGE.md

@@ -43,17 +43,40 @@ matches and emits standard `lcov.info` that Codecov ingests natively.
 
 | Surface | What runs |
 |---|---|
-| **PR + push to main** | `.github/workflows/coverage.yml` → `Coverage / kcov` job → uploads lcov.info to Codecov and fails the build below `MIN_COVERAGE_PCT` (currently `0`, ratcheted up each slice). |
+| **PR + push to main** | `.github/workflows/coverage.yml` → `Coverage / kcov` job → uploads lcov.info to Codecov and fails the build below `MIN_COVERAGE_PCT` (currently `58`, ratcheted up after measured integer-floor gains). |
 | **Local dev** | `bash tools/ci/run-coverage.sh` — works on Linux + macOS (xtrace is a bash primitive, no platform tools needed). |
-| **macOS dev** | Supported. xtrace-based instrumentation runs on macOS bash 3.2+ and Homebrew bash 5.x. |
+| **macOS dev** | Supported. xtrace-based instrumentation runs on macOS bash 3.2+ and Homebrew bash 5.x, with a Perl alarm fallback when GNU `timeout`/`gtimeout` is unavailable. |
 
 ## The current floor
 
-`MIN_COVERAGE_PCT=0` in `.github/workflows/coverage.yml`. Slice 1
+`MIN_COVERAGE_PCT=58` in `.github/workflows/coverage.yml`. Slice 1
 of [#883](https://github.com/sebastienrousseau/dotfiles/issues/883)
 established the baseline at **~2.7% measured** (~613 of ~22 500 lines
 across 231 files). Successive slices raised it; the current measured
-value sits at **~47%**.
+value sits at **59.32%** (`7523/12682` lines, measured on v0.2.513; gate floored at 58 for local<->CI drift + run variance). This release now traces both mandatory unit and regression suites, replays the function exerciser's captured xtrace, and caches source-path normalization so aggregation completes in seconds instead of minutes. It builds on the earlier parser correction for nested Bash execution prefixes and deterministic branch-driving tests for Scorecard snapshots, examples coverage, and `httpdebug`. It builds on the eighth core
+coverage-ratchet slice, which added `jwt` portability coverage and
+branch-driving function coverage for `apihealth`, `apiload`, and
+`apilatency`. This builds on the prior helper slice that drove
+`scripts/dot/commands/restore.sh` to 75.17%,
+`scripts/dot/commands/meta.sh` to 66.88%, `lib/dot/log.sh` to 59.56%,
+and `scripts/dot/commands/diagnostics.sh` to 49.63%, with additional
+git AI, hashsum, regex, jsonv, gl, and hex helper branch coverage.
+This builds on the prior core slice (`scripts/dot/commands/init.sh` at 72.09%,
+`scripts/dot/commands/manual.sh` at 62.50%,
+`scripts/dot/commands/core.sh` at 55.86%, and
+`scripts/dot/commands/secrets.sh` at 54.97%), the prior
+AI command slice (`defaults/dot_local/bin/executable_dot-ai-proxy` at
+76.00%, `scripts/dot/commands/agents.sh` at 66.15%, and
+`scripts/dot/commands/completion.sh` at 45.68%), the registry slice
+(`scripts/dot/commands/registry.sh` at 65.03%) and the macOS
+coverage-runner Perl timeout fallback, the aliases slice
+(`scripts/dot/commands/aliases.sh` at 70.00%), the tools/version-sync
+slice (`scripts/dot/commands/tools.sh` at 72.85%, `lib/dot/utils.sh` at
+73.24%, and `scripts/version-sync.sh` at 36.53%), the first core slice
+for `lib/dot/ui.sh`, and the #954 deep-branch pass for
+`scripts/theme/switch.sh`,
+`scripts/diagnostics/mcp-doctor.sh`, and Linux/WSL branches in
+`scripts/diagnostics/doctor.sh`.
 
 To tighten:
 
@@ -66,10 +89,9 @@ To tighten:
 
 ### Why not the 95% target from #883
 
-The roadmap originally targeted ≥95% measured. After working through
-all six slices, the achievable ceiling with xtrace-only instrumentation
-is closer to **~50%** on this codebase. The remaining gap is structural,
-not aspirational:
+The roadmap originally targeted ≥95% measured. The current xtrace-only
+measurement is **59.32%** on this codebase. The remaining gap is largely
+structural:
 
 - **System-mutation surface** — large parts of the repo orchestrate
   real OS state (`chezmoi apply`, `gpg`, `pass`/`age` keystores,