@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/docs/manual/command-index.md

@@ -1,155 +0,0 @@
----
-render_with_liquid: false
----
-
-# Command Index
-
-Generated from `dot help all`. To refresh after adding or renaming
-a subcommand, run `tools/docs/generate-command-index.sh`. The CI
-job `lint/command-index` fails when this file is stale.
-
-| Command | Summary |
-|---------|---------|
-| `dot add` | Add a file to chezmoi source |
-| `dot agent` | Profile-aware execution, agent card, a2a-card, session log, checkpoints, and conformance |
-| `dot agent` | a2a-card Show or validate the A2A v0.3 agent card |
-| `dot agent` | card Show the local agent card metadata |
-| `dot agent` | checkpoint Manage agent run checkpoints (save/list/show/replay) |
-| `dot agent` | conformance Run the A2A conformance test suite |
-| `dot agent` | delegate Delegate execution to an allowed sub-agent |
-| `dot agent` | log Tail the agent session audit log |
-| `dot agents` | check Verify AGENTS.md tracks CLAUDE.md (exit 1 if drifted) |
-| `dot agents` | list Show recognised AI agent harnesses and their config paths |
-| `dot agents` | render Regenerate AGENTS.md and per-harness config from CLAUDE.md |
-| `dot agy` | Antigravity CLI with context patterns |
-| `dot ai` | AI fleet cockpit, gateway, and cost |
-| `dot ai` | ask Context-aware RAG query over your dotfiles |
-| `dot ai` | chat Start an interactive AI session with a chosen tool |
-| `dot ai` | cost Report AI spend across every provider from the unified run log |
-| `dot ai` | delegate Delegate a coding task to a cheaper AI model under agent policy |
-| `dot ai` | doctor Diagnose AI tooling configuration and connectivity |
-| `dot ai` | install Install AI CLI tools via mise/native installers |
-| `dot ai` | login Interactive setup/authentication for installed AI CLI tools |
-| `dot ai` | run Run a one-shot prompt with an AI tool |
-| `dot ai` | serve Run the local AI gateway/proxy that routes non-Claude providers |
-| `dot ai` | tools Show installed AI CLI tools and their versions |
-| `dot ai-query` | Context-aware RAG query over your dotfiles |
-| `dot ai-setup` | Interactive setup for all AI CLI tools |
-| `dot aider` | Aider with context patterns |
-| `dot aliases` | cheatsheet Generate the alias cheatsheet markdown |
-| `dot aliases` | list List all shell aliases shipped by the dotfiles |
-| `dot aliases` | search Search aliases by term |
-| `dot aliases` | stats Show alias usage counts from shell history |
-| `dot aliases` | tiers Show which alias tiers/ecosystems are enabled |
-| `dot aliases` | why Show details and deprecation status for a single alias |
-| `dot attest` | Export workstation attestation evidence (--json |
-| `dot backup` | Create a compressed backup of your home |
-| `dot bundle` | Create offline archive of dotfiles environment |
-| `dot cache-refresh` | Regenerate shell caches for ultra-fast startup |
-| `dot cd` | Print source directory path (use: cd $(dot cd)) |
-| `dot chaos` | Simulate config corruption to test self-healing |
-| `dot cl` | Claude CLI with context patterns |
-| `dot commit` | AI-powered conventional commit |
-| `dot completion` | Generate shell completions (bash/zsh/fish/nu) from the command registry |
-| `dot copilot` | GitHub Copilot CLI with context patterns |
-| `dot diff` | Show chezmoi diff with exclusions |
-| `dot dns-doh` | Enable DNS-over-HTTPS [macOS,Linux] |
-| `dot docs` | Show repo README |
-| `dot doctor` | Deep audit: tools, paths, portability, AI analysis (--ai |
-| `dot edit` | Open chezmoi source in $EDITOR |
-| `dot encrypt-check` | Check disk encryption status |
-| `dot env` | Tool versions (mise) |
-| `dot env` | emit Emit a portable workstation environment manifest (SBOM; --format json) |
-| `dot env` | install Install requested tool versions via mise |
-| `dot env` | list List managed tool versions via mise |
-| `dot env` | prune Show or remove orphan tool installs (--yes to commit) |
-| `dot env` | use Pin a tool version globally/locally via mise |
-| `dot firewall` | Apply firewall hardening [macOS,Linux] |
-| `dot fleet` | Show fleet node status, drift, and namespace (--json for machine output) |
-| `dot fleet` | apply SSH to every host in fleet.toml and run dot sync (or a custom --cmd) |
-| `dot fleet` | drift Check for configuration drift across managed files |
-| `dot fleet` | enforce Show or set RBAC enforcement mode (advisory/strict) for agent profiles |
-| `dot fleet` | events Show recent fleet events from local event log |
-| `dot fleet` | namespace Show or set the active namespace for multi-tenant isolation |
-| `dot fleet` | status Show this node's fleet status: id, namespace, version, OS, drift, last apply |
-| `dot fonts` | Install (default) or patch Nerd Fonts (JetBrainsMono by default) |
-| `dot help` | Show this help message |
-| `dot history` | Shell history analysis |
-| `dot keys` | Keybindings (sign-check: verify git signing) |
-| `dot keys` | sign-check Verify git commit-signing configuration and key availability |
-| `dot kimi` | Kimi CLI with context patterns |
-| `dot kiro` | Kiro CLI with context patterns |
-| `dot learn` | Start the interactive tour of your new tools |
-| `dot lint` | Lint shell scripts (--fix |
-| `dot load-bench` | Measure time to heavy-layer readiness |
-| `dot lock-screen` | Enforce lock screen idle settings [Linux] |
-| `dot mcp` | Inspect MCP policy, supply chain, and registry |
-| `dot mcp` | doctor Run the MCP policy/supply-chain/config audit |
-| `dot mcp` | registry Show the configured MCP server registry |
-| `dot metrics` | Show recent observability metrics (JSONL) |
-| `dot mode` | Set or inspect agent operating profiles (ask/plan/apply/audit) |
-| `dot mode` | current Show the active agent profile and its policy |
-| `dot mode` | doctor Validate the agent-profiles.json config and default profile |
-| `dot mode` | list List available agent operating profiles (ask/plan/apply/audit) |
-| `dot mode` | run Run a command under a given agent profile with a checkpoint |
-| `dot mode` | set Switch the active agent profile |
-| `dot mode` | show Show details of a specific agent profile |
-| `dot new` | Create a new project from a template |
-| `dot ollama` | Ollama with context patterns |
-| `dot opencode` | OpenCode with context patterns |
-| `dot packages` | List installed packages and package managers |
-| `dot patterns` | edit Edit an AI steering pattern in $EDITOR |
-| `dot patterns` | list List AI steering patterns |
-| `dot patterns` | view View an AI steering pattern |
-| `dot perf` | Show performance mode and quick timing |
-| `dot policy` | Check and enforce security policies across the environment |
-| `dot profile` | Show/switch configuration profile |
-| `dot profile` | set Set the active configuration profile (run dot sync to apply) |
-| `dot profile` | show Show the active configuration profile and feature flags |
-| `dot registry` | info Print full metadata for a registry module |
-| `dot registry` | install Install a registry module (scaffold) |
-| `dot registry` | list List modules in the configured module registry |
-| `dot registry` | search Filter registry modules by keyword |
-| `dot registry` | set-url Override the registry URL (https only; persists) |
-| `dot registry` | url Show the active registry URL |
-| `dot rollback` | Rollback dotfiles to a previous state |
-| `dot sandbox` | Launch a safe sandbox preview (Docker/Podman) |
-| `dot score` | System health and security scorecard |
-| `dot search` | Find commands by keyword |
-| `dot secret-audit` | Audit secret hygiene and leakage surface |
-| `dot secrets` | Edit encrypted secrets (age) |
-| `dot secrets` | edit Edit the encrypted secrets file (age) |
-| `dot secrets` | get Retrieve a secret value (--raw for plaintext) |
-| `dot secrets` | list List indexed secret keys |
-| `dot secrets` | load Emit export lines for a secrets bucket (use with eval) |
-| `dot secrets` | provider Show the active secrets provider |
-| `dot secrets` | set Store a secret value under a key |
-| `dot secrets-create` | Create an encrypted secrets file |
-| `dot secrets-init` | Initialize age key for secrets |
-| `dot sgpt` | Shell-GPT with context patterns |
-| `dot snapshot` | Capture baseline system snapshot |
-| `dot ssh-cert` | Manage short-lived SSH certificates |
-| `dot ssh-key` | Encrypt an SSH key locally with age |
-| `dot status` | Show configuration drift (chezmoi status) |
-| `dot sync` | Apply dotfiles (alias for apply; --pull to fetch, --check to preview) |
-| `dot telemetry` | Disable OS telemetry [macOS,Linux] |
-| `dot teleport` | Deploy the dotfiles environment to a remote host over SSH |
-| `dot theme` | Switch terminal theme (dark/light) |
-| `dot theme` | current Show the current theme info |
-| `dot theme` | family Cycle between theme families |
-| `dot theme` | list Show all available terminal/wallpaper themes |
-| `dot theme` | rebuild Regenerate themes from system and custom wallpapers |
-| `dot theme` | set Set a theme by name (interactive picker if omitted) |
-| `dot theme` | sync Sync the dotfiles theme with system dark/light mode |
-| `dot theme` | toggle Toggle light/dark within the current theme family |
-| `dot tools` | Show or install nix packages |
-| `dot tools` | docs Show the full tools markdown documentation |
-| `dot tools` | install Enter the Nix development shell with all managed tools |
-| `dot tune` | Apply OS tuning (opt-in) [macOS,Linux] |
-| `dot uninstall` | Remove the managed dotfiles environment (prompts unless --force) |
-| `dot upgrade` | Update system toolchains, plugins, and dotfiles |
-| `dot usb-safety` | Disable automount for removable media [Linux] |
-| `dot version` | Show version information. |
-| `dot wallpaper` | Apply a wallpaper from your library [macOS,Linux] |
-| `dot wallpaper` | rotate Rotate to the next wallpaper in your library |
-| `dot wallpaper` | sync Sync wallpaper from your library |

package/docs/manual/concept-index.md

@@ -1,168 +0,0 @@
----
-render_with_liquid: false
----
-
-# Concept Index
-
-Alphabetical list of concepts covered in the manual.
-
-- Accessibility
-- Adding a New Flag
-- Agent Policy Enforcement
-- AI & Agents
-- Algorithms
-- Apply / Sync
-- Attestation
-- Author
-- Auto-Populated
-- Bibliography
-- Build Artifacts
-- Built-in Chezmoi Functions
-- Built-in Chezmoi Variables
-- Cache Files
-- Caching
-- Changing Presets on an Existing Host
-- Checking Active Flags
-- CI
-- CI-Level Gates
-- CI-Specific
-- Color Science
-- Configuration
-- Contributions
-- Cross-Host Trust
-- Cryptography
-- Daily Use
-- Data Flow
-- Design Principles
-- Development
-- Diagnostics
-- Documentation Systems
-- Drift Detection
-- Dynamic HEIC (Apple Appearance Metadata)
-- Environment Variables
-- Example: Font Size by Preset
-- Example: Platform × Preset
-- Example: Using Theme in Ghostty Config
-- Exit Codes
-- Feature Matrix
-- Flag Catalogue
-- Flag Deprecation
-- Fleet
-- Fleet Attestation
-- Fleet Deployment Workflow
-- Fleet Operational Commands
-- Fleet Trust Propagation
-- From `.chezmoidata.toml`
-- From `.chezmoidata/hardware.toml`
-- From `.chezmoidata/themes.toml`
-- From Feature Flags
-- Gates Enforced by CI
-- General
-- Getting More Help
-- Global Flags
-- Global Flags (`.chezmoidata.toml`)
-- Hardware Presets
-- Helper Templates (in `.chezmoitemplates/`)
-- Identity and Signing
-- Incident Response
-- Inspect & Repair
-- Installation
-- Installation & Update
-- Invocation
-- Limitations
-- Listing Known Presets
-- Log Files
-- Machine-Scoped Secrets
-- Manual
-- MIT License
-- Next
-- Observability
-- Ongoing (monthly)
-- Ongoing (quarterly)
-- Operational Rules
-- Option A: Drop a Static Image
-- Option B: Dynamic HEIC (Recommended)
-- Option C: Golden Ratio Brightness (Advanced)
-- Option D: Install System Wallpapers (Already-Available)
-- Optional Binaries (installed by Mise on first apply)
-- Per-Machine Profiles
-- Per-Preset Overrides (`.chezmoidata/hardware.toml`)
-- Performance
-- Philosophy
-- Post-Install
-- Pre-Install
-- Prerequisites
-- Principles
-- Protocols
-- Read by Tools
-- Recovery
-- Reference
-- Required Binaries
-- Scenario
-- Secret-Related
-- Secrets
-- See Also
-- Shell Performance
-- Single Source, Many Hosts
-- Source Repository
-- Start Here
-- Startup Order
-- Startup Performance Model
-- Step 1: Choose or Create a Preset
-- Step 1: Generate an Age Key (First Time Only)
-- Step 1: Per-Host Install
-- Step 1: Run the Installer
-- Step 2: Choose Encryption Method
-- Step 2: Exchange Signing Keys
-- Step 2: Select the Preset for This Host
-- Step 2: Verify
-- Step 3: Reference the Preset in Templates
-- Step 3: Share the Age Key (for Shared Secrets)
-- Step 3: Take the Tour
-- Step 3A: Chezmoi-Encrypted File
-- Step 3B: SOPS-Encrypted YAML
-- Step 4: Add a New Preset
-- Step 4: Customize
-- Step 4: Reference the Secret in a Template
-- Step 4: Verify Fleet Alignment
-- Step 5: Add Your Identity
-- Step 5: Commit and Verify
-- Step 5: Per-Host Customization
-- Step 5: Per-Preset Feature Flags
-- Step 6: First Theme Switch
-- Step 6: Fleet-Wide Updates
-- Step 6: Multi-Recipient (Fleet)
-- Step 7: Rotate a Compromised Key
-- Step 7: Secrets Rotation
-- Step 8: Decommission a Host
-- Summary
-- Supported Architectures
-- Supported Platforms
-- Supported Shells
-- Template Testing
-- Tested CI Environments
-- The Four Subsystems
-- The Pipeline
-- The Self-Healing Loop
-- The Threat Model
-- The Why
-- Theme
-- Theme Application
-- Themes
-- Third-Party Licenses
-- Threat Model Summary
-- Tools & Systems
-- Troubleshooting
-- Troubleshooting Community
-- Trust Boundaries
-- Unsetting
-- User-Owned Configuration
-- User-Settable
-- Using a Flag in a Template
-- Validation in CI
-- Verified Files
-- Verifying No Plaintext Leaks
-- Verifying the Result
-- Wallpaper Discovery
-- What Got Installed
-- When to Use a Profile

package/docs/manual/index.md

@@ -1,66 +0,0 @@
----
-title: "The .dotfiles Manual"
-description: "A trusted agent workstation baseline for macOS, Linux, and WSL."
-render_with_liquid: false
----
-
-# The .dotfiles Manual
-
-A trusted agent workstation baseline for macOS, Linux, and WSL. Chezmoi handles templating and platform differences; the `dot` CLI coordinates lifecycle operations on top.
-
-This manual is generated from the Markdown sources in [`docs/manual/`](https://github.com/sebastienrousseau/dotfiles/tree/main/docs/manual) and published in nine formats per release. The HTML edition you are reading is the canonical online version.
-
-## Read it your way
-
-- **Web (multi-page)** — browse the chapters below
-- **Single-page HTML, PDF, EPUB, ASCII text** — attached to every [GitHub Release](https://github.com/sebastienrousseau/dotfiles/releases/latest)
-- **CLI** — `dot manual` opens the manual locally; `dot manual pdf` downloads the PDF; `dot manual text` pipes the ASCII edition to your pager
-
-## Contents
-
-### [Introduction](00-introduction.md)
-
-The audience, scope, conventions, and where the manual is published.
-
-### Concepts
-
-- [Architecture](01-concepts/01-architecture.md) — repository layout, chezmoi templating, the `dot` dispatcher
-- [Trust model](01-concepts/02-trust-model.md) — signing, attestation, SBOM, policy gates
-- [Theme engine](01-concepts/03-theme-engine.md) — wallpaper-driven theming across apps
-- [Fleet](01-concepts/04-fleet.md) — multi-workstation coordination and drift detection
-- [Self-healing](01-concepts/05-self-healing.md) — automatic remediation and rollback
-
-### Tutorials
-
-- [First install](02-tutorials/01-first-install.md)
-- [Add a wallpaper-driven theme](02-tutorials/02-add-wallpaper.md)
-- [Create an agent profile](02-tutorials/03-create-profile.md)
-- [Encrypt a secret](02-tutorials/04-encrypt-secret.md)
-- [Deploy to a fleet](02-tutorials/05-deploy-fleet.md)
-
-### Reference
-
-- [`dot` CLI](03-reference/01-dot-cli.md) — every subcommand
-- [Config files](03-reference/02-config-files.md) — every `~/.config/dotfiles/*` path
-- [Environment](03-reference/03-environment.md) — every variable read by the framework
-- [Templates](03-reference/04-templates.md) — every `{{ .var }}` reference
-- [Feature flags](03-reference/05-feature-flags.md)
-
-### Cookbook
-
-- [Recipes](04-cookbook/01-recipes.md)
-- [Troubleshooting](04-cookbook/02-troubleshooting.md)
-- [FAQ](04-cookbook/03-faq.md)
-
-### Appendices
-
-- [A — Platform matrix](05-appendices/A-platform-matrix.md)
-- [B — Security checklist](05-appendices/B-security-checklist.md)
-- [C — Glossary](05-appendices/C-glossary.md)
-- [D — Bibliography](05-appendices/D-bibliography.md)
-- [E — License](05-appendices/E-license.md)
-
-### Indexes
-
-- [Concept index](concept-index.md)
-- [Command index](command-index.md)

package/docs/operations/ARCHITECTURE_ROADMAP.md

@@ -1,7 +0,0 @@
-# Architecture Roadmap
-
-Historical architecture planning has been consolidated into the canonical
-[`../../ROADMAP.md`](../../ROADMAP.md).
-
-Current architecture decisions belong in `docs/architecture/`; future roadmap
-items belong in the root roadmap or in GitHub issues and milestones.

package/docs/operations/ATTESTATION.md

@@ -1,44 +0,0 @@
----
-render_with_liquid: false
----
-
-# Workstation Attestation
-
-`dot attest` exports a machine-readable record of the current workstation state.
-
-It captures:
-
-- dotfiles version
-- platform and architecture
-- Git signing settings
-- active agent profile
-- MCP strict-mode audit status
-- tracked agent card, profile, and registry data
-- policy bundles
-- model and prompt registries
-
-Run:
-
-```bash
-dot attest
-dot attest --json
-dot attest -j
-dot attest --write ~/.local/state/dotfiles/attestations/workstation.json
-dot attest -w ~/.local/state/dotfiles/attestations/workstation.json
-dot attest --fleet-store /srv/dotfiles-fleet
-dot attest -F /srv/dotfiles-fleet -I engineering
-```
-
-The default output path is `~/.local/state/dotfiles/attestations/workstation-attestation.json`.
-
-Fleet export writes:
-
-- `<fleet-store>/<fleet-id>/<hostname>/workstation-attestation.json`
-- timestamped copies for retention
-
-Governance evidence is embedded directly in the JSON output. That includes:
-
-- policy bundle definitions
-- model registry metadata
-- prompt registry metadata
-- tracked MCP policy and registry artifacts

package/docs/operations/CI_CADENCE.md

@@ -1,107 +0,0 @@
----
-render_with_liquid: false
----
-
-# CI Cadence
-
-This page tabulates every GitHub Actions workflow in `.github/workflows/`
-with its trigger cadence and the rationale for that cadence. Maintained
-under [issue #861](https://github.com/sebastienrousseau/dotfiles/issues/861).
-
-## Cadence rules
-
-We use four cadence buckets:
-
-| Bucket | When | Used for |
-|---|---|---|
-| **Event** | `push`, `pull_request`, `merge_group` | Code-change gates — must run on every PR. |
-| **Weekly** | `schedule:` Monday or Sunday | Drift detection, beta-tool watch, extended platform matrices. |
-| **Monthly** | (none currently) | Long-running audits, historical scans. |
-| **Manual** | `workflow_dispatch` only | Releases, ad-hoc tooling. |
-
-**Anti-rule:** no workflow runs on `cron: '* * * *'` (daily) unless its
-output is consumed daily by something downstream. Nothing today meets
-that bar; see "Why no daily jobs" below.
-
-## Workflow cadence table
-
-| Workflow | Triggers | Schedule (UTC) | Why this cadence |
-|---|---|---|---|
-| `ci.yml` | event + schedule | Mon 06:00 (weekly) | Lint / test on every PR; weekly schedule catches drift from external dependencies (apt mirrors, Homebrew bottles) even when no code lands. |
-| `ci-enforced.yml` | event | — | Strict gates fire on every PR; no scheduled run (covered by ci.yml weekly). |
-| `codeql.yml` | event + schedule | Mon 06:00 (weekly) | Source-code SAST. Weekly schedule catches new CodeQL rule packs. |
-| `compliance-guard.yml` | event | — | Policy enforcement on every PR; no need to schedule. |
-| `cross-platform-test.yml` | event + schedule | Sun 07:00 (weekly) | Validates BSD vs GNU tool divergence on every PR; weekly catches GitHub-hosted-runner image updates. |
-| `devcontainer-prebuild.yml` | event + schedule | Mon 03:00 (weekly) | Pre-build the devcontainer image weekly so first `Open in Codespaces` is fast. |
-| `manual-publish.yml` | manual only | — | Release-trigger flow; never scheduled. |
-| `nightly.yml` | schedule + manual | **Sun 02:00 (weekly)** | Was daily; flipped to weekly under [#861](https://github.com/sebastienrousseau/dotfiles/issues/861). Jobs (beta-tool detection, extended OS matrix on macos-15-intel/macos-14, dependency-report) don't need daily cadence. |
-| `npm-publish.yml` | release tag | — | Trigger: `push` of a version tag. |
-| `policy-bundle-release.yml` | manual + release | — | Manual / release-trigger only. |
-| `pr-signature.yml` | pull_request | — | Verifies PR description has the branding signature. |
-| `reliability-gate.yml` | event | — | Reliability audit on every PR; no scheduled cadence. |
-| `reusable-*.yml` (×7) | callable | — | Called by other workflows; not directly triggered. |
-| `sbom-diff.yml` | pull_request | — | Generates SBOM diff per PR. |
-| `security-enhanced.yml` | event + schedule | **Sun 02:00 (weekly)** | Was daily; reduced to weekly in earlier hardening. Per-PR runs cover the active-change case. |
-| `security-release.yml` | release tag | — | SLSA provenance on release; never scheduled. |
-| `sync-versions.yml` | manual | — | Version-bump tooling. |
-| `update-deps.yml` | schedule | Mon 08:00 (weekly) | Dependabot is the primary path; this is a belt-and-suspenders weekly sweep. |
-
-## Why no daily jobs
-
-We reviewed every workflow with maintainer Sebastien Rousseau on
-2026-05-12 and concluded:
-
-1. **No external signal needs daily polling.** Dependency updates flow
-   through Dependabot (push-driven, not poll-driven). Beta-tool
-   detection in `nightly.yml` checks for major Chezmoi / ShellCheck
-   updates — these ship every few months, not days. CVE scans run on
-   every PR (`sbom-diff.yml`) plus a weekly aggregate
-   (`security-enhanced.yml`).
-
-2. **No downstream consumer reads daily artifacts.** No external
-   dashboard, no published feed, no alert ingester depends on a daily
-   nightly artifact. The artifacts are inspected ad-hoc.
-
-3. **Daily cadence was vestigial.** `nightly.yml` had cron `0 2 * * *`
-   from an earlier era when the workflow ran the full test matrix; the
-   matrix has since moved into `ci-enforced.yml` (event-driven), but
-   the cron was never updated. Confirmed via `git log` of the file.
-
-If any of these conditions changes (e.g., we add a publishing pipeline
-that needs daily artifacts), the appropriate path is a new `daily-checks.yml`
-workflow with explicit cadence rationale documented here — *not* flipping
-an existing weekly back to daily.
-
-## Cost impact of the daily → weekly flip
-
-Before (daily nightly):
-
-- 7 runs/week × ~40 min total CI minutes per run = **~280 min/week**
-- ~14,560 minutes/year (~243 hours of CI compute)
-
-After (weekly nightly):
-
-- 1 run/week × ~40 min = **~40 min/week**
-- ~2,080 minutes/year (~35 hours)
-
-**Net saving: ~208 hours of CI compute per year (~85% reduction)** on
-the nightly workflow alone. GitHub-hosted minutes are billed per
-runner-minute; saving aligns with the project's "zero-debt, no waste"
-mandate.
-
-## Reviewing this page
-
-When adding a new workflow:
-
-1. Pick a bucket from the rules at the top of this page.
-2. Add the row to the table — include the **why**, not just the cron
-   expression. Future maintainers should be able to decide whether a
-   cadence is still load-bearing.
-3. If proposing a daily cadence, justify why a weekly version doesn't
-   meet the need in the workflow's PR description.
-
-## References
-
-- [`nightly.yml`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/nightly.yml) — the workflow whose cadence flip triggered this page.
-- [`security-enhanced.yml`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/security-enhanced.yml) — earlier daily→weekly reduction.
-- Issue [#861](https://github.com/sebastienrousseau/dotfiles/issues/861).