feat(hermes): boxed Hermes stack — 2012 MBP containerized agent + ledger MCP broker

.secretscanignore

@@ -0,0 +1,6 @@
+# Allowlist for tools/githooks/pre-push. One extended regex per line.
+# Matched against "path:added-line". Keep entries NARROW — a broad rule here
+# is how the next account number gets through.
+#
+# Cheatsheets are wall-to-wall example values (unix timestamps, fake IDs).
+^tools/cheat/cheatsheets/

CLAUDE.md

@@ -102,39 +102,21 @@ Specific changes:
 dotfiles/
 ├── darwin/                 # nix-darwin (macOS system config)
 │   ├── configuration.nix   # Shared darwin config
-│   ├── modules/
-│   │   └── homebrew.nix    # Homebrew taps/casks/brews
 │   └── profiles/           # Machine-specific configs
-│       └── ditto.nix       # Work machine (the only darwinConfiguration)
+│       ├── alyssa.nix      # Personal machine
+│       └── ditto.nix       # Work machine
 ├── home-manager/           # User-level configuration
 │   ├── modules/
-│   │   ├── common.nix      # Shared across all profiles (no GUI)
-│   │   ├── git.nix
-│   │   ├── dev/            # Language tooling modules
+│   │   ├── common.nix      # Shared across all profiles
+│   │   ├── dev/            # Development tool modules
 │   │   │   ├── nix-lang.nix
 │   │   │   └── rust.nix
-│   │   ├── ide/            # IDE configurations
-│   │   │   ├── vscode.nix
-│   │   │   └── vscode-profiles/  # base, jujutsu, rust
-│   │   └── tools/          # cheat, helix, gh-dash, agents,
-│   │       │               #   agent-skills, claude-code
-│   │       └── ...
+│   │   └── ide/            # IDE configurations
+│   │       └── vscode/
 │   └── profiles/           # User profiles
-│       ├── code.nix        # macOS "code" user
-│       ├── dev.nix         # Devcontainer / codespaces profile
+│       ├── dev.nix         # Devcontainer profile
 │       ├── home.nix        # Personal profile
 │       └── work.nix        # Work profile
-├── lib/
-│   └── core-packages.nix   # Packages shared by devShells + home-manager
-├── tools/                  # Non-Nix tool content wired in by modules/tools/*
-│   ├── agents/             # Agent-instruction overlay (AGENTS.md, #40)
-│   ├── cheat/              # Cheatsheets + cheatpath config
-│   ├── claude/             # Claude rules
-│   └── helix/              # Helix config
-├── secrets/                # agenix/ragenix age-encrypted secrets
-├── docker/                 # 2012 MBP container notes + entrypoint
-├── Dockerfile              # x86_64 dev image
-├── justfile                # Task Runner recipes
 └── flake.nix               # Flake configuration
 ```
 
@@ -175,26 +157,11 @@ dotfiles/
 - Opt-in via profile imports
 - Keep focused and composable
 
-**Tool modules** (`home-manager/modules/tools/*`):
-- Wire non-Nix tool *content* from the top-level `tools/` directory into the
-  home (cheat cheatsheets, helix config, the agent-instruction overlay, etc.)
-- Keeps editable plaintext config in `tools/` while the module handles
-  installation, symlinks, and activation
-
 **Profile-specific** (`home-manager/profiles/*.nix`):
 - Machine or context-specific packages
 - Import relevant modules
 - Keep minimal - prefer modules
 
-### Shared package lists (`lib/core-packages.nix`)
-
-`lib/core-packages.nix` is a single `pkgs: [ ... ]` list imported by **both**
-the flake's devShells and home-manager. This is deliberate: the ephemeral
-`nix develop` shell and the persistent home-manager environment install the
-same core CLI tools, so `cheat`, `jj`, `just`, `gh`, etc. behave identically
-whether you're in a throwaway shell or a switched profile. Add a
-universally-needed CLI tool here rather than duplicating it in both places.
-
 ### Configuration Conflicts to Avoid
 
 1. **Overlays**: Set `nixpkgs.overlays` ONLY at darwin system level, not in home-manager modules
@@ -315,4 +282,4 @@ This document should evolve as patterns emerge. When you:
 
 ---
 
-*Last updated: 2026-07-28 - Synced Repository Structure with reality (lib/, tools/, secrets/, docker/, modules/tools/) and documented the shared `lib/core-packages.nix` pattern*
+*Last updated: 2026-04-17 - Added CI checks section documenting statix/deadnix rules after empty_pattern failure in PR #20*

README.md

@@ -4,36 +4,25 @@ These are my dotfiles, managed by [Nix](https://nixos.org/), [Nix-Darwin](https:
 
 ```
 dotfiles/
-├── darwin/                 # nix-darwin (macOS system config)
-|   ├── modules/
-|   |   └── homebrew.nix
+├── darwin/
 |   ├── profiles/
+|   |   ├── alyssa.nix
 |   |   └── ditto.nix
 |   └── configuration.nix
 ├── home-manager/
 |   ├── modules/
-|   |   ├── dev/            # language tooling (nix-lang, rust)
-|   |   ├── ide/vscode*     # extensions & settings
-|   |   ├── tools/          # cheat, helix, gh-dash, agents, claude-code
-|   |   ├── common.nix      # shared CLI tools (no GUI)
-|   |   └── git.nix
-|   └── profiles/           # code, dev (devcontainer), home, work
-├── lib/
-|   └── core-packages.nix   # packages shared by devShells + home-manager
-├── tools/                  # non-Nix tool content
-|   ├── agents/             # agent-instruction overlay (AGENTS.md, ...)
-|   ├── cheat/              # cheatsheets + cheatpath config
-|   ├── claude/             # Claude rules
-|   └── helix/              # helix config
-├── secrets/                # agenix/ragenix encrypted secrets
-├── docker/                 # 2012 MBP container notes + entrypoint
-├── Dockerfile              # x86_64 dev image
-├── .devcontainer.json      # Nix Package Manager
-├── .gitignore              # Nix artifacts
+|   |   ├── ide/vscode  # extensions & settings
+|   |   └── common.nix
+|   └── profiles/
+|       ├── dev.nix     # for devcontainers
+|       ├── home.nix
+|       └── work.nix
+├── .devcontainer.json  # Nix Package Manager
+├── .gitignore          # Nix artifacts
 ├── flake.lock
-├── flake.nix               # Home Manager + darwin config
-├── justfile                # Task Runner recipes
-└── README.md
+├── flake.nix           # Home Manager config
+├── justfile            # Task Runner recipes
+└── README.md           
 ```
 
 ### Quickstart
@@ -136,10 +125,6 @@ As long as you have docker or an [ephemeral environment in the cloud](https://ep
 |-----------|------|---------|
 | `darwin/` | nix-darwin | macOS system config (dock, defaults, homebrew)
 | `home-manager/` | Home Manager | User packages and dotfiles (cross-platform)
-| `lib/` | Nix | `core-packages.nix`, imported by both devShells and home-manager so ephemeral `nix develop` and persistent profiles stay consistent
-| `tools/` | (plain files) | Non-Nix tool content wired in by modules: `agents/` instruction overlay, `cheat/` cheatsheets, `claude/` rules, `helix/` config
-| `secrets/` | agenix/ragenix | age-encrypted secrets (git config, private agent overlay)
-| `docker/` + `Dockerfile` | Docker | x86_64 dev image for a frozen 2012 MacBook Pro (see `docker/CLAUDE.md`)
 
 This keeps package management declarative and reproducible across environments.
 

home-manager/profiles/home.nix

@@ -4,7 +4,6 @@
 {
   imports = [
     ../modules/ide/vscode.nix
-    ../modules/tools/agent-skills.nix
   ];
 
   home = {

home-manager/profiles/work.nix

@@ -5,7 +5,6 @@
   imports = [
     ../modules/ide/vscode.nix
     ../modules/dev/rust.nix
-    ../modules/tools/agent-skills.nix
   ];
 
   home = {

lib/core-packages.nix

@@ -3,7 +3,6 @@
 pkgs: with pkgs; [
   asciinema
   bat
-  eza
   ripgrep
   jujutsu
   just