dotfiles

The bootstrap takes a bare macOS installation through Xcode tools, Homebrew, 1Password, GitHub authentication, Oh My Zsh, package installation, and the first chezmoi apply. It pauses at the authentication boundaries that should remain interactive instead of pretending credentials can be automated safely.

After that first run, the repository becomes the source of truth. An ordinary chezmoi apply renders configuration and reruns only the lifecycle automation whose declared inputs changed.

Templates contain 1Password references rather than resolved tokens, passwords, host addresses, or private keys. Chezmoi renders those values only on the destination machine, while the 1Password SSH agent supplies private keys without copying key material into the repository.

A self-healing Git hook installs and wires gitleaks, then scans staged changes with redacted output. Chezmoi's private source attributes control destination permissions; they are not mistaken for secrecy in a public Git repository.

Run-on-change scripts converge the parts of a workstation that cannot be represented by copying files. Homebrew metadata updates run every 12 hours through a command-scoped trust grant, while package and application upgrades remain a deliberate manual action.

Other scripts render Ollama settings into a per-user LaunchAgent, remove conflicting Tailscale installations, synchronize Ghostty's resolved palette into Yazi, and pin global command-line tools from structured data. Each automation path owns both its desired state and the repair logic for stale machine state.

The Neovim configuration now lives directly in chezmoi alongside its LSP, formatting, navigation, Yazi, and Claude Code integrations. A custom `:Tail` command follows external file changes inside a normal editable buffer using libuv file events with a polling recovery path.

The implementation preserves a scrolled-up cursor, refuses to clobber unsaved edits, rearms after atomic rename or delete-and-recreate rotation, cleans up its handles, and disables itself above a size ceiling. A headless adversarial suite and recovery suite currently pass 43 checks; a seeded property fuzzer then mixes 900 file, buffer, cursor, and watcher operations while asserting invariants after every step.