feat: clean up agent config

modules/capabilities/ai.nix

@@ -33,11 +33,6 @@ in
         };
 
         features.plugins = true;
-        marketplaces.nix-managed = {
-          source_type = "local";
-          source = "${ai.marketplace}";
-        };
-        plugins."ponytail@nix-managed".enabled = true;
         hooks = ai.codexHooks;
         mcp_servers = ai.servers // {
           context7 = ai.servers.context7 // {
@@ -196,11 +191,6 @@ in
         ) ai.skills
         // {
           ".codex/AGENTS.md".text = builtins.readFile ./ai/instructions/codex.md;
-          # Codex's installed-plugin scanner skips symlinked version directories.
-          "${ai.codexCache}" = {
-            source = ai.sources.ponytail;
-            recursive = true;
-          };
         };
     };
 }

modules/capabilities/ai/README.md

@@ -1,41 +0,0 @@
-# Codex installation
-
-`ai.nix` installs binaries and Codex defaults on Polaris and Zenith.
-`_sources.nix` pins upstream assets; `_assets.nix` declares skills, MCP servers,
-the Ponytail marketplace and the upstream Herdr session hook.
-Edit `instructions/codex.md` for global Codex instructions.
-
-Nix owns installation files. Codex owns writable user settings, plugin toggles,
-trust, credentials and sessions. Bundled/service-delivered capabilities remain
-vendor-managed. Update Ponytail's revision, hash and `ponytailVersion` together.
-The cache uses real directories with linked files because Codex skips symlinked
-plugin version directories. Do not run plugin updaters on Nix-managed assets.
-
-Herdr's skill is linked directly from the same source as its binary. An agent
-can also read it with `herdr --skill`; no generated file is necessary.
-The upstream session hook supports restore, not model instruction injection.
-
-## Manual transition
-
-Close Codex before cleaning up the previous setup and activating the new one.
-No migration or compatibility code runs automatically.
-
-- Remove old standalone skills: `~/.codex/skills/ponytail`,
-  `~/.agents/skills/find-skills`, `~/.agents/skills/context7-mcp.bak`,
-  and `~/.codex/skills/nixos-maintainer.bak`.
-- Remove the old Ponytail cache `~/.codex/plugins/cache/ponytail/ponytail`.
-  Remove any unmanaged copy at `~/.codex/plugins/cache/nix-managed/ponytail/4.9.0`
-  if it blocks Home Manager activation. The obsolete managed
-  `~/.codex/plugins/ponytail` link is removed by Home Manager.
-- In `~/.codex/config.toml`, remove the old `marketplaces.ponytail` entry and
-  rename `plugins."ponytail@ponytail"` to `plugins."ponytail@nix-managed"`,
-  preserving its enabled preference. Remove user launch fields for the
-  `context7`, `nixos` and `openaiDeveloperDocs` MCP servers so system defaults
-  apply; preserve toggles and unrelated preferences.
-- Remove the old Herdr SessionStart command from `~/.codex/hooks.json` and its
-  `~/.codex/herdr-agent-state.sh` file. Preserve unrelated hooks.
-- Activate your Nix configuration, then restart Codex.
-
-If an earlier version of this work was activated, Home Manager removes its
-managed instruction and integration links for other harnesses. Unmanaged copies
-must be removed manually if no longer wanted.

modules/capabilities/ai/_assets.nix

@@ -1,8 +1,6 @@
 { pkgs }:
 let
   sources = import ./_sources.nix { inherit pkgs; };
-  json = pkgs.formats.json { };
-  ponytailVersion = "4.9.0";
   context7Headers = pkgs.writeShellScript "context7-http-headers" ''
     set -euo pipefail
     CONTEXT7_KEY_FILE="''${XDG_CONFIG_HOME:-$HOME/.config}/context7/api-key"
@@ -25,32 +23,7 @@ let
   };
 in
 {
-  inherit sources ponytailVersion context7Headers;
-  inherit codexHooks;
-  codexCache = ".codex/plugins/cache/nix-managed/ponytail/${ponytailVersion}";
-  marketplace = pkgs.runCommand "ai-marketplace" { } ''
-    mkdir -p "$out/.agents/plugins" "$out/plugins"
-    ln -s ${sources.ponytail} "$out/plugins/ponytail"
-    cp ${
-      json.generate "ai-marketplace.json" {
-        name = "nix-managed";
-        plugins = [
-          {
-            name = "ponytail";
-            source = {
-              source = "local";
-              path = "./plugins/ponytail";
-            };
-            policy = {
-              installation = "AVAILABLE";
-              authentication = "ON_INSTALL";
-            };
-            category = "Productivity";
-          }
-        ];
-      }
-    } "$out/.agents/plugins/marketplace.json"
-  '';
+  inherit context7Headers codexHooks;
   skills = {
     context7-mcp = ../skills/context7-mcp;
     nixos-maintainer = ../skills/nixos-maintainer;

modules/capabilities/ai/_sources.nix

@@ -1,10 +1,4 @@
 { pkgs }:
 {
-  ponytail = pkgs.fetchFromGitHub {
-    owner = "DietrichGebert";
-    repo = "ponytail";
-    rev = "356918eba965ee1eac64bd3a7f0dd02108350de5";
-    hash = "sha256-LPNMyHsri3+eeDmphEAKL1JgoRE4dLIPfZ4XZ+xu5UY=";
-  };
   herdr = pkgs.llm-agents.herdr.src;
 }

modules/capabilities/ai/instructions/codex.md

@@ -1,23 +1,24 @@
 # Environment
 
-- This is Nix; use `nix run` for missing commands. Default Nix commands to `--quiet`.
-- Keep output bounded. Capture large Nix listings in `/tmp`; inspect targeted excerpts and failing logs only. Locate store files before reading them.
+- Use `nix run` for missing commands and `--quiet` for Nix commands.
+- Capture large Nix listings in `/tmp`; read targeted excerpts and failure logs. Locate store files before reading them.
 - Manage persistent binaries, skills, plugins and MCP definitions in `/home/kiri/.config/nixos`. Keep interactive settings, credentials and session state outside Nix.
-- `HERDR_ENV=1` means you are inside Herdr. Read the Herdr skill or run `herdr --skill` when Herdr interaction is needed.
 
 # Work
 
-- Inspect relevant code and callers; follow project conventions and fix root causes.
-- Prefer existing code, standard libraries and native capabilities. Avoid speculative abstractions; optimize conceptual simplicity, not line count.
-- Keep changes focused. Prefer clean breaking changes over compatibility layers or migration scripts; explain required manual steps.
-- Use targeted reads and tool calls. Verify unfamiliar or consequential APIs against version-appropriate primary documentation; prefer Context7 when needed.
-- In reviews, distinguish confirmed problems from optional improvements and explain meaningful tradeoffs.
+- Complete authorized work without repeated confirmation. Make reasonable assumptions for routine choices; ask about consequential unknowns while continuing independent work.
+- Prefer existing capabilities and simple solutions. Add abstractions or compatibility code only for a concrete need; explain required manual steps.
+- Verify unfamiliar or consequential APIs against version-appropriate primary documentation; prefer Context7.
 - Never push without my explicit approval. Other remote actions must remain within the authorized task.
 - User instructions take precedence over skill guidelines, including testing defaults.
 
 # Validation
 
-Do not add or run tests unless explicitly requested or necessary to resolve a
-concrete correctness concern. Use the smallest relevant validation and stop once
-it provides sufficient confidence. Avoid broad suites and repeated builds without
-a specific reason. Report only checks actually performed.
+- Write or run automated tests only when explicitly requested or covered by the repository's established testing policy. Do not invent a testing policy or introduce tests into a repository without tests unless explicitly requested.
+- Validate changes with the smallest relevant build, manual behaviour check, or review of code and output.
+- Broaden or repeat validation only for changes, failures or unresolved concerns. Report only checks performed.
+
+# Writing
+
+- Lead with the result. Write concisely in plain language, preserving important reasoning, evidence and limitations.
+- Omit repetition and stock phrases. Use lists when they improve readability.