cleanup

AGENTS.md

@@ -11,12 +11,10 @@ and maintenance entry points. Global instructions remain applicable.
   environment, or access live company systems with write authority. Test writes need
   task-specific authority. Moving credentials or synchronizing company content
   requires agreement; ordinary repository work does not authorize either.
-- Follow the user's testing policy: automated tests only when explicitly requested
+- Do not write or run tests or perform extensive validation unless explicitly
-  or covered by an established repository policy. A test file alone does not establish
+  requested. For routine changes, use a focused review or small manual check.
-  a general policy. Use the smallest relevant review, build, or manual check.
+- Run `just validate` only when explicitly requested. Read its short result first;
-- Use `just validate` for a completed configuration batch, or name affected hosts
+  inspect saved logs only for failures or a concrete unresolved concern.
-  for iteration. Read the short result first; inspect saved logs only for failures
-  or a concrete unresolved concern. Documentation-only edits need no system build.
 - Replace superseded state in `docs/current-work.md`; keep durable rationale in
   `docs/design.md` and operational detail beside its owner. Use Git for chronology.
   Remove temporary state when it no longer serves a purpose.

README.md

@@ -55,9 +55,9 @@ directory. Failure stops the command; snapshots are removed on exit. It neither
 updates inputs nor creates result links or activates systems. The implementation is
 `scripts/validate.py`; `just` and Python are installed on both workstations.
 
-Use targeted hosts during iteration and full validation for a completed batch.
+Run targeted host builds or full validation only when explicitly requested. Routine
-Documentation-only changes need review and `git diff --check`, not system builds.
+changes need a focused review or small manual check. Build, activation and
-Build, activation and interactive behavior are separate evidence.
+interactive behavior are separate evidence.
 
 User-owned activation:
 
@@ -76,8 +76,8 @@ provisioning is documented with workbench. Never put plaintext secrets in Nix.
 - **Orientation:** Super+Shift+N names the focused workspace; submit an empty name
   to clear it. Named empty workspaces persist until cleared. Noctalia shows labels;
   terminal titles include the working directory and command.
-- **Icons/vault:** check Oil from Walker and Nautilus device/symbolic icons. Walker's
+- **Icons/vault:** check Oil from Walker and Nautilus device/symbolic icons. Check
-  `?` vault provider should request unlocking on use, never during desktop startup.
+  Walker's `?` vault provider; upstream Elephant may query `rbw` during startup.
 - **Calendar:** in Noctalia Settings → Services → Calendar, set the Radicale
   password through the existing Personal account (GNOME Keyring). Add an ICS account
   named Work using Outlook's published URL. Keep this URL in writable Noctalia

docs/current-work.md

@@ -10,6 +10,7 @@ Complete independent agreed work and obvious fixes autonomously. Leave consequen
 unknowns pending and collect recommendations/alternatives into one substantial review
 batch. Ask earlier only to prevent broad rework/blockage. The old 2–4-question quota
 is superseded. Keep effort focused; no speculative systems or peripheral research.
+Do not write or run tests or perform extensive validation unless explicitly requested.
 Do not activate, push, decrypt for discovery or access company systems with write
 authority. No subagents unless explicitly authorized by current instructions.
 
@@ -31,7 +32,7 @@ The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorizati
   Noctalia labels; shell titles include directory/command. Garden shell initialization
   now belongs to company integration instead of every host's generic shell.
 - Kanagawa declares Adwaita/hicolor icon fallback; modest Limine branding/layout.
-  A pinned Elephant patch defers its startup `rbw list` to the explicit vault query.
+  Walker uses upstream Elephant without a local vault patch. It may query `rbw` at startup.
 - GitHub devenv 2.3.2 installed with native Zsh hook and upstream reload defaults.
   CLI dependencies keep upstream pins/cache; workbench tools use this repository's
   exact nixpkgs pin. Company tools are also installed through the work profile. Product and
@@ -87,8 +88,8 @@ Final full validation passed before the final review deletions:
 `/tmp/nixos-validate-t7zv1zux` (session 88912,
 completed exit 0). Formatting, devenv preparation, flake check, all three host
 builds (Orion, Polaris, Zenith), and the tools-only workbench build passed.
-This includes the final notes startup ordering, serialized vault-query patch,
+This includes the final notes startup ordering, FUSE wrapper paths, native Zsh retry
-FUSE wrapper paths, native Zsh retry function and SecretSpec package collision fix.
+function and SecretSpec package collision fix. The vault patch was removed afterward.
 No systems were activated.
 
 Native devenv tools-only startup also passed in an isolated temporary home:
@@ -101,9 +102,9 @@ Evidence: `/tmp/foundation-editor-check/{startup,notes}.log`. No real notebook o
 credentials loaded. Built Kanagawa index declares `Inherits=Adwaita,hicolor`.
 Python source syntax and local documentation links checked; no automated tests added.
 
-The final review only removed the unaccepted Kubernetes login wrapper and the
+The earlier final review removed the unaccepted Kubernetes login wrapper and the
 machine-wide devenv cache setting; the flake-scoped cache remains. Full builds were
-not repeated for those deletions.
+not repeated for those deletions. The later Walker patch removal has not been built.
 
 Builds do not establish interactive acceptance. The user checkpoint remains; do not
 repeat full builds for documentation-only handoff edits.
@@ -118,12 +119,10 @@ concrete role: in-memory concurrent secret loading with completeness checks, one
 encrypted credential reshaping, dynamic OBS rclone configuration, or pre-existing
 dictation/transcription behavior.
 
-The user checkpoint is still required before this pass is complete. No implementation
+The user checkpoint is still required before this pass is complete. The implementation
-commit was made in this turn.
+was committed as `5748b34` after the initial foundation commit `f164d8b`. Later
-
+cleanup removed the Walker patch, Handy test and AI capability README.
-Initial local commit `f164d8b` predates this implementation. Four documentation files
+No activation was recorded during that pass. External workbench analysis/content
-were already modified during the design pass; those changes belong to this effort.
-No remote changes or activation have occurred. External workbench analysis/content
 changes are unrelated and must not be committed here. Previous external loader
 copies remain at `/tmp/workbench-environment-before-6k4dwzuo`; only root/workbench environment documentation and ignore entries were updated.
 Backups: `/tmp/foundation-workbench-docs-bvrs1hu9`. Old external loaders remain

docs/design.md

@@ -52,8 +52,8 @@ Use store-qualified executables or `runtimeInputs` in packaged scripts; make run
 paths and failures explicit. Do not duplicate package lists, generated settings or
 binding references in documentation.
 
-These clarify the agreed model; they are not a one-package-per-file rule, a new
+These clarify the agreed model; they are not a one-package-per-file rule or a
-testing policy, or a requirement for additional abstractions.
+requirement for additional abstractions.
 
 ## Daily environment
 
@@ -74,9 +74,9 @@ Notes stay in `~/sync/notes`, mostly meeting material; no new taxonomy. HTTP and
 database targets remain independently selected and visibly named. Dadbod working
 queries and connection state stay outside Git; see the editor's `database.lua`.
 
-Kanagawa remains the theme with Adwaita fallback icons. rbw unlocks on requested
+Kanagawa remains the theme with Adwaita fallback icons. Walker uses upstream Elephant
-vault access, preserving its lock policy. Outlook PWA owns work email/calendar
+without a local vault patch; it may query rbw during startup. Outlook PWA owns work
-editing. Mailspring owns personal mail; Thunderbird remains a backup. Noctalia
+email/calendar editing. Mailspring owns personal mail; Thunderbird remains a backup. Noctalia
 provides the combined read-only Radicale/Outlook agenda. The user accepts published
 ICS link access and supplies the URL privately through runtime settings. Personal
 calendar editing stays on the phone; keep khal/todoman.
@@ -118,11 +118,11 @@ validation feedback to repeated reminders. This applies the useful principle of
 progressive disclosure from [OpenAI's harness engineering article](https://openai.com/index/harness-engineering/)
 without introducing speculative skills, orchestration or evaluation infrastructure.
 
-`just validate` includes working-tree changes and new nonignored files without staging,
+`just validate` is available on explicit request. It includes working-tree changes
-formats, evaluates and builds. Concise results and saved logs minimize agent overhead.
+and new nonignored files without staging, formats, evaluates and builds. Targeted
-Targeted host builds support iteration; a full run also builds workbench tools.
+host builds are supported; a full run also builds workbench tools. Builds do not
-Builds do not prove activation or interactive behavior. Preserve the user's testing
+prove activation or interactive behavior. Do not write or run tests or perform
-policy; this pass does not create a new automated testing policy.
+extensive validation unless explicitly requested.
 
 Keep native update and activation commands. `nix flake update` is normal; selective
 updates (often `llm-agents`) are appropriate while nixpkgs breakage awaits repair.

modules/capabilities/ai/README.md

@@ -1,14 +0,0 @@
-# AI tools
-
-Nix installs the tools, assets, skills and system Codex defaults. Codex owns its
-writable user configuration; credentials, session history and other runtime state
-remain outside this repository. `instructions/codex.md` owns global agent guidance.
-
-Herdr is optional experimentation. Reload its managed configuration with
-Ctrl+Alt+Shift+R (or Ctrl+B then Shift+R); its configuration owns the binding reference.
-Home Manager may preserve an earlier regular configuration file with `.bak`.
-
-Ollama supplies `nomic-embed-text` for grounded-docs. The latter runs on localhost
-port 6280 with persistent Podman volumes. Removing another tool must not delete
-these models or volumes. No mandatory agent persistence or orchestration workflow
-is defined here.

modules/capabilities/ai/instructions/codex.md

@@ -14,9 +14,8 @@
 
 # Validation
 
-- Write or run automated tests only when explicitly requested or covered by the repository's established testing policy. Do not invent a testing policy or introduce tests into a repository without tests unless explicitly requested.
+- Do not write or run tests or perform extensive validation unless explicitly requested.
-- Validate changes with the smallest relevant build, manual behaviour check, or review of code and output.
+- For routine changes, use a focused review or small manual check. Report only checks performed.
-- Broaden or repeat validation only for changes, failures or unresolved concerns. Report only checks performed.
 
 # Writing
 

modules/capabilities/handy/push_to_talk_test.py

@@ -1,37 +0,0 @@
-"""Synthetic key-state checks; never reads a keyboard or records audio."""
-
-from unittest.mock import Mock, patch
-
-import push_to_talk as ptt
-
-down = [ptt.key.KEY_LEFTMETA, ptt.key.KEY_D]
-
-
-def check(states, expected, error=None):
-    device = Mock()
-    device.active_keys.side_effect = states
-    device.read_loop.return_value = iter([object(), object()])
-    if error:
-        device.read_loop.side_effect = error
-    with (
-        patch.object(ptt, "list_devices", return_value=["keyboard"]),
-        patch.object(ptt, "InputDevice", return_value=device),
-        patch.object(ptt.signal, "signal"),
-        patch.object(ptt.subprocess, "run") as run,
-    ):
-        try:
-            ptt.main("handy")
-        except (OSError, KeyboardInterrupt):
-            assert error is not None
-        assert [call.args[0][1] for call in run.call_args_list] == expected
-    device.close.assert_called_once()
-
-
-check([[]], [])  # Released before the listener starts: do not record.
-check([down, []], ["--toggle-transcription", "--toggle-transcription"])
-check([down, down, down, [ptt.key.KEY_D]], ["--toggle-transcription"] * 2)
-check([down, down], ["--toggle-transcription", "--cancel"], OSError("unplugged"))
-check([down, down], ["--toggle-transcription", "--cancel"], KeyboardInterrupt())
-assert ptt.held([ptt.key.KEY_RIGHTMETA, ptt.key.KEY_D])
-assert not ptt.held([ptt.key.KEY_LEFTMETA])
-print("Push-to-talk release, repeat, disconnect and cancellation checks passed")

modules/capabilities/walker/default.nix

@@ -23,16 +23,6 @@
       ...
     }:
     let
-      elephantPackages = inputs.walker.inputs.elephant.packages.${pkgs.stdenv.hostPlatform.system};
-      # Upstream initializes rbw at startup. Drop this patch when it supports lazy vault access.
-      providers = elephantPackages.elephant-providers.overrideAttrs (old: {
-        patches = (old.patches or [ ]) ++ [ ./demand-driven-vault.patch ];
-      });
-      elephant = elephantPackages.elephant-with-providers.overrideAttrs (old: {
-        installPhase =
-          builtins.replaceStrings [ "${elephantPackages.elephant-providers}" ] [ "${providers}" ]
-            old.installPhase;
-      });
       walkerDefaults = builtins.fromTOML (builtins.readFile "${inputs.walker}/resources/config.toml");
 
       launcher = pkgs.writeShellApplication {
@@ -46,8 +36,6 @@
     {
       imports = [ inputs.walker.homeManagerModules.default ];
 
-      programs.elephant.package = elephant;
-
       desktop.commands.launcher = [ (lib.getExe launcher) ];
       programs.walker = {
         enable = true;

modules/capabilities/walker/demand-driven-vault.patch

@@ -1,55 +0,0 @@
---- a/internal/providers/bitwarden/setup.go
-+++ b/internal/providers/bitwarden/setup.go
-@@ -34,7 +34,7 @@
- func Setup() {
- 	LoadConfig()
- 
--	initItems()
-+	// Vault access is initiated by an explicit query, never daemon startup.
- }
- 
- func LoadConfig() {
---- a/internal/providers/bitwarden/query.go
-+++ b/internal/providers/bitwarden/query.go
-@@ -7,6 +7,7 @@
- 	"net"
- 	"os/exec"
- 	"strings"
-+	"sync"
- 	"time"
- 
- 	"github.com/abenz1267/elephant/v2/pkg/common"
-@@ -20,7 +21,24 @@
- 	Folder string `json:"folder"`
- }
- 
-+var itemsMu sync.Mutex
-+
- func initItems() {
-+	itemsMu.Lock()
-+	defer itemsMu.Unlock()
-+	initItemsLocked()
-+}
-+
-+func items() []RbwItem {
-+	itemsMu.Lock()
-+	defer itemsMu.Unlock()
-+	if cachedItems == nil {
-+		initItemsLocked()
-+	}
-+	return cachedItems
-+}
-+
-+func initItemsLocked() {
- 	cachedItems = nil
- 	cmd := exec.Command("rbw", "list", "--raw")
- 	output, err := cmd.CombinedOutput()
-@@ -40,7 +58,7 @@
- 
- 	entries := []*pb.QueryResponse_Item{}
- 
--	for k, v := range cachedItems {
-+	for k, v := range items() {
- 		var subtexts []string
- 		actions := []string{ActionCopyPassword, ActionCopyTotp, ActionSyncVault}
- 		if config.AutoTypeSupport {