Operations

The justfile derives CONFIG from $USER and the host architecture, then runs the matching Home Manager output.

Command	Effect
just switch	Build and activate the current platform configuration using scripts/local-flake.sh.
just build	Build the activation package without switching.
just generations	List Home Manager generations.
just show	Display flake outputs.
just update	Update all flake inputs and flake.lock.
just test	Run the Python test suite with the same shell utilities used by CI.
just nix-proxy	Configure Nix daemon proxy routing on macOS; requires sudo.

A normal change is made in an app module or shared Nix/Python helper, checked with just test and just build, then applied with just switch. CI builds Linux and macOS targets and runs lint/tests.

Configuration Boundaries

Nix owns packages, shell setup, launch agents, app placement, and declared configuration keys. apps/codex and apps/claude-code seed writable settings and reset only managed keys; trust decisions, plugin toggles, conversations, and other user-owned values remain local. Pi settings are merged similarly.

The shell is managed, while machine-local shell additions belong in an untracked ~/.zshrc-local. Git identity remains hand-written because include paths are checkout-specific. asdf manages pinned Go, Node, Java, and Maven versions; Python comes from Nixpkgs. On macOS, Colima provides the Docker VM and the Nix daemon can route uncached downloads through Clash.