v1.3.0

Everything below is new since v1.2.0.

Profiles: minimal / developer / custom

setup.sh (and the bootstrap one-liner) now asks once which profile to converge to:

• minimal — core only: a working shell, git, tmux, and the dotf CLI
• developer — everything (the historical behavior; also the non-interactive default)
• custom — core + groups you pick, expanded through dependency closure (picking nvim also pulls in build + node); the interactive picker shows each group's contents and dependencies

Groups: ergonomics (ripgrep, fd, fzf, bat, eza, delta, zoxide, btop, direnv, just, thefuck, shellcheck, gh, yazi, lazygit, imagemagick, poppler-utils) · build · services (Docker, postgres/redis clients) · nvim · node · rust · go-tools · python · ai-clis (claude, opencode, codex, rtk) · cloud (AWS CLI v2). Toolchain dependencies follow automatically (ergonomics → rust, go-tools · nvim → build, node · ai-clis → node, rust · rust → build).

The choice is saved to ~/.config/dotf/profile (parsed, never sourced — state-file content can never execute). Every manifest is now group-sectioned (## group: <name> headers, guard-enforced), and apply.sh / install-tools.sh / installers.sh / doctor.sh gate apt, stow, runtimes, curl installers, and the docker service by the active groups. Skipped groups are logged explicitly, so a minimal run reads as exactly what it did.

New dotf subcommands

• dotf profile — re-select profile/groups, then converge (reports newly-orphaned stow packages, never removes them)
• dotf skills — optional AI skill frameworks, installed user-globally and unattended-safe: SuperClaude, Superpowers (obra), mattpocock/skills, Graphify, Callstack react-devtools + agent-skills

Bootstrap: optional new-user creation

bootstrap.sh can create a fresh sudo user and hand the whole install off to it: hardened authorized_keys copy (install, never cp; refuses symlinked .ssh), one-shot guarded re-exec in the new user's home, prompts on /dev/tty with a reliable open-probe for non-interactive detection. The fresh-machine one-liner is unchanged.

Minimal keeps a working shell

Optional-tool zsh aliases and EDITOR are command -v-guarded, and the delta/nvim git config moved to a new git-dev stow package (ergonomics), included by core ~/.gitconfig only when present — so a minimal machine never has aliases pointing at absent binaries.

Verification

Field-tested end-to-end on fresh Ubuntu 24.04 EC2 (minimal and developer, with the new-user step). Guard test passes under bash 3.2 and 5.x; tests/profile-lib-test.bash (40+ checks) wired into the guard.