Final review (opus) found a Critical bug (jupiter's nixosConfigurations
stopped evaluating because hermes-agent.nixosModules.default was wired
through machines/configuration.nix's mibook-only module list, while
the profile module itself is loaded on both machines) plus three
Important gaps: secrets persist to /var/lib/hermes/.hermes/.env, not
/run/secrets; Telegram/Email need explicit ALLOWED_USERS or they're
wide open / silently drop messages; addToSystemPackages's CLI needs
group membership finn didn't have. All four corrected in the docs
here; the actual code fix is a separate dispatched task.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S
Task 1's implementer found sops.validateSopsFiles makes secret-key
existence a build-time check (via manifest.json.drv), not an
activation-time one as the plan assumed. Corrects Step 10 to reflect
reality rather than leave future readers misled.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S
Task 1 is agent-executable repo wiring (flake input, profile module,
secret declaration), build-checked with nix build. Tasks 2-5 are an
operator-run runbook: OAuth login, Anthropic billing check, Telegram
bot setup, and typing real secrets into $EDITOR via sops - none of
that is meant to pass through an agent session.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S
Locks in host (mibook, not jupiter), deployment mode (NixOS native
module), and auth (claude setup-token / ANTHROPIC_TOKEN, Max extra
credits) after a grilling round. Builds on feat/sops-nix as-is.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S
Back out the entire "choose terminal-only vs KDE at boot" work. The first
attempt (default multi-user.target + on-demand desktop) locked mibook out —
it is WiFi-only with credentials in KWallet, so a headless boot has no
network and no SSH. The follow-up specialisation redesign is no longer
wanted either.
mibook returns to plain always-KDE boot (the pre-feature baseline):
- machines/mibook/configuration.nix: drop specialisation.terminal and the
NetworkManager-wait-online override.
- machines/mibook/environments.nix: drop kde-desktop.startOnBoot.
- modules/environments/kde-desktop/default.nix: drop the startOnBoot option.
- remove the boot-desktop-choice design spec.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1wvPy5kbGp8pUQX61WBCY
Jupiter's Intel iGPU is configured at the OS level but Jellyfin has no
access to it, so transcodes run on CPU only and stutter.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The HA Companion app needs an external_url for clickable notification
deep-links to resolve when the phone is off the home Wi-Fi. Reach is via
Tailscale (Headscale tailnet solar.internal), so external_url points at
the FQDN jupiter.solar.internal:8123; internal_url stays on the bare
hostname for LAN-attached devices.
Phase A only: device registration + notify group + smoke-test land in a
follow-up commit once Companion has registered real mobile_app_<slug>
service names. See docs/superpowers/specs/2026-05-18-ha-push-notifications.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The original plan claimed no flake-level changes were needed because
machines/configuration.nix:21 already passes `_module.args.self = self;`.
That's only true for `config`-time evaluation; `imports` are collected
before `config` is available, so referencing `self` in `imports` causes
infinite recursion. Fix: promote `self` to `specialArgs` on each
nixosSystem call. The implementer of Task 2 caught this on first
dispatch.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Task-by-task plan covering: revert of prior ZHA commit, unstable
OTBR module import, OTBR enablement against the ZBT-2, firmware
flash via universal-silabs-flasher, rebuild on jupiter, and
end-to-end smoke test through the HA UI.
Designed for execution via superpowers:subagent-driven-development
or superpowers:executing-plans, with operator handoffs marked
explicitly (per the 'no SSH' workflow rule).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Captures the architecture, operator workflow, and verification for
running the Connect ZBT-2 as an OpenThread Border Router on jupiter
(via nixos-unstable's services.openthread-border-router module),
with HA's otbr + thread integrations driving the Thread network
and the existing matter-server consuming credentials for
Matter-over-Thread device commissioning.
Supersedes the ZHA-direction commit on this branch (e8d09f4),
which will be reverted at the start of implementation.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
