feat(home-assistant): add alexa_media_player custom component

Package the Alexa Media Player HACS component declaratively (v5.15.7),
so HA can drive the Echo devices (TTS/announce, media, sensors). Needs
dictor 0.1.12 (absent from nixpkgs) and an alexapy 1.29.22 -> 1.29.25
bump to satisfy the manifest's exact requirement pins; both build
against HA's interpreter. Config-flow based: add via the HA UI and sign
in with the Amazon account after rebuild.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RCn8YgGQMGpauatdeTdQYf

docs/superpowers/plans/2026-07-05-ntfy-module.md

@@ -1,269 +0,0 @@
-# ntfy Notification Module Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add a `my.profiles.ntfy` NixOS module that runs an auth-required self-hosted ntfy server on jupiter, exposes a homepage tile, and wires a Home Assistant `rest_command` for publishing notifications.
-
-**Architecture:** A single profile module under `modules/environments/ntfy/`, following the repo's `my.profiles.<name>` pattern. It configures `services.ntfy-sh` with `auth-default-access = deny-all`, opens the firewall, registers a homepage tile, and — when the home-assistant profile is enabled — merges a `rest_command.ntfy_send` into `services.home-assistant.config`. No secrets touch the Nix store; credentials are provisioned manually by the operator, and the only secret lives in HA's `secrets.yaml`.
-
-**Tech Stack:** Nix (flake-parts NixOS config), nixpkgs `services.ntfy-sh`, `services.home-assistant`, nixfmt-rfc-style.
-
-## Global Constraints
-
-- Follow the profile pattern exactly: `let cfg = config.my.profiles.<name>; in { options.my.profiles.<name>.enable = lib.mkEnableOption "..."; config = lib.mkIf cfg.enable { ... }; }`.
-- Namespace is `my.profiles.ntfy`.
-- Homepage self-registration uses `my.homepage.services` (list of `{ group; name; description; href; icon; }`).
-- `hostName` is bound from `config.networking.hostName`, matching sibling modules.
-- All `.nix` files must be formatted with `nixfmt-rfc-style`.
-- No secret values may appear in any `.nix` file (nothing enters the Nix store). The only secret is `ntfy_password` in `/var/lib/hass/secrets.yaml`, provisioned by hand.
-- Evaluation check used throughout (runs on darwin without a Linux builder):
-  `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
-- Do NOT run `nixos-rebuild` or SSH to jupiter; deploy + provisioning are operator steps the user runs on the host.
-
----
-
-### Task 1: Create the ntfy server module (server + homepage tile)
-
-**Files:**
-- Create: `modules/environments/ntfy/default.nix`
-- Modify: `modules/environments/default.nix` (add `./ntfy` to `imports`)
-- Modify: `machines/jupiter/environments.nix` (enable the profile)
-
-**Interfaces:**
-- Consumes: `config.networking.hostName`; `services.ntfy-sh` (nixpkgs); `my.homepage.services` (repo homepage module).
-- Produces: option `my.profiles.ntfy.enable` (bool), `my.profiles.ntfy.port` (port, default 2586), `my.profiles.ntfy.topic` (str, default "ha"), `my.profiles.ntfy.haIntegration.enable` (bool, default true). Later tasks rely on `cfg.port`, `cfg.topic`, and `cfg.haIntegration.enable`.
-
-- [ ] **Step 1: Create the module file**
-
-Create `modules/environments/ntfy/default.nix`:
-
-```nix
-# self-hosted push notification server (ntfy)
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.profiles.ntfy;
-  hostName = config.networking.hostName;
-in
-{
-  options.my.profiles.ntfy = with lib; {
-    enable = mkEnableOption "ntfy notification server";
-
-    port = mkOption {
-      type = types.port;
-      default = 2586;
-      description = "HTTP port ntfy listens on.";
-    };
-
-    topic = mkOption {
-      type = types.str;
-      default = "ha";
-      description = "Topic Home Assistant publishes notifications to.";
-    };
-
-    haIntegration.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.ntfy-sh = {
-      enable = true;
-      settings = {
-        base-url = "http://${hostName}:${toString cfg.port}";
-        listen-http = ":${toString cfg.port}";
-        auth-file = "/var/lib/ntfy-sh/user.db";
-        auth-default-access = "deny-all";
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-    my.homepage.services = [
-      {
-        group = "Services";
-        name = "ntfy";
-        description = "Push notifications";
-        href = "http://${hostName}:${toString cfg.port}";
-        icon = "ntfy.svg";
-      }
-    ];
-  };
-}
-```
-
-- [ ] **Step 2: Register the module in the environments import list**
-
-In `modules/environments/default.nix`, add `./ntfy` to the `imports` list (place it near the other service modules, e.g. after `./home-assistant`):
-
-```nix
-    ./home-assistant
-    ./ntfy
-```
-
-- [ ] **Step 3: Enable the profile on jupiter**
-
-In `machines/jupiter/environments.nix`, inside the `my.profiles = { ... }` block, add:
-
-```nix
-    ntfy.enable = true;
-```
-
-- [ ] **Step 4: Format the new file**
-
-Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
-Expected: exits 0, no diff on re-run.
-
-- [ ] **Step 5: Evaluate the configuration**
-
-Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
-Expected: prints a `/nix/store/...-nixos-system-jupiter-*.drv` path with no evaluation errors. (This forces full module-system evaluation, catching option/type mistakes, without building a Linux derivation.)
-
-- [ ] **Step 6: Confirm the ntfy settings evaluate as expected**
-
-Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.ntfy-sh.settings'`
-Expected JSON includes `"auth-default-access":"deny-all"`, `"listen-http":":2586"`, and `"base-url":"http://jupiter:2586"`.
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add modules/environments/ntfy/default.nix modules/environments/default.nix machines/jupiter/environments.nix
-git commit -m "feat(ntfy): add self-hosted notification server module
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
-```
-
----
-
-### Task 2: Wire the Home Assistant rest_command
-
-**Files:**
-- Modify: `modules/environments/ntfy/default.nix` (add HA integration block)
-
-**Interfaces:**
-- Consumes: `cfg.port`, `cfg.topic`, `cfg.haIntegration.enable` (Task 1); `config.my.profiles.home-assistant.enable`; `services.home-assistant.config` (nixpkgs / repo home-assistant module).
-- Produces: `services.home-assistant.config.rest_command.ntfy_send`, callable from HA automations as `service: rest_command.ntfy_send`.
-
-- [ ] **Step 1: Add the HA integration block to the module**
-
-The module currently has a single `config = lib.mkIf cfg.enable { ... };`. Change it to merge two conditional configs with `lib.mkMerge` so the HA wiring is gated independently. Replace the `config = lib.mkIf cfg.enable { ... };` assignment with:
-
-```nix
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      services.ntfy-sh = {
-        enable = true;
-        settings = {
-          base-url = "http://${hostName}:${toString cfg.port}";
-          listen-http = ":${toString cfg.port}";
-          auth-file = "/var/lib/ntfy-sh/user.db";
-          auth-default-access = "deny-all";
-        };
-      };
-
-      networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-      my.homepage.services = [
-        {
-          group = "Services";
-          name = "ntfy";
-          description = "Push notifications";
-          href = "http://${hostName}:${toString cfg.port}";
-          icon = "ntfy.svg";
-        }
-      ];
-    })
-
-    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
-      services.home-assistant.config.rest_command.ntfy_send = {
-        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
-        method = "POST";
-        payload = "{{ message }}";
-        content_type = "text/plain";
-        username = "homeassistant";
-        password = "!secret ntfy_password";
-        headers = {
-          Title = "{{ title | default('Home Assistant') }}";
-          Priority = "{{ priority | default('default') }}";
-        };
-      };
-    })
-  ];
-```
-
-(The first `mkIf cfg.enable` block is identical to Task 1's config body — it is repeated here because the whole `config` assignment is being replaced with the `mkMerge` form.)
-
-- [ ] **Step 2: Format the file**
-
-Run: `nixfmt-rfc-style modules/environments/ntfy/default.nix`
-Expected: exits 0, no diff on re-run.
-
-- [ ] **Step 3: Evaluate the configuration**
-
-Run: `nix eval '.#nixosConfigurations.jupiter.config.system.build.toplevel.drvPath'`
-Expected: prints a `.drv` path, no evaluation errors (confirms the `rest_command` merges cleanly into the HA config the home-assistant module already defines).
-
-- [ ] **Step 4: Confirm the rest_command evaluated into HA config**
-
-Run: `nix eval --json '.#nixosConfigurations.jupiter.config.services.home-assistant.config.rest_command.ntfy_send'`
-Expected JSON includes `"url":"http://jupiter:2586/ha"`, `"username":"homeassistant"`, and `"password":"!secret ntfy_password"`.
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add modules/environments/ntfy/default.nix
-git commit -m "feat(ntfy): wire Home Assistant rest_command publisher
-
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>"
-```
-
----
-
-## Operator steps (run by the user on jupiter — not part of the agent's task loop)
-
-These require the host and manual credentials, so they are performed by the user after the branch is merged/deployed:
-
-1. Deploy: `sudo nixos-rebuild switch --flake '.#jupiter'`
-2. Create ntfy users:
-   ```bash
-   ntfy user add homeassistant            # set a password
-   ntfy access homeassistant ha write-only
-   ntfy user add --role=admin admin
-   ```
-3. Add the publisher password to Home Assistant secrets:
-   ```yaml
-   # /var/lib/hass/secrets.yaml
-   ntfy_password: <the homeassistant user's password>
-   ```
-4. Restart Home Assistant, then test from an automation / Developer Tools:
-   ```yaml
-   service: rest_command.ntfy_send
-   data:
-     message: "ntfy test"
-     title: "Home Assistant"
-     priority: high
-   ```
-5. Subscribe from the ntfy app as `admin` to receive the message.
-
----
-
-## Self-Review
-
-**Spec coverage:**
-- Module structure + options → Task 1. ✔
-- Server config (deny-all, port, firewall) → Task 1 (steps 1, 6). ✔
-- Homepage tile → Task 1. ✔
-- Registration in `default.nix` + enable on jupiter → Task 1 (steps 2–3). ✔
-- HA `rest_command` wiring, gated on HA profile, `!secret` password → Task 2. ✔
-- Manual provisioning runbook → Operator steps section. ✔
-- Verification (eval/build + nixfmt) → per-task steps. ✔
-- Out-of-scope items (no seeding, no sops, no reverse proxy) → honored; no tasks added for them. ✔
-
-**Placeholder scan:** No TBD/TODO/"handle edge cases". The one "similar to Task 1" note is accompanied by the full repeated code, per the no-placeholders rule. ✔
-
-**Type consistency:** `cfg.port`/`cfg.topic`/`cfg.haIntegration.enable` defined in Task 1 and used identically in Task 2. `rest_command.ntfy_send` name consistent across Task 2 and operator steps. Homepage tile shape matches sibling modules. ✔

docs/superpowers/plans/2026-07-26-jellyfin-hw-transcoding.md

@@ -0,0 +1,154 @@
+# Jellyfin Hardware Transcoding (jupiter) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Give jupiter's Jellyfin service access to the Intel iGPU's VAAPI render node so Quick Sync hardware transcoding can be enabled, instead of every transcode falling back to CPU.
+
+**Architecture:** One NixOS module change (`modules/environments/jellyfin/default.nix`) grants the `jellyfin` systemd service supplementary access to the `video`/`render` groups and installs `libva-utils` for verification. This is declarative and build-verifiable from the Mac. Enabling Quick Sync inside Jellyfin's own dashboard, and the on-machine verification, is a manual step run by the user on jupiter after deploy — the NixOS module has no option for it and this environment's convention is that the assistant never SSHes into jupiter directly (see `docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md`).
+
+**Tech Stack:** NixOS (flake-parts), nixpkgs `services.jellyfin` module, VAAPI/`intel-media-driver`, `libva-utils`.
+
+## Global Constraints
+
+- No SSH from the assistant into jupiter — all on-machine commands are given to the user to run and paste back.
+- Follow the existing profile pattern in `modules/environments/jellyfin/default.nix` (`config = lib.mkIf cfg.enable { ... }`); don't introduce a new toggle option — hardcode the hardware-acceleration wiring on, per the approved spec.
+- Verify locally via `nix eval` / `nix build` before asking the user to deploy.
+
+---
+
+### Task 1: Grant Jellyfin access to the iGPU and verify the build
+
+**Files:**
+- Modify: `modules/environments/jellyfin/default.nix`
+
+**Interfaces:**
+- Produces: `systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [ "video" "render" ];` — verified via `nix eval` in Step 2.
+
+- [ ] **Step 1: Add the device-access config and `libva-utils` package**
+
+Read the current file first (`modules/environments/jellyfin/default.nix`), then edit the `config = lib.mkIf cfg.enable { ... }` block so it reads:
+
+```nix
+  config = lib.mkIf cfg.enable {
+    services.jellyfin = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    environment.systemPackages = [ pkgs.libva-utils ];
+
+    my.homepage.services = [
+      {
+        group = "Media";
+        name = "Jellyfin";
+        description = "Media server";
+        href = "http://${hostName}:${toString port}";
+        icon = "jellyfin.png";
+      }
+    ];
+
+    systemd.services.jellyfin = {
+      after = [ "network-online.target" ];
+      serviceConfig.SupplementaryGroups = [
+        "video"
+        "render"
+      ];
+    };
+  };
+```
+
+Note the two existing `systemd.services.jellyfin` keys (`after`) and the new `serviceConfig.SupplementaryGroups` now live in the same attrset — don't create a second `systemd.services.jellyfin = { ... }` block, it would overwrite the first.
+
+- [ ] **Step 2: Verify the rendered config with `nix eval`**
+
+Run (from the repo root on the Mac):
+
+```bash
+nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
+  --extra-experimental-features 'nix-command flakes'
+```
+
+Expected output: `[ "video" "render" ]`
+
+- [ ] **Step 3: Verify the machine still builds**
+
+Run:
+
+```bash
+nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel' \
+  --extra-experimental-features 'nix-command flakes' --no-link
+```
+
+Expected: build succeeds with no errors (may take a while; watch for any evaluation error mentioning `jellyfin` or `libva-utils`).
+
+- [ ] **Step 4: Format and commit**
+
+```bash
+nixfmt-rfc-style modules/environments/jellyfin/default.nix
+git add modules/environments/jellyfin/default.nix
+git commit -m "feat(jellyfin): grant iGPU access for Quick Sync hardware transcoding"
+```
+
+---
+
+### Task 2: Deploy on jupiter and enable Quick Sync (user-executed)
+
+**Files:** none (on-machine deploy + Jellyfin dashboard UI)
+
+**Interfaces:**
+- Consumes: the `SupplementaryGroups` change from Task 1, already merged into the flake.
+
+These steps run **on jupiter**, by the user — paste the output back so we can confirm each one before moving to the next.
+
+- [ ] **Step 1: Deploy**
+
+```bash
+sudo nixos-rebuild switch --flake '.#jupiter'
+```
+
+Expected: switch succeeds, no errors mentioning `jellyfin`.
+
+- [ ] **Step 2: Confirm the service picked up the new groups**
+
+```bash
+systemctl show jellyfin -p SupplementaryGroups
+systemctl status jellyfin --no-pager
+```
+
+Expected: `SupplementaryGroups=video render` (order may vary) and the service is `active (running)`.
+
+- [ ] **Step 3: Confirm VAAPI driver loads**
+
+```bash
+vainfo
+```
+
+Expected: output starts with something like `vainfo: VA-API version: 1.x` and `Driver version: Intel iHD driver`, followed by a list of supported VAProfiles/VAEntrypoints (e.g. `VAProfileH264Main : VAEntrypointVLD`, `VAEntrypointEncSlice`).
+
+If this instead prints a permissions or "no VA display" error, paste it back — that means the group grant isn't reaching the process and Task 1 needs a follow-up fix (e.g. the jellyfin service may be more sandboxed than expected, requiring an explicit `DeviceAllow=char-drm rw` in `serviceConfig` as well).
+
+- [ ] **Step 4: Enable Quick Sync in the Jellyfin dashboard**
+
+In the Jellyfin web UI:
+1. **Dashboard → Playback**.
+2. Hardware acceleration: **Intel QuickSync (QSV)**.
+3. VA-API device: `/dev/dri/renderD128`.
+4. Enable hardware decoding for the codecs your library uses (H264 at minimum).
+5. If the library has HDR content, enable tone-mapping.
+6. Save.
+
+- [ ] **Step 5: Functional check**
+
+Play a file that requires transcoding (or force a lower quality in the client's playback settings to trigger one), then:
+
+```bash
+journalctl -u jellyfin -n 50 --no-pager
+```
+
+Look for a line referencing `qsv` or `vaapi` in the transcode command. Separately, watch CPU usage (`htop`) during playback — it should stay low on the core doing the transcode, rather than pegging at 100%, since the iGPU is now doing the encode/decode work.
+
+## Self-Review Notes
+
+- Spec coverage: NixOS change (Task 1) ✓, manual dashboard step (Task 2 Step 4) ✓, verification via `vainfo`/build (Task 1 Step 2-3, Task 2 Step 3) ✓, functional check (Task 2 Step 5) ✓. Toggle option explicitly excluded per approved spec — not present, correctly.
+- No placeholders — every step has literal commands/code.
+- `SupplementaryGroups` key/value matches exactly between Task 1 (produced) and Task 2 (consumed/checked).

docs/superpowers/plans/2026-07-29-alexa-media-player.md

@@ -0,0 +1,189 @@
+# Alexa Media Player Integration — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Package the `alexa_media_player` HACS component declaratively on jupiter's Home Assistant so HA can drive the household Echo devices (TTS/announce, media, sensors).
+
+**Architecture:** Add one `buildHomeAssistantComponent` entry to `services.home-assistant.customComponents` (same pattern as the existing `ha-sourdough`). The component has real Python deps, so the module's `let` block also defines two supporting derivations built against HA's own interpreter: a new `dictor` package and an `alexapy` version bump. No HACS runtime, no YAML config — the integration is added through the HA UI after the rebuild.
+
+**Tech Stack:** NixOS, `pkgs.buildHomeAssistantComponent`, `buildPythonPackage`, `fetchFromGitHub`/`fetchFromGitLab`/`fetchPypi`.
+
+## Global Constraints
+
+- Target machine: **jupiter** only. All edits live in `modules/environments/home-assistant/default.nix`.
+- Python dep derivations MUST build against Home Assistant's interpreter set — `pkgs.home-assistant.python3Packages` — the same set `buildHomeAssistantComponent` uses. Do not use top-level `pkgs.python3Packages`.
+- Manifest requirements are enforced at build time by `manifestCheckPhase` and again by HA at runtime. Every requirement must resolve to an installed dist satisfying its specifier. Exact pins (verbatim from `alexa_media_player` v5.15.7 `manifest.json`):
+  - `alexapy==1.29.25`
+  - `dictor>=0.1.12,<0.2`
+  - `wrapt>=1.14.0`  (nixpkgs 1.17.2 — already satisfied)
+  - `packaging>=20.3`  (nixpkgs 26.1 — already satisfied)
+- Pinned artifacts (all three hashes verified to build during planning):
+
+  | Artifact           | Fetcher          | Ref / version | Hash                                              |
+  | ------------------ | ---------------- | ------------- | ------------------------------------------------- |
+  | alexa_media_player | fetchFromGitHub  | `v5.15.7`     | `sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI=` |
+  | alexapy            | fetchFromGitLab  | `v1.29.25`    | `sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4=` |
+  | dictor             | fetchPypi (sdist)| `0.1.12`      | `sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs=` |
+
+---
+
+## File Structure
+
+Single file touched: `modules/environments/home-assistant/default.nix`.
+- Its `let` block gains `haPython`, `dictor`, and `alexapy` bindings.
+- Its `services.home-assistant.customComponents` list gains a second entry (`alexa_media`) alongside the existing `sourdough` entry.
+
+No new files. The two supporting derivations are small and specific to this component, so they live inline in the module's `let` block next to their only consumer (files that change together live together).
+
+---
+
+### Task 1: Package `alexa_media_player` with its Python dependencies
+
+**Files:**
+- Modify: `modules/environments/home-assistant/default.nix` (the `let` block, currently lines 9-12; and the `customComponents` list, currently lines 29-41)
+
+**Interfaces:**
+- Consumes: `pkgs.home-assistant.python3Packages` (HA interpreter set), `pkgs.buildHomeAssistantComponent`, `pkgs.fetchFromGitHub`, `pkgs.fetchFromGitLab`.
+- Produces: a second `customComponents` entry with `domain = "alexa_media"`. No other module consumes these `let` bindings.
+
+- [ ] **Step 1: Add the supporting derivations to the `let` block**
+
+Edit the `let` block so it reads exactly:
+
+```nix
+let
+  cfg = config.my.profiles.home-assistant;
+  hostName = config.networking.hostName;
+
+  # Python deps for the alexa_media_player custom component (Task: Alexa).
+  # Built against Home Assistant's own interpreter — the same set
+  # buildHomeAssistantComponent uses — so HA's build-time and runtime
+  # manifest-requirement checks are satisfied.
+  haPython = pkgs.home-assistant.python3Packages;
+
+  # dictor is not in nixpkgs; alexa_media_player needs dictor>=0.1.12,<0.2.
+  # Pure-Python, no runtime deps, legacy setup.py.
+  dictor = haPython.buildPythonPackage {
+    pname = "dictor";
+    version = "0.1.12";
+    format = "setuptools";
+    src = haPython.fetchPypi {
+      pname = "dictor";
+      version = "0.1.12";
+      hash = "sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs=";
+    };
+    build-system = [ haPython.setuptools ];
+    doCheck = false;
+    pythonImportsCheck = [ "dictor" ];
+  };
+
+  # nixpkgs ships alexapy 1.29.22; the manifest pins ==1.29.25. Patch bump.
+  # nixpkgs fetches alexapy from GitLab (keatontaylor/alexapy), tag v<version>.
+  alexapy = haPython.alexapy.overridePythonAttrs (old: {
+    version = "1.29.25";
+    src = pkgs.fetchFromGitLab {
+      owner = "keatontaylor";
+      repo = "alexapy";
+      tag = "v1.29.25";
+      hash = "sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4=";
+    };
+  });
+in
+```
+
+- [ ] **Step 2: Add the `alexa_media` entry to `customComponents`**
+
+In `services.home-assistant.customComponents`, immediately after the closing `)` of the existing `sourdough` entry (current line 40) and before the list's closing `]` (current line 41), add:
+
+```nix
+        (pkgs.buildHomeAssistantComponent {
+          owner = "Alandtse";
+          domain = "alexa_media";
+          version = "5.15.7";
+          src = pkgs.fetchFromGitHub {
+            owner = "Alandtse";
+            repo = "alexa_media_player";
+            rev = "v5.15.7";
+            hash = "sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI=";
+          };
+          # Every manifest requirement must be importable at a satisfying
+          # version or manifestCheckPhase fails the build.
+          dependencies = [
+            alexapy
+            dictor
+            haPython.wrapt
+            haPython.packaging
+          ];
+        })
+```
+
+- [ ] **Step 3: Format the file**
+
+Run: `nixfmt-rfc-style modules/environments/home-assistant/default.nix`
+Expected: exits 0, no diff surprises (re-read the file if unsure).
+
+- [ ] **Step 4: Build the component in isolation first (fast feedback)**
+
+This is the real test: it runs `manifestCheckPhase`, which fails loudly if any of the four requirements is unmet. It was verified to succeed during planning.
+
+Run:
+```bash
+nix build --impure --no-link --print-out-paths --expr '
+  let
+    pkgs = (builtins.getFlake (toString ./.)).nixosConfigurations.jupiter.pkgs;
+    py = pkgs.home-assistant.python3Packages;
+    dictor = py.buildPythonPackage {
+      pname = "dictor"; version = "0.1.12"; format = "setuptools";
+      src = py.fetchPypi { pname = "dictor"; version = "0.1.12"; hash = "sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs="; };
+      build-system = [ py.setuptools ]; doCheck = false; pythonImportsCheck = [ "dictor" ];
+    };
+    alexapy = py.alexapy.overridePythonAttrs (old: {
+      version = "1.29.25";
+      src = pkgs.fetchFromGitLab { owner = "keatontaylor"; repo = "alexapy"; tag = "v1.29.25"; hash = "sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4="; };
+    });
+  in pkgs.buildHomeAssistantComponent {
+    owner = "Alandtse"; domain = "alexa_media"; version = "5.15.7";
+    src = pkgs.fetchFromGitHub { owner = "Alandtse"; repo = "alexa_media_player"; rev = "v5.15.7"; hash = "sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI="; };
+    dependencies = [ alexapy dictor py.wrapt py.packaging ];
+  }'
+```
+Expected: prints a `/nix/store/...-Alandtse-alexa_media-5.15.7` path, exit 0. If it fails with `<pkg><specifier> not satisfied by version ...`, a dependency version drifted — re-check the manifest pin against the provided dep.
+
+- [ ] **Step 5: Build the whole jupiter system (integration gate)**
+
+Run: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+Expected: builds to completion, exit 0. This confirms the module edits evaluate and the component is wired into HA's package.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add modules/environments/home-assistant/default.nix
+git commit -m "$(cat <<'EOF'
+feat(home-assistant): add alexa_media_player custom component
+
+Package the Alexa Media Player HACS component declaratively (v5.15.7),
+so HA can drive the Echo devices (TTS/announce, media, sensors). Needs
+dictor 0.1.12 (absent from nixpkgs) and an alexapy 1.29.22 -> 1.29.25
+bump to satisfy the manifest's exact requirement pins; both build
+against HA's interpreter. Config-flow based: add via the HA UI and sign
+in with the Amazon account after rebuild.
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+EOF
+)"
+```
+
+---
+
+## Post-implementation (manual, by the user — not an automatable step)
+
+After `sudo nixos-rebuild switch --flake '.#jupiter'`:
+1. Settings → Devices & Services → Add Integration → **Alexa Media Player**.
+2. Sign in with the Amazon account; complete any 2FA / app-password prompt in the UI flow.
+3. Confirm media_player entities and sensors appear; test a TTS/announce service call to an Echo.
+
+## Self-Review
+
+- **Spec coverage:** goal (alexa_media_player packaging) → Task 1; alexapy bump → Step 1; dictor packaging → Step 1; component entry → Step 2; wrapt/packaging already-satisfied → included as deps in Step 2; build-time manifest check → Steps 4-5; runtime config-flow → Post-implementation. Deferred Alexa→HA scope: intentionally absent. No gaps.
+- **Placeholder scan:** none — every step has concrete code/commands and the verified hashes.
+- **Type/name consistency:** `haPython`, `dictor`, `alexapy` defined in Step 1 and referenced by those exact names in Step 2; domain `alexa_media` consistent throughout; hashes identical across plan, spec, and the verified build.

docs/superpowers/specs/2026-07-05-ntfy-module-design.md

@@ -1,176 +0,0 @@
-# ntfy self-hosted notification module — design
-
-Date: 2026-07-05
-Target machine: jupiter
-
-## Purpose
-
-Add a NixOS profile module that runs and configures a self-hosted
-[ntfy](https://ntfy.sh) notification server on jupiter, with authentication
-required, a homepage dashboard tile, and out-of-the-box plumbing so Home
-Assistant automations can publish push notifications.
-
-## Scope decisions (from brainstorming)
-
-- **Service:** ntfy (self-hosted server), not Apprise/Gotify/HA-only.
-- **Access control:** authentication required (`auth-default-access = deny-all`).
-- **Home Assistant:** the module wires an HA `rest_command` so automations can
-  send notifications out of the box.
-- **Credentials:** fully manual. The module runs the server and wires the HA
-  plumbing, but does **not** seed users or store any secret. The operator
-  provisions ntfy users/passwords by hand, and the only secret lives in Home
-  Assistant's `secrets.yaml` — never in the world-readable Nix store.
-
-## Module structure
-
-New module at `modules/environments/ntfy/default.nix` following the repo's
-standard profile pattern (`my.profiles.<name>` with `options` +
-`config = lib.mkIf cfg.enable { ... }`).
-
-Registration:
-1. Add `./ntfy` to the `imports` list in `modules/environments/default.nix`.
-2. Enable via `my.profiles.ntfy.enable = true;` in
-   `machines/jupiter/environments.nix`.
-
-### Options
-
-```nix
-options.my.profiles.ntfy = with lib; {
-  enable = mkEnableOption "ntfy notification server";
-
-  port = mkOption {
-    type = types.port;
-    default = 2586;
-    description = "HTTP port ntfy listens on.";
-  };
-
-  topic = mkOption {
-    type = types.str;
-    default = "ha";
-    description = "Topic Home Assistant publishes notifications to.";
-  };
-
-  haIntegration.enable = mkOption {
-    type = types.bool;
-    default = true;
-    description = "Wire a Home Assistant rest_command that publishes to ntfy.";
-  };
-};
-```
-
-## Server configuration
-
-```nix
-config = lib.mkIf cfg.enable {
-  services.ntfy-sh = {
-    enable = true;
-    settings = {
-      base-url            = "http://${hostName}:${toString cfg.port}";
-      listen-http         = ":${toString cfg.port}";
-      auth-file           = "/var/lib/ntfy-sh/user.db";
-      auth-default-access = "deny-all";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-  my.homepage.services = [
-    {
-      group = "Services";
-      name = "ntfy";
-      description = "Push notifications";
-      href = "http://${hostName}:${toString cfg.port}";
-      icon = "ntfy.svg";
-    }
-  ];
-};
-```
-
-`hostName` is bound from `config.networking.hostName`, matching the pattern in
-the home-assistant and paperless modules.
-
-## Home Assistant wiring
-
-Applied only when ntfy, the HA integration flag, and the home-assistant profile
-are all enabled:
-
-```nix
-lib.mkIf (cfg.enable && cfg.haIntegration.enable
-          && config.my.profiles.home-assistant.enable) {
-  services.home-assistant.config.rest_command.ntfy_send = {
-    url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
-    method = "POST";
-    payload = "{{ message }}";
-    content_type = "text/plain";
-    username = "homeassistant";
-    password = "!secret ntfy_password";
-    headers = {
-      Title = "{{ title | default('Home Assistant') }}";
-      Priority = "{{ priority | default('default') }}";
-    };
-  };
-};
-```
-
-Notes:
-- `services.home-assistant.config` is an attrset that NixOS merges, so adding
-  `rest_command.ntfy_send` from this module composes with the config the
-  home-assistant module already defines.
-- `password = "!secret ntfy_password"` is a whole-value `!secret` reference. The
-  upstream home-assistant module unquotes such values when rendering the config
-  (the same mechanism the repo already relies on for `!include`), so the secret
-  resolves from `/var/lib/hass/secrets.yaml` at runtime and never enters the
-  Nix store. See `reference_nixos_ha_yaml_includes`.
-- `rest_command` is chosen over the `notify` REST platform because ntfy's
-  per-topic URL path plus header-based metadata map cleanly onto rest_command,
-  whereas the notify platform's fixed JSON payload fights ntfy's format.
-
-## Manual provisioning (operator runbook)
-
-Because credentials are fully manual, after the first `nixos-rebuild switch`
-run these once on jupiter:
-
-```bash
-# Dedicated publisher for Home Assistant, scoped to the ha topic
-ntfy user add homeassistant            # prompts for a password
-ntfy access homeassistant ha write-only
-
-# Admin account for the app / web UI
-ntfy user add --role=admin admin
-```
-
-Then add the homeassistant password to Home Assistant's secrets:
-
-```yaml
-# /var/lib/hass/secrets.yaml
-ntfy_password: <the homeassistant user's password>
-```
-
-Restart Home Assistant. Automations can then publish with:
-
-```yaml
-service: rest_command.ntfy_send
-data:
-  message: "Garage door left open"
-  title: "Alert"
-  priority: high
-```
-
-Subscribers (phone/desktop ntfy app) log in as `admin` (or another user granted
-read access) to receive messages.
-
-## Testing / verification
-
-- Build check: `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
-  must succeed with the module enabled.
-- `nixfmt-rfc-style` clean on the new file.
-- Post-deploy manual verification (documented, not automated): create the users
-  above, publish a test message from HA, confirm it reaches a subscribed client.
-
-## Out of scope
-
-- No automated user/token seeding (explicitly deferred to manual provisioning).
-- No sops-nix setup (repo has dangling `config.sops.secrets` references, but
-  wiring up sops is a separate change and not required here).
-- No reverse-proxy / TLS termination (`behind-proxy` left default; LAN-only via
-  firewall).

docs/superpowers/specs/2026-07-26-jellyfin-hw-transcoding.md

@@ -0,0 +1,145 @@
+# Intel Quick Sync hardware transcoding for Jellyfin on jupiter
+
+## Problem
+
+Jellyfin streams stutter on jupiter whenever a client needs a transcode
+(unsupported codec/container, bitrate cap, or a client that can't
+direct-play). Transcoding currently runs entirely on CPU.
+
+jupiter's Intel iGPU is already usable at the OS level:
+
+- `hardware.graphics.enable = true` with `intel-media-driver` (the `iHD`
+  VAAPI driver) is configured in
+  `machines/jupiter/hardware-configuration.nix:20-27`.
+- The commented-out `i915.force_probe = "9a49"` kernel param there
+  corresponds to a Quick-Sync-capable Intel UHD iGPU, confirming the
+  hardware supports it.
+
+But `modules/environments/jellyfin/default.nix` never grants the
+`jellyfin` systemd service access to `/dev/dri`, so Jellyfin has no path
+to the GPU and silently falls back to software transcoding.
+
+## Goal
+
+Give the Jellyfin service access to the iGPU's VAAPI render node, so
+Quick Sync can be enabled in Jellyfin's own dashboard and transcodes are
+offloaded from the CPU.
+
+## Non-goals
+
+- Remote/external access or reverse-proxy tuning.
+- General CPU/RAM headroom review of jupiter.
+- A toggle option (`my.profiles.jellyfin.hardwareAcceleration.enable`) —
+  jupiter only has the one iGPU, so this is hardcoded on rather than
+  made configurable.
+
+## Design
+
+### NixOS change (declarative)
+
+In `modules/environments/jellyfin/default.nix`, inside the existing
+`config = lib.mkIf cfg.enable { ... }` block, grant the systemd service
+supplementary access to the `video` and `render` groups (the groups that
+own `/dev/dri/card*` and `/dev/dri/renderD*`):
+
+```nix
+systemd.services.jellyfin.serviceConfig.SupplementaryGroups = [
+  "video"
+  "render"
+];
+```
+
+This is additive to the existing `systemd.services.jellyfin.after = [
+"network-online.target" ];` block already in the file — both apply to
+the same service.
+
+Also add `libva-utils` to `environment.systemPackages` (or scoped to
+this module) so `vainfo` is available on jupiter to verify the driver
+loads correctly.
+
+### Manual step (not declarative)
+
+Jellyfin stores its transcoding/hardware-acceleration choice in its own
+internal `encoding.xml`, which the NixOS module does not expose as an
+option. After deploying the Nix change, one-time manual configuration in
+the Jellyfin dashboard is required:
+
+1. **Dashboard → Playback**.
+2. Hardware acceleration: **Intel QuickSync (QSV)**.
+3. VA-API device: `/dev/dri/renderD128`.
+4. Enable hardware decoding for the codecs your library actually uses
+   (H264 at minimum; HEVC/VP9 depending on iGPU generation).
+5. If any HDR content exists in the library, enable tone-mapping — this
+   is one of the more CPU-expensive operations Quick Sync can offload.
+
+## Verification
+
+Build-time (from the Mac, no SSH needed):
+
+```
+nix eval '.#nixosConfigurations.jupiter.config.systemd.services.jellyfin.serviceConfig.SupplementaryGroups' \
+  --extra-experimental-features 'nix-command flakes'
+```
+
+Expect `[ "video" "render" ]`.
+
+On jupiter after `sudo nixos-rebuild switch --flake '.#jupiter'`:
+
+```
+systemctl status jellyfin
+journalctl -u jellyfin -n 50 --no-pager
+vainfo
+```
+
+`vainfo` should list the `iHD` driver and print supported VAEntrypoints
+(VLD decode / encode profiles for H264/HEVC).
+
+Functional check: play a file on a client that forces transcoding (or
+force it manually via Jellyfin's playback quality setting), then in
+Jellyfin's dashboard **Activity/Now Playing** panel confirm the
+transcode reason and check that CPU usage on jupiter (`htop`) stays low
+during playback rather than pegging a core — Quick Sync offload should
+show up as low CPU, some GPU (`intel_gpu_top`) activity instead.
+
+## Open items
+
+- Exact supported codec list depends on the iGPU generation (device ID
+  `9a49`) — confirm via `vainfo` output once run, and enable only the
+  hardware decode paths it actually reports.
+
+## Post-deploy fix: two additional runtime packages required
+
+After the initial deploy (Task 1's `SupplementaryGroups` grant) and
+enabling QSV in the dashboard, HEVC HDR playback hung indefinitely
+(Direct Play worked for some titles; titles that needed a real
+transcode+tonemap never produced output). Root-caused via
+`journalctl -u jellyfin` and the per-session ffmpeg transcode log
+(`find / -xdev -iname '*ffmpeg-transcode*'`) — two separate runtimes
+were missing beyond `intel-media-driver` (which only provides VAAPI):
+
+1. **QSV session creation failed:** `Error creating a MFX session: -9`
+   / `Error initializing an MFX session: -3` on
+   `-init_hw_device qsv=qs@va`. VAAPI and QSV are separate runtimes on
+   Linux — QSV needs the oneVPL/MFX GPU implementation. Fix: added
+   `pkgs.vpl-gpu-rt` ("oneAPI Video Processing Library Intel GPU
+   implementation"; note `onevpl-intel-gpu` is the old, renamed
+   attribute) to `hardware.graphics.extraPackages` in
+   `machines/jupiter/hardware-configuration.nix`.
+
+2. **OpenCL device creation failed:** `Failed to get number of OpenCL
+   platforms: -1001` (`CL_PLATFORM_NOT_FOUND_KHR`) on
+   `-init_hw_device opencl=ocl@va`. The `tonemap_opencl` filter jellyfin
+   uses for HDR→SDR tone-mapping needs a working OpenCL ICD, which
+   nothing installed so far provides. Fix: added
+   `pkgs.intel-compute-runtime` ("Intel Graphics Compute Runtime oneAPI
+   Level Zero and OpenCL, supporting 12th Gen and newer" — matches
+   jupiter's Tiger Lake/Xe iGPU) to the same `extraPackages` list.
+
+Confirmed working end-to-end: HEVC HDR transcode with QSV encode +
+OpenCL tone-map runs at `speed=2.68x` realtime on jupiter's iGPU, and
+plays smoothly on Apple TV (JellyTV app).
+
+Both packages live in `machines/jupiter/hardware-configuration.nix`
+(`hardware.graphics.extraPackages`), alongside `intel-media-driver`,
+rather than in the jellyfin module itself — they're iGPU runtime
+capabilities, not something specific to the jellyfin service.

docs/superpowers/specs/2026-07-29-alexa-media-player-design.md

@@ -0,0 +1,152 @@
+# Amazon Alexa integration for Home Assistant (jupiter) — design
+
+**Date:** 2026-07-29
+**Machine:** jupiter
+**Status:** approved, ready for implementation plan
+
+## Goal
+
+Let Home Assistant control and read the household Amazon Echo devices via the
+unofficial [`alexa_media_player`](https://github.com/Alandtse/alexa_media_player)
+integration: text-to-speech / announcements, media control, and per-device
+sensors (last-called device, next alarm/timer, DND state, etc.).
+
+This uses the user's Amazon account through an unofficial API. It is a
+config-flow integration: after the rebuild it is added through the HA UI, not
+via YAML.
+
+## Non-goals (deferred)
+
+Alexa → HA voice control ("Alexa, turn on the light") is **out of scope**. It
+would need either `emulated_hue` bound to port 80 on the LAN, or a public HTTPS
+endpoint plus the AWS-Lambda Smart Home Skill. The user chose to decide on that
+later. Nothing in this change touches the firewall, port 80, systemd unit
+capabilities, or network exposure.
+
+## Approach
+
+Package the integration declaratively, following the existing `ha-sourdough`
+pattern in `modules/environments/home-assistant/default.nix` (a
+`buildHomeAssistantComponent` entry in `services.home-assistant.customComponents`).
+No HACS runtime.
+
+Unlike sourdough, `alexa_media_player` has real Python dependencies. Its
+`manifest.json` (v5.15.7) declares:
+
+```
+alexapy==1.29.25
+packaging>=20.3
+wrapt>=1.14.0
+dictor>=0.1.12,<0.2
+```
+
+`buildHomeAssistantComponent` runs `manifestCheckPhase` at build time
+(`check_manifest.py`): every requirement must resolve to an installed
+distribution **whose version satisfies the specifier**, or the build fails.
+Home Assistant repeats this check at runtime. Therefore each requirement must be
+satisfied exactly — the exact `==1.29.25` pin in particular.
+
+Dependency status in the pinned nixpkgs (`nixos-25.11`):
+
+| Requirement            | nixpkgs today | Action                                  |
+| ---------------------- | ------------- | --------------------------------------- |
+| `alexapy==1.29.25`     | 1.29.22       | **Bump** to 1.29.25 via override        |
+| `dictor>=0.1.12,<0.2`  | *absent*      | **Package** dictor 0.1.12 (new)         |
+| `wrapt>=1.14.0`        | 1.17.2        | none — already satisfied                |
+| `packaging>=20.3`      | 26.1          | none — already satisfied                |
+
+`authcaptureproxy` (in nixpkgs at 1.3.7) is a transitive dependency of
+`alexapy`, not listed in the manifest, so it needs no direct handling.
+
+## Components
+
+All changes live in `modules/environments/home-assistant/default.nix` (plus the
+hashes below). Three small pieces, wired together in the module's `let` block:
+
+### 1. `dictor` package (new)
+
+Not in nixpkgs. Pure-Python, no runtime dependencies (`requires_dist: null`),
+ships a `setup.py`. A minimal `pkgs.python3Packages.buildPythonPackage`:
+
+- pname `dictor`, version `0.1.12`
+- `src = fetchPypi { pname = "dictor"; version = "0.1.12"; hash = "sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs="; }`
+- setuptools format (legacy `setup.py`); `build-system = [ setuptools ]`
+- `doCheck = false` (no meaningful test suite); `pythonImportsCheck = [ "dictor" ]`
+
+Build against the HA Python set so the version lands in HA's venv — i.e. use
+`config.services.home-assistant.package.python.pkgs` (the same interpreter the
+component check and HA runtime use), not the top-level `pkgs.python3Packages`.
+
+### 2. `alexapy` 1.29.25 (override)
+
+nixpkgs `alexapy` is fetched from **GitLab** (`keatontaylor/alexapy`, tag
+`v<version>`), not PyPI. Override just the version + src via
+`overridePythonAttrs`, reusing the existing build-system and dependency list:
+
+- `version = "1.29.25"`
+- `src = fetchFromGitLab { owner = "keatontaylor"; repo = "alexapy"; tag = "v1.29.25"; hash = "sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4="; }`
+
+This is a patch bump (1.29.22 → 1.29.25); the dependency set is expected to be
+unchanged. Override the HA-Python-set `alexapy` so it shares the interpreter
+with dictor and the component.
+
+### 3. `alexa_media_player` component (new `customComponents` entry)
+
+```
+buildHomeAssistantComponent {
+  owner = "Alandtse";
+  domain = "alexa_media";
+  version = "5.15.7";
+  src = fetchFromGitHub {
+    owner = "Alandtse";
+    repo  = "alexa_media_player";
+    rev   = "v5.15.7";
+    hash  = "sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI=";
+  };
+  dependencies = [ alexapy' dictor' wrapt packaging ];  # HA-python-set packages
+}
+```
+
+`dependencies` must make every manifest requirement importable at the required
+version for `manifestCheckPhase` to pass. Include all four (the two custom ones
+plus `wrapt` and `packaging` from the HA Python set) to be explicit.
+
+## Data flow
+
+1. `nixos-rebuild switch` builds the component; `manifestCheckPhase` validates
+   the four requirements against the provided `dependencies`.
+2. HA starts; the custom component is present but not configured.
+3. User adds **Alexa Media Player** in Settings → Devices & Services, signs in
+   with the Amazon account (email/password; 2FA or app-password handled in the
+   UI flow at runtime).
+4. HA creates media_player entities and per-device sensors; TTS/announce
+   services become available for automations.
+
+## Error handling / risks
+
+- **Version-pin drift.** If a future `alexa_media_player` bump changes the
+  `alexapy==` pin, `alexapy` must be re-bumped in lockstep, or the build fails
+  loudly at `manifestCheckPhase` (fail-safe, not silent).
+- **Amazon login fragility.** The unofficial API can break on Amazon's side
+  (captcha/2FA changes). This is a runtime concern, independent of packaging;
+  not addressed here.
+- **`dictor` upper bound `<0.2`.** 0.1.12 is the current release and satisfies
+  it. If nixpkgs later gains a `dictor` ≥ 0.2, prefer our pinned 0.1.12 for
+  this component.
+
+## Verification
+
+- `nix build '.#nixosConfigurations.jupiter.config.system.build.toplevel'`
+  succeeds — this exercises the build-time manifest-requirements check for all
+  three new/overridden derivations.
+- `nixfmt-rfc-style` clean on the edited module.
+- Post-deploy (manual, by the user): the integration appears under Add
+  Integration, and a TTS/announce call reaches an Echo.
+
+## Pinned artifacts
+
+| Artifact                    | Source     | Ref / version | Hash                                              |
+| --------------------------- | ---------- | ------------- | ------------------------------------------------- |
+| alexa_media_player          | GitHub     | v5.15.7       | sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI= |
+| alexapy                     | GitLab     | v1.29.25      | sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4= |
+| dictor                      | PyPI sdist | 0.1.12        | sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs= |

flake.lock

@@ -21,11 +21,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -60,20 +60,17 @@
         "flake-compat": [
           "nix"
         ],
-        "gitignore": [
-          "nix"
-        ],
         "nixpkgs": [
           "nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1781733627,
+        "lastModified": 1783008725,
-        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
         "type": "github"
       },
       "original": {
@@ -92,11 +89,11 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1782337899,
+        "lastModified": 1784762557,
-        "narHash": "sha256-Imevyelg3r2N5iDonnGdOKGRiB56m3HgVFAljTB3CLU=",
+        "narHash": "sha256-R/r6jRnANV50c8F5Fz5+1Q1moab0IGWRk+cg5ME2nMY=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "3887a906b178836818a62e8eba666ad652e8a388",
+        "rev": "d10c84cd0cc0efdcb29cf2611caf5fbcd10fa071",
         "type": "github"
       },
       "original": {
@@ -146,11 +143,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1782379505,
+        "lastModified": 1784723954,
-        "narHash": "sha256-zPvPiU+a7pqtH47xrtZLNRABJKpOjfZQclDbcvNtH+I=",
+        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "603d3afd1b6145bd66e97ae38a34d91c95df70cf",
+        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
         "type": "github"
       },
       "original": {
@@ -161,11 +158,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780902259,
+        "lastModified": 1783148766,
-        "narHash": "sha256-YMnBf9lk/LYgvqfmSSJuOGigtRs5Lsy26pJHVlR9yMY=",
+        "narHash": "sha256-H9+N+GFtsbVC8ZniHliChM7ndizxtqVZs6bnGOLM3WQ=",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "a50de1b7d8a586adc18d2395c19de7d6058e6030",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.1550.bd0ff2d3eac2/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.4193.a50de1b7d8a5/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -190,11 +187,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
+        "lastModified": 1782614948,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -221,11 +218,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1782467914,
+        "lastModified": 1784796856,
-        "narHash": "sha256-inDx/w70OSJoJPqtKh0BrzAsbZZhpya7YgS43jHnhwg=",
+        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
-        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1022855.e73de5be04e0/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -248,11 +245,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1782375420,
+        "lastModified": 1784707089,
-        "narHash": "sha256-f+/IH5ng5P91VHrhcNxqpW2RYDySD68V1fcX00COQy4=",
+        "narHash": "sha256-DUedXhD2Rg8q4Xyd07Sb90eZGy4gg6W+Vl/WbLNwAZo=",
-        "rev": "4062d36ebeae843c750011eef6b61ec9a9dbc9a9",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.3250.4062d36ebeae/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.5845.b3fe9581c906/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

machines/jupiter/environments.nix

@@ -23,7 +23,6 @@ in
     jellyseerr.enable = true;
     development.enable = true;
     home-assistant.enable = true;
-    ntfy.enable = true;
 
     homepage.enable = true;
     paperless = {

machines/jupiter/hardware-configuration.nix

@@ -35,6 +35,8 @@
       #vaapiIntel         # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
       libva-vdpau-driver
       libvdpau-va-gl
+      vpl-gpu-rt # oneVPL/MFX runtime, required for QSV (h264_qsv/hevc_qsv) session creation
+      intel-compute-runtime # OpenCL runtime, required for tonemap_opencl (HDR tone-mapping)
     ];
   };
 

machines/mibook/configuration.nix

@@ -44,6 +44,14 @@
 
   services.openssh.enable = true;
 
+  # KDE (PowerDevil) power settings: do nothing on lid close while on AC power.
+  # Shipped as a system-wide default; KConfig cascades so a user's own
+  # ~/.config/powerdevilrc will override this if present.
+  environment.etc."xdg/powerdevilrc".text = ''
+    [AC][SuspendAndShutdown]
+    LidAction=0
+  '';
+
   system = {
     stateVersion = "23.05";
     autoUpgrade.enable = true;

modules/environments/default.nix

@@ -7,7 +7,6 @@
     ./claude-code
     ./development
     ./home-assistant
-    ./ntfy
     ./hyprland
     ./zsh
     ./paperless

modules/environments/home-assistant/default.nix

@@ -9,6 +9,39 @@
 let
   cfg = config.my.profiles.home-assistant;
   hostName = config.networking.hostName;
+
+  # Python deps for the alexa_media_player custom component. Built against
+  # Home Assistant's own interpreter — the same set buildHomeAssistantComponent
+  # uses — so HA's build-time and runtime manifest-requirement checks pass.
+  haPython = pkgs.home-assistant.python3Packages;
+
+  # dictor is not in nixpkgs; alexa_media_player needs dictor>=0.1.12,<0.2.
+  # Pure-Python, no runtime deps, legacy setup.py.
+  dictor = haPython.buildPythonPackage {
+    pname = "dictor";
+    version = "0.1.12";
+    format = "setuptools";
+    src = haPython.fetchPypi {
+      pname = "dictor";
+      version = "0.1.12";
+      hash = "sha256-bbSDda4eU9ye2EToWzj04/v79qTmC+yjd1Fa0URTuRs=";
+    };
+    build-system = [ haPython.setuptools ];
+    doCheck = false;
+    pythonImportsCheck = [ "dictor" ];
+  };
+
+  # nixpkgs ships alexapy 1.29.22; the manifest pins ==1.29.25. Patch bump.
+  # nixpkgs fetches alexapy from GitLab (keatontaylor/alexapy), tag v<version>.
+  alexapy = haPython.alexapy.overridePythonAttrs (old: {
+    version = "1.29.25";
+    src = pkgs.fetchFromGitLab {
+      owner = "keatontaylor";
+      repo = "alexapy";
+      tag = "v1.29.25";
+      hash = "sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4=";
+    };
+  });
 in
 {
 
@@ -23,6 +56,42 @@ in
     services.home-assistant = {
       enable = true;
       openFirewall = true;
+
+      # HACS-style custom components, packaged declaratively (no HACS runtime).
+      # Config-flow based: add via Settings > Devices & Services after rebuild.
+      customComponents = [
+        (pkgs.buildHomeAssistantComponent {
+          owner = "Matts-Baps";
+          domain = "sourdough";
+          version = "1.1.3";
+          src = pkgs.fetchFromGitHub {
+            owner = "Matts-Baps";
+            repo = "ha-sourdough";
+            rev = "v1.1.3";
+            hash = "sha256-Uoid/2f6GxZMuE5Keu2VjHPYuOxnYG8hsCD6BYcaTvM=";
+          };
+        })
+        (pkgs.buildHomeAssistantComponent {
+          owner = "Alandtse";
+          domain = "alexa_media";
+          version = "5.15.7";
+          src = pkgs.fetchFromGitHub {
+            owner = "Alandtse";
+            repo = "alexa_media_player";
+            rev = "v5.15.7";
+            hash = "sha256-1rcZVSX1xA1Lc4qSu39MOitVEciZFhoPQy2y5+PpoAI=";
+          };
+          # Every manifest requirement must be importable at a satisfying
+          # version or manifestCheckPhase fails the build.
+          dependencies = [
+            alexapy
+            dictor
+            haPython.wrapt
+            haPython.packaging
+          ];
+        })
+      ];
+
       extraComponents = [
         "matter"
         "mobile_app"

modules/environments/jellyfin/default.nix

@@ -22,6 +22,8 @@ in
       openFirewall = true;
     };
 
+    environment.systemPackages = [ pkgs.libva-utils ];
+
     my.homepage.services = [
       {
         group = "Media";
@@ -34,6 +36,10 @@ in
 
     systemd.services.jellyfin = {
       after = [ "network-online.target" ];
+      serviceConfig.SupplementaryGroups = [
+        "video"
+        "render"
+      ];
     };
   };
 }

modules/environments/kde-desktop/default.nix

@@ -24,4 +24,4 @@ in
       numix-icon-theme
     ];
   };
-}
+}

modules/environments/ntfy/default.nix

@@ -1,74 +0,0 @@
-# self-hosted push notification server (ntfy)
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.profiles.ntfy;
-  hostName = config.networking.hostName;
-in
-{
-  options.my.profiles.ntfy = with lib; {
-    enable = mkEnableOption "ntfy notification server";
-
-    port = mkOption {
-      type = types.port;
-      default = 2586;
-      description = "HTTP port ntfy listens on.";
-    };
-
-    topic = mkOption {
-      type = types.str;
-      default = "ha";
-      description = "Topic Home Assistant publishes notifications to.";
-    };
-
-    haIntegration.enable = mkOption {
-      type = types.bool;
-      default = true;
-      description = "Wire a Home Assistant rest_command that publishes to ntfy.";
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      services.ntfy-sh = {
-        enable = true;
-        settings = {
-          base-url = "http://${hostName}:${toString cfg.port}";
-          listen-http = ":${toString cfg.port}";
-          auth-file = "/var/lib/ntfy-sh/user.db";
-          auth-default-access = "deny-all";
-        };
-      };
-
-      networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-      my.homepage.services = [
-        {
-          group = "Services";
-          name = "ntfy";
-          description = "Push notifications";
-          href = "http://${hostName}:${toString cfg.port}";
-          icon = "ntfy.svg";
-        }
-      ];
-    })
-
-    (lib.mkIf (cfg.enable && cfg.haIntegration.enable && config.my.profiles.home-assistant.enable) {
-      services.home-assistant.config.rest_command.ntfy_send = {
-        url = "http://${hostName}:${toString cfg.port}/${cfg.topic}";
-        method = "POST";
-        payload = "{{ message }}";
-        content_type = "text/plain";
-        username = "homeassistant";
-        password = "!secret ntfy_password";
-        headers = {
-          Title = "{{ title | default('Home Assistant') }}";
-          Priority = "{{ priority | default('default') }}";
-        };
-      };
-    })
-  ];
-}