chore(beads): sync issue export

Author: edmundmiller

.beads/issues.jsonl

@@ -166,7 +166,7 @@
 {"id":"dotfiles-853","title":"Evaluate tmux-sessionx","description":"Test omerxx/tmux-sessionx - Enhanced session manager","status":"closed","priority":2,"issue_type":"task","owner":"git@edmundmiller.dev","created_at":"2026-01-13T21:50:33Z","created_by":"Edmund Miller","updated_at":"2026-01-15T16:08:45Z","closed_at":"2026-01-15T16:08:45Z","close_reason":"Evaluated both: chose sesh (zoxide + Raycast integration). Implemented in tmux config with C-c t keybinding.","source_repo":".","compaction_level":0,"original_size":0}
 {"id":"dotfiles-86f8","title":"Harden Scintillate GitHub SSH credentials","description":"Scintillate currently mounts /home/emiller/.ssh into the container at /home/ubuntu/.ssh so git over SSH works. This is intentionally broad and should be replaced with least-privilege credentials: dedicated GitHub deploy key(s), preferably read-only for vault sync unless push is required; mount only that key plus known_hosts; set GIT_SSH_COMMAND/ssh config explicitly; decide separately whether commit signing is needed. Context: commit eaeeb071 added Scintillate runtime tools and the broad SSH mount as a temporary unblock.","status":"open","priority":2,"issue_type":"task","created_at":"2026-06-10T08:03:59.971014342Z","created_by":"emiller","updated_at":"2026-06-10T08:03:59.971014342Z","source_repo":"dotfiles","source_repo_path":"/home/emiller/.config/dotfiles","compaction_level":0,"original_size":0}
 {"id":"dotfiles-86qn","title":"Fix Hermes containers not picking up env changes on deploy","description":"Hermes gateway containers (observed with scintillate) did not restart/recreate after Nix deploy added agenix-backed env-file content. The systemd unit stayed active with an old Docker container from before deploy, so docker inspect showed HERMES_HONCHO_HOST but no HONCHO_API_KEY even though /run/agenix/hermes-scintillate-honcho-api-key existed and /run/hermes-scintillate-env/secrets.env had been regenerated.\n\nAcceptance criteria:\n1. A deploy that changes /run/hermes-*-env/secrets.env or referenced agenix secret content results in the corresponding Hermes container receiving the new environment.\n2. Scintillate no longer requires manual restart/recreate after Honcho/env secret changes.\n3. The fix documents the tradeoff with restartIfChanged=false for interactive gateways.","status":"open","priority":1,"issue_type":"bug","created_at":"2026-05-25T21:42:58.328211Z","created_by":"emiller","updated_at":"2026-05-25T21:45:26.660277Z","source_repo":"dotfiles","source_repo_path":"/Users/emiller/.config/dotfiles","compaction_level":0,"original_size":0,"comments":[{"id":20,"issue_id":"dotfiles-86qn","author":"emiller","text":"Follow-up from manual Scintillate recovery on 2026-05-25:\n\nImportant nuance: `docker restart hermes-agent-scintillate` was NOT sufficient. Docker restart preserves the existing container config/env, so after restart the container still had HERMES_HONCHO_HOST/HERMES_HOME but no HONCHO_API_KEY.\n\nWhat worked was forcing container recreation so the module pre-start script reran `docker create --env-file /run/hermes-scintillate-env/secrets.env`:\n1. Remove old container: `docker rm -f hermes-agent-scintillate`\n2. Let `hermes-gateway-scintillate.service` / its ExecStartPre recreate the container\n3. Verify with `docker inspect hermes-agent-scintillate --format \"{{range .Config.Env}}{{println .}}{{end}}\"`\n\nAfter recreation, docker inspect showed HONCHO_API_KEY=present, HERMES_HONCHO_HOST=present, and HERMES_HOME=present. The new container was created at 2026-05-25T21:43:49Z and the service was active.\n\nRoot cause candidate: the generated pre-start script only recreates the container when `.container-identity` changes or the container is missing. The identity hash apparently does not include env-file contents or referenced agenix secret contents, so env-file-only secret changes do not force container recreation. Acceptance should specifically require container *recreation*, not just restart, when env-file contents or referenced secret generations change.","created_at":"2026-05-25T21:45:26Z"}]}
-{"id":"dotfiles-87x8","title":"Repair ACP authentication for agent review gates","status":"open","priority":2,"issue_type":"task","created_at":"2026-07-12T02:27:13.895645Z","created_by":"emiller","updated_at":"2026-07-12T02:27:13.895645Z","source_repo":"dotfiles","source_repo_path":"/Users/emiller/.config/dotfiles","compaction_level":0,"original_size":0}
+{"id":"dotfiles-87x8","title":"Repair ACP authentication for agent review gates","status":"in_progress","priority":2,"issue_type":"task","assignee":"omp","created_at":"2026-07-12T02:27:13.895645Z","created_by":"emiller","updated_at":"2026-07-12T22:46:06.784801Z","source_repo":"dotfiles","source_repo_path":"/Users/emiller/.config/dotfiles","compaction_level":0,"original_size":0}
 {"id":"dotfiles-894","title":"Add deploy-rs input and deploy output to flake.nix","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-02T16:13:09Z","created_by":"emiller","updated_at":"2026-01-02T16:26:44Z","closed_at":"2026-01-02T16:26:44Z","close_reason":"Closed","source_repo":".","compaction_level":0,"original_size":0}
 {"id":"dotfiles-89r","title":"Research ericmckevitt dotfiles","description":"Config examples. https://github.com/ericmckevitt/Dotfiles/tree/main","status":"open","priority":4,"issue_type":"task","owner":"git@edmundmiller.dev","created_at":"2026-01-13T22:33:56Z","created_by":"Edmund Miller","updated_at":"2026-01-13T22:33:56Z","source_repo":".","compaction_level":0,"original_size":0}
 {"id":"dotfiles-8cbu","title":"Obsidian Insider CLI warning: installer/app mismatch (resolved)","description":"## Summary\nObsidian CLI emitted: \"Your Obsidian installer is out of date ... better CLI support\" while app logs showed `Loading updated app package ... obsidian-1.12.6.asar`.\n\n## Root cause\nInstaller/wrapper and app package were on different tracks:\n- `/Applications/Obsidian.app` wrapper metadata was old (1.8.9), which triggers CLI compatibility warning logic.\n- Insider auto-updater had already downloaded and loaded newer app package (`obsidian-1.12.6.asar`).\n\n## Resolution\n- Removed `\"obsidian\"` cask from `hosts/mactraitorpro/homebrew.nix` to avoid stable-track overwrite.\n- Uninstalled Homebrew Obsidian cask.\n- Rebuilt nix-darwin config (`./bin/hey re`) and verified Obsidian absent from managed casks.\n- Reinstalled Obsidian via Early Access (Insider) installer manually.\n\n## Verification\n- `obsidian --help` no longer prints installer mismatch warning.\n- CLI command list renders normally.\n- App still loads updated Insider package (`obsidian-1.12.6.asar`) and reports up-to-date.\n\n## Follow-up\nKeep Obsidian manually managed for Insider use; avoid re-adding the stable Homebrew cask in host config.\n","notes":"## How to check next time\nRun these commands:\n\n```bash\n# Wrapper/installer version\ndefaults read /Applications/Obsidian.app/Contents/Info CFBundleShortVersionString\ndefaults read /Applications/Obsidian.app/Contents/Info CFBundleVersion\n\n# CLI path in use\nwhich -a obsidian\n\n# Look for mismatch warning\nobsidian --help | head -n 20\nobsidian commands | head -n 20\n\n# Confirm runtime package being loaded\n# (usually shows updated Insider asar if Early Access is active)\ntail -n 30 ~/Library/Application\\ Support/obsidian/obsidian.log\n```\n\nInterpretation:\n- If CLI prints `Your Obsidian installer is out of date... better CLI support`, the wrapper/installer is stale.\n- If logs show `Loading/Loaded updated app package ... obsidian-<version>.asar`, the JS app package may still be newer than the wrapper.\n- If using Insider/Early Access, prefer manual installer management and avoid the stable Homebrew cask.","status":"closed","priority":2,"issue_type":"bug","owner":"git@edmundmiller.dev","created_at":"2026-03-20T00:31:18Z","created_by":"Edmund Miller","updated_at":"2026-03-20T01:50:30Z","closed_at":"2026-03-20T00:31:37Z","close_reason":"Resolved: removed Homebrew-managed Obsidian, rebuilt nix config, manually installed Early Access wrapper, and verified warning is gone.","source_repo":".","compaction_level":0,"original_size":0,"labels":["cli","homebrew","insider","nix-darwin","obsidian"]}