defaults.org is the literate source for my macOS preference changes. Its shell blocks tangle to macos. Edit the Org source and regenerate the script; do not maintain the two files independently. The generated file is not marked executable in Git, so apply it explicitly with:
sh macos/macosThe script changes system and application defaults and may request elevated privileges. It is an opt-in machine-setup action, not something that runs when the repository is cloned.
The four tracked plists under LaunchAgents/ are currently symlinked from
~/Library/LaunchAgents/. Their schedules and entry points are:
| Label | Schedule | Entry point |
|---|---|---|
com.stafforini.personal-updates.fast-brew | 03:00 daily | bin/personal-updates fast-brew |
com.stafforini.codex-protocol-watch | 04:15 daily | bin/codex-protocol-watch, run through ~/repos/launchd/bin/launchd-run-record |
com.stafforini.personal-updates.scan | 02:15 daily | bin/personal-updates scan |
com.stafforini.personal-updates.delayed | 05:00 daily | bin/personal-updates delayed --min-age-days 7 |
The plists write logs under ~/.local/state/ and use absolute paths into this
checkout. After changing a plist, reload its matching LaunchAgent before
treating the change as active.
The separate launchd repository owns scheduling for the reasoning-task
worktree sync; this repository only supplies the
=sync-reasoning-tasks-worktrees= command.
It also owns the daily com.stafforini.elpaca-cooldown.observe job (08:30),
which runs =bin/elpaca-cooldown observe= from this checkout.
It also owns com.stafforini.chrome-profile-focusd, the always-running server
behind the Karabiner Chrome profile keys (see bin/chrome-profile-focusd).
bin/personal-updates separates immediate tool updates from ordinary Homebrew
updates that should age before installation:
| Mode | Behavior |
|---|---|
fast-brew | Upgrades the fast lane; its built-in default is codex. Claude Code uses its native updater. |
scan | Records currently available formula and cask updates and when each version first appeared. |
delayed | Upgrades eligible entries after the configured minimum age, subject to holds and exclusions. |
fast | Installs recommended macOS system updates manually; it is not scheduled. |
The policy files are fast-brew.txt, hold.txt, and
excluded-casks.txt. Runtime state lives at
~/.local/state/personal-updates/state.json and logs live under the adjacent
logs/ directory. Dry-run the two mutating Homebrew lanes with:
bin/personal-updates fast-brew --dry-run
bin/personal-updates delayed --dry-runThe focused regression suite is:
python3 -m unittest tests.test_personal_updates -vPaired macOS-only skills live under macos/.claude/skills/ and
macos/.codex/skills/. They cover contact reconciliation, application inspection,
LuLu alert review and machine security audits, but they are not global skills:
agent discovery loads them only while working in this project scope. Their current names,
descriptions, and paths are generated in the
tracked agent skill inventory.
The audit-mac-app scanner emits bounded static observations and explicit
coverage gaps, not a safety verdict. Gatekeeper assessment and isolated Electron
extraction are selected separately; entitlement declarations are not privacy
grants. No target app is launched and no permissions are changed by the scan.
The reconcile-contacts helpers require explicit BBDB and Contacts source paths.
They compare a supported field projection and generate review-only identity
candidates, not executable merge/deletion batches. Equal counts do not establish
complete reconciliation; account scope, ambiguity and unassessed fields remain
part of the result.
The review-lulu-alert helper distinguishes incomplete captures from a verified
absence of alerts. Reviews do not answer prompts or alter rules; saved captures
remain historical evidence. Its routine tests use fixtures, with live
Accessibility checks reserved for a separately selected integration run.
The security-audit isolation checks include synthetic peer-process argument and environment probes. Filesystem and network restrictions alone are not accepted as evidence of credential separation.
Auditing the security-audit skill itself uses synthetic artifacts, not live environment scans. Its shell classifier reports incomplete coverage with a nonzero status and does not certify values from variable names. The credential incident helper keeps read-only operations free of state creation and serializes authorized updates from cooperating helper processes.
The design record for the read-only LuLu alert reviewer is retained at its local specification. Design records explain decisions; they are not loaded as executable configuration.
bin/epoch-doc-link creates ordinary Internet shortcuts whose URL has the form
epoch-doc:///document/DOC_ID. The local handler validates that form and
delegates to chrome-profile-open epoch, so links fail visibly instead of
falling back to another Chrome profile.
Install or repair the generated application outside Google Drive with:
~/bin/install-epoch-doc-handlerThe installer compiles and ad-hoc signs Epoch Document Link.app under
~/Applications, replaces only a bundle with identifier
com.stafforini.epoch-doc-handler, rolls back failed registration, and
registers the epoch-doc scheme with LaunchServices.