Check-in — 2026-07-24

Operator golden shell matured into a centrally pinned multi-runtime toolkit (Codex skills, then uv/mise/fvm + Tier-1/2 CLIs). This entry closes that milestone and records what is live vs still deferred.

TL;DR

Golden operator shell is no longer “zsh only”: Codex + skills, uv (Python 3.11–3.13), mise (Node 22 + operator CLIs), fvm (CLI), plus Tier-2 Go / just / rustup / sops / age and a shared gitconfig (delta pager). Pins live in one file. Graylog/octoprint stay out of scope. Git identity is intentionally not hand-edited per host — wait for SOPS automation.

Phase status

Area	Status	Notes
Operator shell (zsh/p10k/atuin)	Done	#111
Codex + ~/.agents/skills	Done	#115
Devtools Tier-1 (uv/mise/fvm/CLIs)	Done	#116
Devtools Tier-2 (Go/rust/sops/just/gitconfig)	Done in git; fleet re-apply in flight	#117
Per-host user.name / user.email	Done (SOPS)	secrets/operator/git-identity.sops.yaml → ~/.gitconfig.local

What shipped

• operator/devtools/versions.toml — single pin source
• Ansible operator-shell tags devtools + chezmoi; host_vars disable on graylog/octoprint
• Docs: operator-devtools.md, operator-codex.md

Known gaps / drift

• Some Whrrr/LXC hosts had Tier-1 + rustup from earlier push-mode but were missing Go/just/golden gitconfig until the post-merge fleet re-apply
• ~/.gitconfig includes ~/.gitconfig.local; identity is deployed from SOPS (Ben / not@realemail.app)
• Atuin account sync / Codex login remain owner-once where not already done

What remains

Priority	Owner vs agent	Item
P1	Agent	Finish --tags devtools,chezmoi on all in-scope hosts; verify Go/just/sops
P2	Agent	Dependabot hygiene (security + minor bumps)
P3	Owner	Atuin sync / codex login only where still needed

flowchart LR
  pins[versions.toml]
  pins --> ansible[operator-shell]
  pins --> bootstrap[bootstrap.sh]
  pins --> win[sync-windows.ps1]
  ansible --> hosts[in-scope hosts]
  skip[graylog octoprint]
  ansible -.-> skip