chore(deps): bump protobuf from 6.33.4 to 6.33.5 in /uv-global

.axiom.toml

@@ -0,0 +1,27 @@
+{
+	"data": "ENC[AES256_GCM,data:HFS8DcH8+tHPEknZaj+ldPicLJBWuT0+Lhwc440x5BoaZ7G8Ptq515kzroddn3PTTA2Qw/+xtvO+ZwhR9pm2oRG5p6aJi4N0IomoBTJ+0s0PQOzq+xShhK85YvVDjGrOAWVj3m9OqYkC8eKiFHnQE3WfNZUjYGBEQyGXcvhXhEBSYNgSU6Cse99+zaqWhZZOB+g3uQFUHlOCSDrAffhjk+l1IaYV59O+Vj0CN5luVAhXn20BoCbbDQvRDbl67XLCXUhrO+qtXWqFB0FapPdCDzMMwBuGxQ0GqWWohuDfgM1h9Fc/QQXjWFhJNW/0SWeRpIVEU1iJj3Ruj/BS5z1YC3BASMfNaM0dPEma2Zcg70RRHEb+BIVTpr7Z5RHScYX2rEEAOa6XNiosnNW3lp7bsARKoTAAQlmgvptdLjXSB6Nt/KVZsQEp3DbAcEmDeg4tmjEQRLGtIjk9mrcD3FBCeHgLjXg52DaqbUAXpmCdh3+S+FlysTVi287ZWfRZhgRJWy3KS6+hVe9cdpYKzg60QjkC3mLwkZ+Jz1jdMTz14r0xaAWOUaEaH2UFioseQOw/0BFjUt8wJSeZSiekUEyBR77W7tOQEijocVyZKI06JKGHDJTmtLXKPggAGeQB8d/+LXQJVNGcwTFReLs/a4olMeUaO9GV//JPDMNKBGq/JRAP96/zKPzXGDDgHf069T9ffe+LGRPa51V9U/+h+MXimWvdEBZlp3/srgZ001xaFcgIDKgM1pv/rgty2UJlPrJH06b+DTzlzd2lf7b23QKSx+kUucJVIIxl7fl4CjpmwNfML8NTlwBOn+sKOZjqSvoIquqSLDwReIuofRikjV2yiTS8lv8W8fPV9Hn5SVC/8MfTn9KTy5ORhbUPuenSDW5BVEJtcPRBIdeXTo+QZ0+J6+5gfl565exQJQaGrSD0gzMA7wuTcEHQJCFIaTj7IabdM2zayePZ+K6HLuaEtjy/2gCpg0N6VtC5jiWSgDmrZL83r8ztvKndk9QfWN5xBkwnN+3c/F/cfW35MaU=,iv:9ojnbWS7YLIIZ9KxW6c3BIwiIB5OCQaojpzecqPDHEo=,tag:0EqhDrEF0BfreOd7GfDufw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1j2lyxxhxj0g2fw05h8c856fjxy2f0salxlk78pwglpv2nxjm3ptsgxcce4",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dzJMbXBpZTZrQXBxOU9Y\nTUlYZzdmdEk1UnoxbjJ2ejZibEQ1OHRvekNVCm80bGhUeDJxNEsyeS9Gb1VJL2U1\nMUtDcEc2a3p0clQzbTBva0tNVS9udGcKLS0tIFNXUmQzd1lRRDlkMXpiSjkxV0pI\ndnQ1SER0ZFYrc3VaaXMvRWNkMGg2TjAK1z7lZdbULC/4UYtNaMH+azC+/rve7DPf\n3EWMue9Wzy/RbeYZf3A5v7/+rirP+2+A23q6jSKrqkYvq/Rc1ZE+Xw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age14vhzajp8xemrjzqh9gzf6rpy0sckf3sa4vfdf5u60xgrktnfxc0sx85uj6",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1OTRia1RueWVJWDBrbVNU\nSkhnVVpDRk96SkhvTVBTYjN1ckE4WUcrSkZVCjFpVkhTd0ZtTnlPVUZ4U1lhUTZr\nUUlEYWVNNEp2MWgzVjFGa0FqMmxqWFUKLS0tIHI3WE8rRStlUnJTS2c0UlR0TCtD\naHo5ZHZJdlVwMGF5a1h4TzdVR3hxR0EKVpwY7Rq894frCluPV3PvCuq8XYhkBEq7\nDsLfRqs0h7t5FtmmGZzVeIkrODWjR0RIzzmKqtyoc7Q7hiwpZVpLFg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1wzdqusx4v0wpn7lgda4x4tw3qkd4jlcyy89pxrh4g679m0ajadtsh49e6t",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvU1ZxTVNKRm44OGh6ci9G\nN2JkcVV4UTRtQkNGaUNZNWRtNVEyRHNtaHlJCkxSTHVncHAxbUY2K2t5Y1NHUXdB\ndHNSSzMxN0IyZ1hwaW9QSkpqTHRXQW8KLS0tIGhOZU9mR0ZMU0NNM2pOL0pDeXlG\nVWJsdVU5N01mSGVpcjliK1QzSUFHSzgKxRK3nvnoVYxJ7oG5smdZBHxIefBkJ+qX\n9VpQQOyPdlrW4XHiKr1yReY+vkBtAkp5ifuAp0sZ96UDh6SccgGidg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1qepnuljqzftv5sg72nj4wt0njcnezvnlhsq0dg8zqls5e2twzuwsyxklww",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZFhBNWczR0JiTVd1RVox\nZ2RqbFlXMFQ3UkZxVU01TVFYU2F1L1JWc0I4CmRNK1M1U1ptWis1YXRaVXRKNHNJ\nOUtETTQ0WVZvNG9PQ1F2elRHS1RhbUkKLS0tIC9EdXRqQUVyYjBlRjRLRm9KNFJY\nSDhNK0Jsak1QUll6bGttaXN0RnVQME0KrByAvYTEdwA1hpidCd//282s4bI5CZTQ\nz6XHWYRH8Cn+XVi2LTedp3lrnKWGkNFrzWQx3JJ9+OeuQ1Nks11ObA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-02-03T19:19:07Z",
+		"mac": "ENC[AES256_GCM,data:CLpFCY3rG18RsfMQdTL6sYaCpbBdj0+5m673vCUXKH+Dg9xoFT1CkRpl+WbaknsHzeUvmzHKWmSQ2Pq+Arue6n7qHuizM4rjGPrE1s5sSSVE5nY/R5bFWxIyx4Af/ALvdfDziwR3jf/c8zxC90UElLsiDV/9uXqPxVXxqBzzPU8=,iv:BrbIv1KUZz5YQ/ZCsC5LJb1r1lz4RVmWCVZLS7B4GZE=,tag:qh41aDCwUC8Vnyi28CSMow==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}

.github/workflows/flake-update.yml

@@ -0,0 +1,27 @@
+name: update flake inputs
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # mondays 9am UTC
+  workflow_dispatch:
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: DeterminateSystems/nix-installer-action@main
+
+      - run: nix flake update
+
+      - uses: peter-evans/create-pull-request@v5
+        with:
+          commit-message: "chore(nix): update flake inputs"
+          title: "chore(nix): update flake inputs"
+          body: |
+            automated flake.lock update.
+
+            run `nix flake check` locally before merging.
+          branch: flake-update
+          delete-branch: true

.gitignore

@@ -1 +1,3 @@
 .DS_Store
+result
+result-*

.sops.yaml

@@ -1,7 +1,31 @@
 keys:
-  - &user_bdsqqq age1wzdqusx4v0wpn7lgda4x4tw3qkd4jlcyy89pxrh4g679m0ajadtsh49e6t
+  - &user_bdsqqq age1j2lyxxhxj0g2fw05h8c856fjxy2f0salxlk78pwglpv2nxjm3ptsgxcce4
+  - &host_mbp_m2 age1j2lyxxhxj0g2fw05h8c856fjxy2f0salxlk78pwglpv2nxjm3ptsgxcce4
+  - &host_htz_relay age14vhzajp8xemrjzqh9gzf6rpy0sckf3sa4vfdf5u60xgrktnfxc0sx85uj6
+  - &host_r56 age1wzdqusx4v0wpn7lgda4x4tw3qkd4jlcyy89pxrh4g679m0ajadtsh49e6t
+  - &host_lgo_z2e age1qepnuljqzftv5sg72nj4wt0njcnezvnlhsq0dg8zqls5e2twzuwsyxklww
 creation_rules:
   - path_regex: secrets\.yaml$
     key_groups:
       - age:
           - *user_bdsqqq
+          - *host_mbp_m2
+          - *host_htz_relay
+          - *host_r56
+          - *host_lgo_z2e
+  - path_regex: cookies\.txt$
+    key_groups:
+      - age:
+          - *user_bdsqqq
+          - *host_mbp_m2
+          - *host_htz_relay
+          - *host_r56
+          - *host_lgo_z2e
+  - path_regex: \.axiom\.toml$
+    key_groups:
+      - age:
+          - *user_bdsqqq
+          - *host_mbp_m2
+          - *host_htz_relay
+          - *host_r56
+          - *host_lgo_z2e

AGENTS.md

@@ -0,0 +1,20 @@
+## verification
+
+this is a nix-darwin + home-manager config. changes must be verified by building.
+
+```bash
+# dry-run build (evaluates config, catches most errors)
+nix build .#darwinConfigurations.mbp-m2.system --dry-run   # darwin
+nix build .#nixosConfigurations.lgo-z2e.config.system.build.toplevel --dry-run  # nixos
+
+# full build (required before shipping)
+nix build .#darwinConfigurations.mbp-m2.system   # darwin
+nix build .#nixosConfigurations.lgo-z2e.config.system.build.toplevel  # nixos
+```
+
+**do not assume changes work.** nix evaluation errors, hash mismatches, and derivation failures only surface at build time. run the build yourself before asking the user to verify.
+
+common failure modes:
+- `hash mismatch` — upstream changed, update the hash
+- `cannot create file '/usr/local/...'` — derivation tries to escape sandbox, add `dontBuild` or fix installPhase
+- `attribute not found` — typo or missing import