Mac Studio primary-machine rollout and Ubuntu VM cutover

[arbiter-hd]

Goal

Make the Mac Studio the primary home machine and compute host, keep Ubuntu as the primary development workstation inside the Studio, keep the M4 Mac mini as the Hermes runtime, and use the future MacBook Air as the mobile gateway into the home lab.

Current state: Pre-arrival staging only. PR #116 adds the guarded mac-studio profile. No live host, VM, route, service, Apple Account, Tailscale state, or Ollama model should change before the hardware-arrival gate opens.

Target topology

MacBook Air [mobile gateway]
   |-- SSH / Screen Sharing --> Mac Studio
   |-- SSH / Screen Sharing --> Mac Mini
   |-- Tailscale SSH ---------> Mac Studio (as well as all VMs that are on Mac Studio)
   `-- Tailscale SSH ---------> M4 Mac mini

Mac Studio [primary controller and compute]
   |-- VMware + Vagrant ------> Ubuntu VM [inside Studio] playground
   |
   |-- Primary dev machine will Mac Studio itself (we will install dependencies using brew and mise, similar to the mac-mini)                           
   |-- native macOS ----------> Ollama [local AI]
   `-- SSH / Screen Sharing --> M4 Mac mini [Hermes runtime]
                                     `-- Hermes operations --> Home lab

Rollout path (need to update the roll out path because at moment do not have a mac air)

[PR #116 stages the profile]
              |
              v
      {Has Studio arrived?} -- no --> [STOP: preview and docs only]
              |
             yes
              v
 [Manual macOS + network setup]
              |
              v
    [Apply with ARRIVED gate]
              |
              v
         [Studio doctor]
              |
              v
 [Back up + halt old Ubuntu VM]
              |
              v
 [Rebuild Ubuntu inside Studio]
              |
              v
 [Validate locally before Tailscale]
              |
              v
 [Retire old node + enroll ubuntu-dev]
              |
              v
        [CUTOVER doctor]
              |
              v
      [MacBook Air remote QA]
              |
              v
 [Activate four-host topology + sync]

Ownership map

Device	Primary role	Dotfiles own	Machine-owned state
Mac Studio	Main controller, VM host, local AI	mac-studio profile, shell, packages, VM commands, doctors	Apple Account, Remote Login, Screen Sharing, Tailscale enrollment, SSH keys, Ollama models
Ubuntu VM	Primary development workstation inside Studio	Vagrant definition, guest provisioning, development config	Project secrets, databases, VM-local credentials and data
MacBook Air	Mobile gateway while away	Existing mac-thin profile	Apple Account, Tailscale enrollment, SSH keys
M4 Mac mini	Hermes production runtime	Existing guarded mac-mini profile	Dedicated Apple Account, Hermes runtime state, production secrets

Phase 0: finish staging

• Review and merge PR feat: add staged Mac Studio profile #116 after hd719 approves its current head.
• Keep current thin-Mac, Ubuntu, and Mac-mini routing unchanged before arrival.
• Keep the global machine-topology, dotfiles-sync, personal-ready, and sync-coding-prompts definitions on the current three-host topology until cutover.

Phase 1: prepare the Studio

• Complete macOS updates and sign in with the personal Apple Account.
• Install Xcode Command Line Tools, Homebrew, and VMware Fusion; finish VMware first-run setup manually.
• Enable and verify Remote Login and Screen Sharing.
• Enroll the Studio in Tailscale with a stable machine name.
• Create machine-local SSH keys and authentication; never copy private keys, tokens, .env files, or production secrets between hosts.

Phase 2: apply and verify the Studio profile

• Clone dotfiles-hd at ~/Developer/dotfiles-hd.
• Run the mac-studio dry-run and check.
• After reviewing both, apply with DOTFILES_MAC_STUDIO_ARRIVED=1.
• Pass hosts/shared/macos/doctor.sh --profile mac-studio.
• Confirm Ollama is installed but no service or model pull runs automatically.
• Select and test local models after the base host is healthy; keep ~/.ollama machine-owned.

Phase 3: move Ubuntu into the Studio

• Back up and verify uncommitted repositories, databases, and other VM-local data.
• Record the old VM SSH host-key and Git-key fingerprints.
• Halt the old VM and keep it recoverable; never run both ubuntu-dev identities together.
• Rebuild Ubuntu from the tracked Vagrant definition without a Tailscale auth key first.
• Verify localhost SSH, provisioning, repositories, tools, and restored data.
• Retire the old Tailscale node, enroll the new VM as ubuntu-dev, and verify the new host fingerprint.
• Pass the Ubuntu doctor and DOTFILES_MAC_STUDIO_CUTOVER=1 hosts/shared/macos/doctor.sh --profile mac-studio.
• Destroy the old VM and remove its registered Git keys only after explicit approval.

Phase 4: remote-controller QA

• From the Studio, control Ubuntu, the Mac mini, and the home lab.
• Configure the MacBook Air with the existing mac-thin profile and personal Apple Account.
• From the Air, reach the Studio, Ubuntu, and Mac mini over Tailscale.
• Prove that the Air works as the away-from-home gateway without changing the Mac mini role.
• Keep the Mac mini on its existing dedicated Apple Account and as the Hermes runtime.

Phase 5: activate the new topology

• Update the canonical vault machine-topology rule after live cutover.
• Update dotfiles-sync, personal-ready, and sync-coding-prompts for the verified four-host topology.
• Run final readiness and recovery checks from both the Studio and Air.
• Record the accepted hostnames, SSH routes, and rollback procedure without storing secrets.

Acceptance criteria

• Mac Studio is the primary machine and can control the full home environment.
• Ubuntu runs inside the Studio and remains the primary development workstation.
• MacBook Air is a working mobile gateway to Studio, Ubuntu, and Mac mini.
• Mac mini remains the stable Hermes production runtime.
• Ollama runs locally with models and cache owned only by the Studio.
• No duplicate Ubuntu identity, copied secret, or unapproved live-host mutation occurred.

Out of scope

• Additional VM definitions beyond Ubuntu.
• Switching the Mac mini Apple Account.
• Automatic Ollama model downloads or service startup.
• Production Hermes or home-lab service changes.
• Copying private keys, credentials, databases, or mutable application state between hosts.

Related

• Staged implementation: feat: add staged Mac Studio profile #116
• Studio runbook: hosts/mac-studio/README.md
• Ubuntu runbook: hosts/ubuntu-dev/README.md