feat: stage native Studio development and lightweight Air access

AGENTS.md

@@ -16,13 +16,15 @@ constraints, and agent workflow policy here.
 
 ## Profile Routing
 
-| Target                                     | Source of truth                      |
-| ------------------------------------------ | ------------------------------------ |
-| Thin personal MacBook (`mac-thin`)         | `hosts/mac-thin/README.md`           |
-| Standalone development MacBook (`mac-pro`) | `hosts/mac-pro/README.md`             |
-| Personal Mac mini (`mac-mini`)             | `hosts/mac-mini/README.md`            |
-| Resilience work Mac (`mac-work`)           | `hosts/mac-work/README.md`            |
-| Ubuntu workstation                         | `hosts/ubuntu-dev/README.md`          |
+| Target                                     | Source of truth              |
+| ------------------------------------------ | ---------------------------- |
+| Thin personal MacBook (`mac-thin`)         | `hosts/mac-thin/README.md`   |
+| Future access-only Air (`mac-air`)         | `hosts/mac-air/README.md`    |
+| Staged primary Mac Studio (`mac-studio`)   | `hosts/mac-studio/README.md` |
+| Standalone development MacBook (`mac-pro`) | `hosts/mac-pro/README.md`    |
+| Personal Mac mini (`mac-mini`)             | `hosts/mac-mini/README.md`   |
+| Resilience work Mac (`mac-work`)           | `hosts/mac-work/README.md`   |
+| Ubuntu workstation                         | `hosts/ubuntu-dev/README.md` |
 
 `config/` holds portable configuration and must not be reorganized casually.
 `chezmoi/` owns approved user-config delivery and rollback. `hosts/` owns
@@ -61,6 +63,15 @@ host-specific provisioning, lifecycle, maintenance, doctors, and runbooks.
 If Hamel explicitly asks for one link, create it safely. Do not expand that
 request into a full-machine migration.
 
+The `mac-studio` profile is pre-arrival staging. Do not apply it, move or
+destroy the Ubuntu VM, or change live host routing until the Studio arrives
+and Hamel approves the cutover gates in its runbook. Studio apply requires
+`DOTFILES_MAC_STUDIO_ARRIVED=1`; never set it on another host.
+The future `mac-air` client profile requires `DOTFILES_MAC_AIR_ARRIVED=1` on
+that device. Follow the Studio runbook for native development, dormant Ubuntu
+preservation, mini development isolation, and the later Air rollout. Update
+canonical topology and sync policies only after verified live cutover.
+
 ## Package Ownership
 
 - Mac package policy lives only in `hosts/shared/macos/Brewfile` and the

README.md

@@ -4,13 +4,15 @@ Hamel's profile-aware dotfiles, provisioning, and machine operations.
 
 ## Choose a Host
 
-| Host | Role | Entry point |
-| --- | --- | --- |
-| Thin Mac | Control plane for Codex, SSH, Vagrant, and VMware Fusion | [`hosts/mac-thin/README.md`](hosts/mac-thin/README.md) |
-| Ubuntu dev | Primary VM development workstation | [`hosts/ubuntu-dev/README.md`](hosts/ubuntu-dev/README.md) |
-| Mac Pro | Standalone full-development MacBook; local Brew stack, no VM | [`hosts/mac-pro/README.md`](hosts/mac-pro/README.md) |
-| Mac mini | Production runtime host | [`hosts/mac-mini/README.md`](hosts/mac-mini/README.md) |
-| Work Mac | Company-scoped terminal and editor setup | [`hosts/mac-work/README.md`](hosts/mac-work/README.md) |
+| Host       | Role                                                               | Entry point                                                |
+| ---------- | ------------------------------------------------------------------ | ---------------------------------------------------------- |
+| Thin Mac   | Control plane for Codex, SSH, Vagrant, and VMware Fusion           | [`hosts/mac-thin/README.md`](hosts/mac-thin/README.md)     |
+| Ubuntu dev | Primary VM development workstation                                 | [`hosts/ubuntu-dev/README.md`](hosts/ubuntu-dev/README.md) |
+| Mac Studio | Staged native development workstation; dormant Ubuntu and local AI | [`hosts/mac-studio/README.md`](hosts/mac-studio/README.md) |
+| Future Air | Lightweight clients and remote Studio access; no VMware            | [`hosts/mac-air/README.md`](hosts/mac-air/README.md)       |
+| Mac Pro    | Standalone full-development MacBook; local Brew stack, no VM       | [`hosts/mac-pro/README.md`](hosts/mac-pro/README.md)       |
+| Mac mini   | Production with explicitly selected secondary development          | [`hosts/mac-mini/README.md`](hosts/mac-mini/README.md)     |
+| Work Mac   | Company-scoped terminal and editor setup                           | [`hosts/mac-work/README.md`](hosts/mac-work/README.md)     |
 
 Clone at the canonical path:
 
@@ -33,6 +35,8 @@ dotfiles-hd/
 │   ├── tests/               one host-validation runner
 │   ├── shared/macos/        shared full-Mac provisioning and doctor
 │   ├── mac-thin/            control plane and VM lifecycle
+│   ├── mac-studio/          staged native development and dormant Ubuntu
+│   ├── mac-air/             future lightweight remote clients
 │   ├── ubuntu-dev/          Vagrant guest provisioning and maintenance
 │   ├── mac-pro/             standalone development MacBook policy
 │   ├── mac-mini/            production runtime Mac policy
@@ -59,6 +63,13 @@ hosts/mac-thin/bootstrap.sh --apply
 uvm-up
 ```
 
+Staged Mac Studio profile (do not apply before arrival):
+
+```bash
+hosts/shared/macos/bootstrap.sh --profile mac-studio --dry-run
+hosts/shared/macos/bootstrap.sh --profile mac-studio --check
+```
+
 Standalone full-development MacBook:
 
 ```bash
@@ -86,6 +97,7 @@ gates pass.
 
 - `chezmoi/` owns approved user configuration links and timestamped rollback.
 - `hosts/mac-thin/` owns the Vagrant and VMware lifecycle.
+- `hosts/mac-studio/` owns native development and preserves dormant Ubuntu after approved cutover.
 - `hosts/ubuntu-dev/` owns guest provisioning and workstation maintenance.
 - `hosts/shared/macos/` owns common full-Mac packages and operational setup.
 - `hosts/mac-pro/` and `hosts/mac-mini/` own profile package overlays and shell entry points.

chezmoi/README.md

@@ -9,13 +9,15 @@ services, secrets, identity, enrollment, macOS preferences, or mutable state.
 
 ## Profiles
 
-| Profile | Host | Package behavior |
-| --- | --- | --- |
-| `ubuntu` | Ubuntu development VM | Installs the declared mise toolchain |
-| `mac-thin` | Thin Mac control plane | Installs the thin Brewfile |
-| `mac-pro` | Standalone full-development MacBook | Installs shared and profile Brewfiles through the Mac bootstrap |
-| `mac-mini` | Production Mac mini | Configuration-only inside Chezmoi; packages stay in the guarded Mac bootstrap |
-| `mac-work` | Resilience work Mac | Reserved for a later opt-in rollout |
+| Profile      | Host                                                   | Package behavior                                                              |
+| ------------ | ------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| `ubuntu`     | Ubuntu development VM                                  | Installs the declared mise toolchain                                          |
+| `mac-thin`   | Thin Mac control plane                                 | Installs the thin Brewfile                                                    |
+| `mac-air`    | Future thin-Mac clients and note tools; no VMware      | Installs the Air Brewfile and thin Neovim plugins                             |
+| `mac-pro`    | Standalone full-development MacBook                    | Installs shared and profile Brewfiles through the Mac bootstrap               |
+| `mac-studio` | Staged native development, dormant Ubuntu and local AI | Installs shared and profile Brewfiles through the Mac bootstrap               |
+| `mac-mini`   | Production Mac mini                                    | Configuration-only inside Chezmoi; packages stay in the guarded Mac bootstrap |
+| `mac-work`   | Resilience work Mac                                    | Reserved for a later opt-in rollout                                           |
 
 Each `profiles/*.paths` file is the exact backup, apply, doctor, and rollback
 allowlist. A matching `*.ancestors` file records parent directories whose
@@ -27,7 +29,8 @@ original type must be restored exactly.
 ./chezmoi/bootstrap.sh ubuntu --preview
 ```
 
-Substitute `mac-thin`, `mac-pro`, `mac-mini`, or `mac-work` as needed.
+Substitute `mac-thin`, `mac-air`, `mac-pro`, `mac-studio`, `mac-mini`, or `mac-work` as
+needed.
 
 After review and host approval:
 
@@ -79,5 +82,5 @@ CHEZMOI_BIN="$HOME/.local/bin/chezmoi" \
   bash chezmoi/tests/production-test.sh
 ```
 
-The test renders and exercises all five profiles in temporary homes. It covers
+The test renders and exercises all supported profiles in temporary homes. It covers
 backup, apply, second-apply idempotence, doctor, rollback, and recovery/reapply.

chezmoi/apply.sh

@@ -9,6 +9,10 @@ validate_profile_os
 require_canonical_checkout
 [[ "${DOTFILES_CHEZMOI_APPROVED:-0}" == 1 ]] \
   || die "set DOTFILES_CHEZMOI_APPROVED=1 after approving this host and preview"
+[[ "$PROFILE" != mac-studio || "${DOTFILES_MAC_STUDIO_ARRIVED:-0}" == 1 ]] \
+  || die "mac-studio apply requires DOTFILES_MAC_STUDIO_ARRIVED=1 after the hardware arrives"
+[[ "$PROFILE" != mac-air || "${DOTFILES_MAC_AIR_ARRIVED:-0}" == 1 ]] \
+  || die "mac-air apply requires DOTFILES_MAC_AIR_ARRIVED=1 after the hardware arrives"
 [[ "$PROFILE" != mac-mini || "${DOTFILES_MAC_MINI_CONFIG_ONLY:-0}" == 1 ]] \
   || die "Mac mini requires DOTFILES_MAC_MINI_CONFIG_ONLY=1"
 [[ "$PROFILE" != mac-work || "${DOTFILES_WORK_MAC_OPT_IN:-0}" == 1 ]] \
@@ -34,9 +38,9 @@ if [[ -n "$PROFILE_ANCESTORS" ]]; then
       prepared="$backup_dir/prepared-ancestors/$relative"
       mkdir -p "$(dirname "$prepared")"
       mv "$target" "$prepared"
-      mkdir -m "$managed_mode" "$target"
+      mkdir -p -m "$managed_mode" "$target"
     elif [[ ! -e "$target" ]]; then
-      mkdir -m "$managed_mode" "$target"
+      mkdir -p -m "$managed_mode" "$target"
     fi
   done < "$PROFILE_ANCESTORS"
   while IFS='|' read -r relative _source; do

chezmoi/bootstrap.sh

@@ -4,11 +4,11 @@ profile="${1:-}"; mode="${2:---preview}"; version="v2.72.0"
 script_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)"
 bin="${CHEZMOI_BIN:-$HOME/.local/bin/chezmoi}"
 case "$profile:$mode" in
-  ubuntu:--preview|ubuntu:--apply|mac-thin:--preview|mac-thin:--apply|mac-pro:--preview|mac-pro:--apply|mac-mini:--preview|mac-mini:--apply|mac-work:--preview|mac-work:--apply) ;;
-  *) echo "usage: $0 ubuntu|mac-thin|mac-pro|mac-mini|mac-work --preview|--apply" >&2; exit 2 ;;
+  ubuntu:--preview|ubuntu:--apply|mac-thin:--preview|mac-thin:--apply|mac-air:--preview|mac-air:--apply|mac-pro:--preview|mac-pro:--apply|mac-studio:--preview|mac-studio:--apply|mac-mini:--preview|mac-mini:--apply|mac-work:--preview|mac-work:--apply) ;;
+  *) echo "usage: $0 ubuntu|mac-thin|mac-air|mac-pro|mac-studio|mac-mini|mac-work --preview|--apply" >&2; exit 2 ;;
 esac
 case "$profile:$(uname -s)" in
-  ubuntu:Linux|mac-thin:Darwin|mac-pro:Darwin|mac-mini:Darwin|mac-work:Darwin) ;;
+  ubuntu:Linux|mac-thin:Darwin|mac-air:Darwin|mac-pro:Darwin|mac-studio:Darwin|mac-mini:Darwin|mac-work:Darwin) ;;
   *) [ "${DOTFILES_CHEZMOI_TEST:-0}" = 1 ] || { echo "profile/OS mismatch" >&2; exit 1; } ;;
 esac
 if [ "$mode" = --apply ] || [ "${DOTFILES_CHEZMOI_REQUIRE_REVIEWED:-0}" = 1 ]; then

chezmoi/lib.sh

@@ -21,8 +21,8 @@ die() {
 load_profile() {
   PROFILE="${1:-}"
   case "$PROFILE" in
-    ubuntu|mac-thin|mac-pro|mac-mini|mac-work) ;;
-    *) die "profile must be ubuntu, mac-thin, mac-pro, mac-mini, or mac-work" ;;
+    ubuntu|mac-thin|mac-air|mac-pro|mac-studio|mac-mini|mac-work) ;;
+    *) die "profile must be ubuntu, mac-thin, mac-air, mac-pro, mac-studio, mac-mini, or mac-work" ;;
   esac
   PROFILE_CONFIG="$PROFILES_DIR/$PROFILE.toml"
   PROFILE_MANIFEST="$PROFILES_DIR/$PROFILE.paths"
@@ -46,7 +46,7 @@ activate_profile() {
 validate_profile_os() {
   [[ "${DOTFILES_CHEZMOI_TEST:-0}" == 1 ]] && return
   case "$PROFILE:$(uname -s)" in
-    ubuntu:Linux|mac-thin:Darwin|mac-pro:Darwin|mac-mini:Darwin|mac-work:Darwin) ;;
+    ubuntu:Linux|mac-thin:Darwin|mac-air:Darwin|mac-pro:Darwin|mac-studio:Darwin|mac-mini:Darwin|mac-work:Darwin) ;;
     *) die "$PROFILE does not match $(uname -s)" ;;
   esac
 }

chezmoi/preview.sh

@@ -75,10 +75,10 @@ if [[ "${DOTFILES_CHEZMOI_CONFIG_ONLY_PREVIEW:-0}" != 1 ]]; then
       command -v mdformat >/dev/null 2>&1 \
         || printf '  install pinned mdformat bundle\n'
       ;;
-    mac-thin)
+    mac-thin|mac-air)
       if command -v brew >/dev/null 2>&1; then
         HOMEBREW_NO_AUTO_UPDATE=1 brew bundle check --verbose \
-          --file "$REPO_DIR/hosts/mac-thin/Brewfile" || true
+          --file "$REPO_DIR/hosts/$PROFILE/Brewfile" || true
       else
         printf '  Homebrew is required before the approved apply\n'
       fi
@@ -96,6 +96,16 @@ if [[ "${DOTFILES_CHEZMOI_CONFIG_ONLY_PREVIEW:-0}" != 1 ]]; then
         printf '  Homebrew is required before the approved apply\n'
       fi
       ;;
+    mac-studio)
+      if command -v brew >/dev/null 2>&1; then
+        HOMEBREW_NO_AUTO_UPDATE=1 brew bundle check --verbose \
+          --file "$REPO_DIR/hosts/shared/macos/Brewfile" || true
+        HOMEBREW_NO_AUTO_UPDATE=1 brew bundle check --verbose \
+          --file "$REPO_DIR/hosts/mac-studio/Brewfile" || true
+      else
+        printf '  Homebrew is required before the approved apply\n'
+      fi
+      ;;
     mac-work)
       if command -v brew >/dev/null 2>&1; then
         HOMEBREW_NO_AUTO_UPDATE=1 brew bundle check --verbose \

chezmoi/profiles/mac-air.ancestors

@@ -0,0 +1 @@
+.config/fastfetch|config/fastfetch|700

chezmoi/profiles/mac-air.paths

@@ -0,0 +1,13 @@
+.zshrc|hosts/mac-air/.zshrc
+.config/zsh|config/zsh
+.config/bookokrat|config/bookokrat
+.config/fastfetch/config.jsonc|config/fastfetch/config.jsonc
+.config/fastfetch/logo-anon-glitch.txt|config/fastfetch/logo-anon-glitch.txt
+.config/fastfetch/logo-anon.txt|config/fastfetch/logo-anon.txt
+Library/Application Support/com.mitchellh.ghostty/config|hosts/mac-air/ghostty.conf
+.config/herdr/config.toml|config/herdr/config.toml
+.config/hunk/config.toml|config/hunk/config.toml
+.config/homebrew/Brewfile|hosts/mac-air/Brewfile
+.config/nvim|config/nvim
+.config/starship.toml|config/starship/starship.toml
+.terminfo/78/xterm-ghostty|@absolute:/Applications/Ghostty.app/Contents/Resources/terminfo/78/xterm-ghostty

chezmoi/profiles/mac-air.toml

@@ -0,0 +1,2 @@
+[data]
+profile = "mac-air"

chezmoi/profiles/mac-studio.ancestors

@@ -0,0 +1,3 @@
+.config/btop|config/btop|700
+.config/fastfetch|config/fastfetch|700
+.config/mise|config/mise|700

chezmoi/profiles/mac-studio.paths

@@ -0,0 +1,14 @@
+.zshrc|hosts/mac-studio/.zshrc
+.config/zsh|config/zsh
+.config/bookokrat|config/bookokrat
+.config/btop/btop.conf|config/btop/btop.conf
+.config/btop/themes|config/btop/themes
+.config/fastfetch/config.jsonc|config/fastfetch/config.jsonc
+.config/fastfetch/logo-anon-glitch.txt|config/fastfetch/logo-anon-glitch.txt
+.config/fastfetch/logo-anon.txt|config/fastfetch/logo-anon.txt
+Library/Application Support/com.mitchellh.ghostty/config|config/ghostty/config
+.config/herdr/config.toml|config/herdr/config.toml
+.config/hunk/config.toml|config/hunk/config.toml
+.config/mise/config.toml|config/mise/config.toml
+.config/nvim|config/nvim
+.config/starship.toml|config/starship/starship.toml

chezmoi/profiles/mac-studio.toml

@@ -0,0 +1,2 @@
+[data]
+profile = "mac-studio"

chezmoi/source/.chezmoiignore.tmpl

@@ -54,9 +54,24 @@ Library
 30-install-thin-tools.sh
 40-install-work-tools.sh
 {{- end }}
+{{- if eq .profile "mac-studio" }}
+.config/homebrew
+.hermes
+.terminfo
+20-install-ubuntu-tools.sh
+30-install-thin-tools.sh
+40-install-work-tools.sh
+{{- end }}
 {{- if eq .profile "mac-work" }}
 .hermes
 .terminfo
 20-install-ubuntu-tools.sh
 30-install-thin-tools.sh
 {{- end }}
+{{- if eq .profile "mac-air" }}
+.config/btop
+.config/mise
+.hermes
+20-install-ubuntu-tools.sh
+40-install-work-tools.sh
+{{- end }}

chezmoi/source/dot_config/homebrew/symlink_Brewfile.tmpl

@@ -1,5 +1,7 @@
 {{- if eq .profile "mac-thin" -}}
 {{ joinPath .chezmoi.sourceDir ".." ".." "hosts" "mac-thin" "Brewfile" }}
+{{- else if eq .profile "mac-air" -}}
+{{ joinPath .chezmoi.sourceDir ".." ".." "hosts" "mac-air" "Brewfile" }}
 {{- else -}}
 {{ joinPath .chezmoi.sourceDir ".." ".." "hosts" "mac-work" "Brewfile" }}
 {{- end -}}

chezmoi/source/private_Library/private_Application Support/private_com.mitchellh.ghostty/symlink_config.tmpl

@@ -1 +1,5 @@
+{{- if eq .profile "mac-air" -}}
+{{ joinPath .chezmoi.sourceDir ".." ".." "hosts" "mac-air" "ghostty.conf" }}
+{{- else -}}
 {{ joinPath .chezmoi.sourceDir ".." ".." "config" "ghostty" "config" }}
+{{- end -}}

chezmoi/source/run_onchange_after_30-install-thin-tools.sh.tmpl

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 {{- $repo := joinPath .chezmoi.sourceDir ".." ".." }}
-# brew: {{ output "git" "-C" $repo "hash-object" "hosts/mac-thin/Brewfile" | trim }}
+# brew: {{ output "git" "-C" $repo "hash-object" (printf "hosts/%s/Brewfile" .profile) | trim }}
 # nvim: {{ output "git" "-C" $repo "hash-object" "config/nvim/lazy-lock.json" | trim }}
 brewfile="$HOME/.config/homebrew/Brewfile"
 lockfile="$HOME/.config/nvim/lazy-lock.json"

chezmoi/source/symlink_dot_zshrc.tmpl

@@ -3,8 +3,12 @@
 {{ joinPath $repo "hosts" "ubuntu-dev" ".zshrc" }}
 {{- else if eq .profile "mac-thin" -}}
 {{ joinPath $repo "hosts" "mac-thin" ".zshrc" }}
+{{- else if eq .profile "mac-air" -}}
+{{ joinPath $repo "hosts" "mac-air" ".zshrc" }}
 {{- else if eq .profile "mac-pro" -}}
 {{ joinPath $repo "hosts" "mac-pro" ".zshrc" }}
+{{- else if eq .profile "mac-studio" -}}
+{{ joinPath $repo "hosts" "mac-studio" ".zshrc" }}
 {{- else if eq .profile "mac-mini" -}}
 {{ joinPath $repo "hosts" "mac-mini" ".zshrc" }}
 {{- end -}}

chezmoi/tests/production-test.sh

@@ -178,16 +178,16 @@ set -e
 ((layout_status != 0))
 [[ "$layout_output" == *"unapproved mac-thin symlink parent"* ]]
 
-for profile in ubuntu mac-thin mac-pro mac-mini mac-work; do
+for profile in ubuntu mac-thin mac-air mac-pro mac-studio mac-mini mac-work; do
   home_dir="$case_dir/$profile/home"
   state_dir="$case_dir/$profile/state"
   mkdir -p "$home_dir" "$state_dir"
   case "$profile" in
     ubuntu) mkdir -p "$home_dir/.config/btop" "$home_dir/.config/fastfetch" ;;
-    mac-pro|mac-mini) prepare_mac_mini_home "$home_dir" ;;
+    mac-pro|mac-studio|mac-mini) prepare_mac_mini_home "$home_dir" ;;
   esac
   prepare_profile_parents "$profile" "$home_dir"
-  if [[ "$profile" == mac-thin ]]; then
+  if [[ "$profile" == mac-thin || "$profile" == mac-air ]]; then
     chmod 700 "$home_dir/.config" "$home_dir/.config/fastfetch"
   fi
   common=(
@@ -206,8 +206,9 @@ for profile in ubuntu mac-thin mac-pro mac-mini mac-work; do
 
   case "$profile" in
     ubuntu) printf '%s\n' 10-configure-git.sh 20-install-ubuntu-tools.sh ;;
-    mac-thin) printf '%s\n' 10-configure-git.sh 30-install-thin-tools.sh ;;
+    mac-thin|mac-air) printf '%s\n' 10-configure-git.sh 30-install-thin-tools.sh ;;
     mac-pro) printf '%s\n' 10-configure-git.sh ;;
+    mac-studio) printf '%s\n' 10-configure-git.sh ;;
     mac-mini) printf '%s\n' 10-configure-git.sh ;;
     mac-work) printf '%s\n' 10-configure-git.sh 40-install-work-tools.sh ;;
   esac > "$case_dir/$profile.expected-scripts"
@@ -235,7 +236,7 @@ for profile in ubuntu mac-thin mac-pro mac-mini mac-work; do
     [[ -z "$("$CHEZMOI_BIN" "${common[@]}" status --exclude=scripts,dirs)" ]]
     "$CHEZMOI_BIN" "${common[@]}" verify --exclude=scripts,dirs
     [[ "$(path_mode "$home_dir/.config")" == 700 ]]
-    if [[ "$profile" == mac-thin ]]; then
+    if [[ "$profile" == mac-thin || "$profile" == mac-air ]]; then
       [[ "$(path_mode "$home_dir/.config/fastfetch")" == 700 ]]
     fi
     if [[ "$profile" == mac-mini ]]; then
@@ -254,6 +255,23 @@ for profile in ubuntu mac-thin mac-pro mac-mini mac-work; do
     bash "$CHEZMOI_DIR/doctor.sh" "$profile" >/dev/null
 done
 
+for staged_profile in mac-studio mac-air; do
+  guard_home="$case_dir/$staged_profile-guard/home"
+  guard_state="$case_dir/$staged_profile-guard/state"
+  mkdir -p "$guard_home" "$guard_state"
+  set +e
+  guard_output="$({
+    DOTFILES_CHEZMOI_TEST=1 DOTFILES_CHEZMOI_APPROVED=1 \
+      CHEZMOI_BIN="$CHEZMOI_BIN" CHEZMOI_DESTINATION="$guard_home" \
+      CHEZMOI_STATE_DIR="$guard_state" \
+      bash "$CHEZMOI_DIR/apply.sh" "$staged_profile"
+  } 2>&1)"
+  guard_status=$?
+  set -e
+  ((guard_status != 0))
+  [[ "$guard_output" == *"$staged_profile apply requires DOTFILES_MAC_"* ]]
+done
+
 rollback_home="$case_dir/rollback/home"
 rollback_state="$case_dir/rollback/state"
 rollback_backups="$case_dir/rollback/backups"