Session record 2026-06-24: YubiKey inventory, GPG commit-signing plan,
reusable SPECCOL inventory/provisioning stick (dock-aware), and full
hardening + provisioning of the Dell Latitude E7250 as the dedicated
air-gapped keygen/forensic host (BIOS A24, Secure Boot, AMT off, radios
off, dist-upgraded, Phase-2 tooling installed). TPM 1.2-only (hardware
limit). Captures key gotchas (yubikey-manager package name, FAT32 +x,
TXT-before-TPM-clear, E7250 not on LVFS) and the refined architecture.
Baby-step plan for hardware-backed OpenPGP commit/tag signing on YubiKey 5
NFC #30836069 (air-gapped keygen, ed25519/cv25519 subkeys, 2y expiry, touch
required). LUKS-encrypted recovery backup on the Type-C USB stick; non-secret
config to be folded into ansible/. HTTPS+GPG-sign (lowest risk); 2nd YubiKey
scheduled as Phase 9 follow-up.
- Add hyprland.lua.j2 Ansible template with full Lua DSL config
- Update tasks to deploy hyprland.lua instead of hyprland.conf
- Add docs/tech/hyprland-lua-migration.md with API reference,
dispatcher mapping, pitfalls, and validation commands
- Update keybindings doc to reflect .lua config format
Co-authored-by: Junie <junie@jetbrains.com>
- New Ansible template for kitty.conf with window_title_bar
- Title bar shows: hostname | cwd | title on every tile
- Document title bar feature in keybindings cheatsheet
- SUPER+Q: killactive (was kitty)
- SUPER+T: exec kitty (new terminal binding)
- SUPER+C: removed (was killactive)
- All monitors set to 60Hz (DP-1 and HDMI-A-1 down from 144Hz)
- Deleted alesi-routine-morning.service and .timer from ~/.config/systemd/user/
- Timer failed daily at 07:45 (exit 128, git outside repo)
- daily-routine.sh script retained for manual use
- Updated CHANGELOG.md and workstation-health.md
Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API
hardware decode config for Chrome 148 on Wayland/Hyprland.
- Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error
- Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland)
- Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts
- Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux*
- Add gnome-libsecret password store for gnome-keyring integration
- Install libva-utils and libva-nvidia-driver packages
- Update driver version to 580.159.03 in hardware inventory
WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified
working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.
Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring
(local cache via org.freedesktop.secrets D-Bus). All apps (himalaya,
git, ssh-agent, JetBrains IDEs, browsers) now read secrets via
libsecret/secret-tool through gnome-keyring.
Changes:
- Install gnome-keyring + rbw, enable as systemd user service
- Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com)
- Migrate 45 meaningful entries from KWallet → BW + GK
- Switch git credential.helper from store to libsecret
- Document: one-pager, ADR, migration checklist, NEXT_STEPS update
- Skill: devops/secrets-migration for reuse
Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in
KWallet) and GitHub CLI token re-auth.
See docs/product/passwords.md for the full guide.
Hyprland 0.53+ requires launching via start-hyprland (watchdog) for
proper crash diagnostics and signal handling. Without it a warning
banner appears on login.
Override package-managed hyprland.desktop with local copy pointing to
start-hyprland. XDG_DATA_DIRS priority ensures the override wins
without modifying system files.
- ansible/roles/hyprland/tasks/main.yml: manage override in ~/.local/share/wayland-sessions/
- docs/adr/0004-start-hyprland-override.md: full decision record
- docs/hyprland-uwsm.md: document override behavior
- Post-update fio benchmark: random read +12.4%, write +15.9% IOPS
- Latency reduced 10-14% for random workloads
- SMART health unchanged: 0 media errors, 0 error log entries
- Firmware research status updated to complete
- Pre-benchmark checklist marked done
Comprehensive benchmark of Samsung PM9A1 NVMe SSD before firmware
update from GXA7401Q to GXA7802Q. Includes SMART health, hdparm,
and fio results (seq/rand read/write, 4K blocks, iodepth=32).
- Researched 7 component categories for available firmware updates
- NVMe SSD (PM9A1): update available GXA7401Q -> GXA7802Q
- Motherboard BIOS F53 is current (no update needed)
- SATA SSD 840 EVO, GPU GTX 1050 Ti: EOL, no updates
- NIC/CPU microcode: managed via kernel/firmware packages
- USB peripherals: no LVFS/fwupd support
- Recommend installing fwupd for future firmware management
- Created crash analysis for 2026-03-17 OOM event.
- Documented stability test results and memory tuning effects.
- Added PARA-structured workflows for EOD protocol.
- Updated workstation health report for current 16GB swap status.
- Delete deprecated CLAUDE.md
- Create root-level AGENTS.md for AI assistant guidance
- Create SDD constitution in .specify/memory/constitution.md
- Align documentation with PARA structure (docs/product/project-brief.md, docs/tech/stack.md, docs/plans/)
- Add standardized YAML frontmatter to all documentation files
- Update README.md with saTway branding and structure
- Synchronized Ansible roles with removed redundant packages.
- Performed system audit (performance, boot, disk usage).
- Organized home directory by removing 22 clean remote repositories.
- Reclaimed ~21GB of disk space in ~/Projects.
- Retained dirty repositories and those without remote origins for safety.
- Updated documentation (performance tuning, software stack, setup).
- Created NEXT_STEPS.md and documented learnings.
mw
ja
