Skip to content
Digital Nestby Ulises Jeremias

Epic G · Agentic Workstation · Personal DX graph

Agentic Workstation — thin machine, fat capabilities

Graph-like Personal DX: optional HorneroConfig desktop, Workstation machine (L1), Toolkit capabilities (L1.5), Harness runtime (L2), and project overlay (L3). Provisioning via chezmoi; capabilities live in agent-toolkit.

Thin workstationNo embedded skills · toolkit delegates via uv
Explore layers ↓Provisioning & doctorchezmoi init --apply ulises-jeremias/agentic-workstation

A graph, not a forced ladder

The Digital Nest Personal DX stack is graph-like. HorneroConfig is an optional desktop surface (L0), not a required predecessor. Workstation provisions the machine (L1),agent-toolkit distributes capabilities (L1.5), and the harness/overlay holds memory and run state (L2/L3). The workstation stays thin: it ships no embeddedskills/*, loops/*, or mcp/* — onlydev-companion/runner. Everything else is delegated to agent-toolkit viauv tool install --force agent-toolkit-cli && agent-toolkit install.

DotfilesHorneroConfig · Hyprland + Quickshell · 22 rices · smart-colors
Machine provisioningchezmoi apply · packages · shell · dots-* thin helpers
LLM policyenv.d · DOTS_AI_DEVCOMPANION_LLM_ALLOWLIST · strict=1 · llm-status gate
Toolingagent-toolkit · 61 skills · 16 agents · 10 loops · MCP · SKILL.md catalog

The 4-layer DX stack

Four layers, one continuous system: dotfiles paint the desktop, machine provisioning boots the host,LLM policy gates the model, tooling delivers every capability. Delegation only — no duplication.

Agentic Workstation — 4-layer DX stackDotfiles layer provides HorneroConfig desktop. Machine provisioning layer uses chezmoi to install packages and shell. LLM policy layer enforces provider allowlist via env.d. Tooling layer distributes 61 skills and 16 agents via agent-toolkit. Harness runtime consumes all layers.DX STACK · 4 LAYERS · THIN WORKSTATIONL0 DOTFILESHorneroConfigHyprland + Quickshell · smart-colors · 22 rices · chezmoi home/dotfiles — desktop personalization · theme-intelligence · delivers ~/.config/hypr & quickshellL1 MACHINE PROVISIONINGAgentic Workstationchezmoi apply · packages · shell · dots-doctor · thin helpersthin — ships no embedded skills · keeps only dev-companion/runner · chezmoi init --applyL1 LLM POLICYLLM Policyenv.d · provider allowlist · DOTS_AI_DEVCOMPANION_LLM_STRICT~/.config/agentic-workstation/env.d/*.env · never committed · dots-devcompanion llm-statusL1.5 TOOLINGAgent Toolkit61 skills · 16 agents · 10 loops · MCP · 7 profiles · SKILL.md catalogsole source via uv tool install --force agent-toolkit-cli && agent-toolkit installIdentity · midnight #020617 · cyan #22D3EE · violet #A78BFA · lime #84CC16 · thin after L1
Four-layer stack: dotfiles (HorneroConfig) → machine provisioning (chezmoi) →LLM policy (env.d allowlist) → tooling (agent-toolkit). Harness runtime overlays all four. Thin boundary after L1 — no embedded capabilities in workstation.
  • Layer 0 — dotfiles: HorneroConfig · Hyprland + Quickshell · chezmoi home/
  • Layer 1 — machine provisioning: agentic-workstation · chezmoi apply · packages · shell · thin
  • Layer 1 — LLM policy: env.d · provider allowlist · DOTS_AI_DEVCOMPANION_LLM_STRICT · dots-devcompanion llm-status
  • Layer 1.5 — tooling: agent-toolkit · 61 skills · 16 agents · uv install

Ecosystem — 4 capas · SVG · midnight identity

The diagram is the map; the layers below are the territory. HorneroConfig paints the desktop, Workstation provisions the machine (thin), Toolkit distributes every capability, Harness keeps runtime memory. midnight #020617 · cyan #22D3EE ·violet #A78BFA · lime #84CC16.

Agentic Workstation — 4-layer ecosystemPersonal DX graph: HorneroConfig is an optional desktop sibling. Workstation provisions the machine, delegates capabilities to agent-toolkit, and the harness consumes them as runtime memory.PERSONAL DX GRAPH · OPTIONAL DESKTOP SIBLINGWorkstation ↔ Toolkit ↔ Harness · HorneroConfig optionalmachine provisioning · capability distribution · runtime memory — desktop is a sibling edge, not a hard dependencythin boundary →capabilities delegated after L1 via uvL0 DESKTOPHorneroConfigdesktop · dotfilesHyprland + Quickshellsmart-colors · 22 riceschezmoi home/ · yazi · themesDELIVERS~/.config/hypr & quickshellsmart-colors cachedotfilesulises-jeremias/dotfilesL1 MACHINEWorkstationmachine · provisioningchezmoi apply · packagesdots-* thin helpers · LLM policydots-doctor · dev-companion runnerTHIN · KEEPS ONLYdev-companion/runneruv → agent-toolkit installagentic-workstationthin · no embedded skillsL1.5 CAPABILITIESToolkitcapabilities · distribution61 skills · 16 agents · 10 loopsMCP · 7 profiles · packs/schemasdots-skills sync (delegated)SOLE SOURCESKILL.md catalog at runtimeagent-toolkit installagent-toolkituv tool install --forceL2 RUNTIMEHarnessruntime · memoryknowledge/ persistent · packspersonas · loops · tracesruns/<id>/trace.jsonlCONSUMESworkspace-contextagent-toolkit loop runagentic-harnessai-workspace · per runapplyinstalloverlayIdentity · midnight #020617 · cyan #22D3EE · violet #A78BFA · lime #84CC16 · thin after L1 — toolkit owns runtime catalog1200×560

Thin boundary marked after L1 — no embedded capabilities. Accessible inline SVG with role="img", <title> and <desc>.

Four layers, one continuous system

Narrative: HorneroConfig / desktop → Workstation / machine → Toolkit / capabilities → Harness / runtime. Desktop is where you sit; machine is what boots; capabilities are what the agent can do; runtime is where memory lives. Each layer delegates inward — never duplicates.

L0 · DESKTOP (optional)

HorneroConfig

desktop · dotfiles

HorneroConfig / desktop (optional Personal DX surface)

Optional desktop surface in the Personal DX graph — not a required linear predecessor of the workstation. Transforms Linux desktop into a functional workspace via Hyprland + Quickshell + smart-colors when you want the physical nest.

Owns

  • Hyprland / Wayland compositor + Quickshell shell
  • 22 rices, smart-colors (python-materialyoucolor → dots/smart-colors)
  • chezmoi home/ source state (dotfiles)
  • Theme-intelligence: light/dark, semantic mapping

Delivers

  • ~/.config/hypr / quickshell
  • Rice configs (~/.local/share/dots)
  • Smart color cache

ulises-jeremias/dotfiles

L1 · MACHINE

Workstation

machine · provisioning

Workstation / machine

Thin agentic-workstation. Provisions the machine via chezmoi: packages, shell, secrets, LLM policy, and thin dots-* helpers. Delegates all capabilities to agent-toolkit — ships no embedded skills.

Owns

  • chezmoi apply: packages, shell, LLM policy (env.d)
  • Profile-driven install (technical / data / ai / minimal)
  • dots-* thin helpers (doctor, skills, loop, devcompanion)
  • dev-companion/runner — workstation-only runtime (kept)

Delivers

  • ~/.local/bin/dots-* (thin, delegate)
  • ~/.local/share/agentic-workstation/runner
  • ~/.config/agentic-workstation (LLM policy)

ulises-jeremias/agentic-workstation

L1.5 · CAPABILITIES

Toolkit

capabilities · distribution

Toolkit / capabilities

Sole capability distribution. agent-toolkit provides 61 skills, 16 agents, 10 loops, MCP templates and 7 profiles via uv. Single source of truth — versioned independently from the workstation.

Owns

  • 61 skills (9 domains) + 16 agent personas
  • 10 loop templates + 7 tool profiles (Claude/Cursor/OpenCode…)
  • MCP templates + packs/prompts/schemas
  • Symlink sync via dots-skills (delegated)

Delivers

  • ~/.local/share/agentic-workstation/skills-external/agent-toolkit/
  • ~/.claude/skills/, ~/.config/opencode/skills/ …
  • Plugins: /plugin marketplace add agent-toolkit

ulises-jeremias/agent-toolkit

L2 · RUNTIME

Harness

runtime · memory

Harness / runtime

Running instance — the harness that makes AI sessions stateful. Persistent knowledge, personas, packs, and loop execution. Consumes toolkit CLIs; agentic-harness / ai-workspace is the generic baseline.

Owns

  • knowledge/ — persistent memory across sessions
  • personas/ + packs/ — scope + client context bundles
  • Loop runs: trace.jsonl, state, isolation worktrees
  • workspace-context: persona constraints + pack loading

Delivers

  • ai-workspace/knowledge/
  • ai-workspace/personas/ & packs/
  • runs/<id>/trace.jsonl worktrees

ulises-jeremias/ai-workspace → agentic-harness

midnight #020617 cyan #22D3EE violet #A78BFA lime #84CC16— thin workstation boundary after L1; toolkit owns capability surface.
Provisioning · machine installs, toolkit distributes

Machine provisioning: from zero to agentic in one command

Agentic Workstation keeps provisioning and capabilities strictly separate. The workstation (L1) is a thin chezmoi baseline — shells, packages, configs, secrets and LLM policy. Capabilities never live here; they are injected by the toolkit on demand.

  1. 01

    Chezmoi apply

                  chezmoi init --apply ulises-jeremias/agentic-workstation

    Bootstraps machine provisioning. Applies home/ source state (shell, packages, configs) idempotently.

    Profile: technical / non-technical / ai / data / infra / minimal / custom (see home/.chezmoidata/profiles.yaml)

  2. 02

    Toolchain

                  uv tool install --force agent-toolkit-cli && agent-toolkit install

    Thin-workstation canonical path. Single installer — no AUR/pipx fallbacks. Installs skills, agents, loops, MCP, prompts and syncs per-tool symlinks.

    Also via run_once_after_50-install-agent-toolkit.sh.tmpl + run_onchange_45-install-ai-agents.sh.tmpl (delegated)

  3. 03

    Swarm prerequisites

                  dots-doctor && agent-toolkit swarm doctor

    Profile-driven swarm provisioning (install_group_swarm). Installs tmux + Herdr (brew → mise → curl) + herdr integration install opencode idempotently.

    Uses isolated tmux socket agent-toolkit-swarm-<run-id>; never overwrites ~/.tmux.conf

  4. 04

    Secrets & LLM policy

                  dots-devcompanion llm-status

    Machine-level LLM policy lives only in workstation (env.d + dots-devcompanion). Toolkit has no provider awareness. Wire before queuing background jobs.

    Engagement policy: DOTS_AI_DEVCOMPANION_LLM_ALLOWLIST + DOTS_AI_DEVCOMPANION_LLM_STRICT=1

Profile-driven — no host snowflakes

home/.chezmoidata/profiles.yaml encodes feature groups. technical, data, ai enableswarm by default (install_group_swarm). custom answers every flag. Questionnaire lives inhome/.chezmoi.toml.tmpl; install scripts translate canonical package_groups names per platform (apt / brew / pacman / dnf).

Secrets & LLM policy stay in ~/.config/agentic-workstation/env.d/*.env and are never committed. Runner logicdev-companion/runner is the only capability kept in the workstation — everything else is delegated.

Health checks · doctor keeps the thin boundary honest

dots-doctor — the workstation heartbeat

dots-doctor is the single health gate for the thin workstation. It prints a snapshot for humans and machines, validates swarm prerequisites profile-aware, and delegates deep checks to agent-toolkit doctor / swarm doctor.

OS & chezmoi snapshot

            dots-doctor

Pretty OS, df, chezmoi version/source-path, ai-workspace hint, env.d summary, gh auth state, skill bundle count.

When: Always — human-readable snapshot (default mode)

Swarm health

            dots-doctor --json | jq

Profile-aware swarm validation: tmux -V, herdr --version, herdr integration list --json, agent-toolkit swarm doctor.

When: When install_group_swarm=true → tmux missing = FAIL, herdr missing = WARN (tmux fallback)

Machine report

            dots-doctor --issue

Markdown-friendly report (no colors) for GitHub / Slack tickets. Same snapshot, paste-ready.

When: Support tickets, CI --no-snapshot for narrow parsing

Skill drift

            dots-doctor drift

Compares registry versions vs deployed skill.json. Delegates to scripts/check-skill-drift.py (thin-workstation passthrough).

When: After toolkit upgrades; thin-workstation validate-skills.sh delegates to toolkit when empty

LLM policy gate

            dots-devcompanion llm-status

Verifies active provider allowlist/strict before queuing devcompanion jobs — never invokes model.

When: Before queueing any background job for client engagements

dots-doctor flags & subcommands
FlagEffectOutput
dots-doctorDefault + snapshot (OS, df, chezmoi, env.d, gh auth, skill count, swarm)Human, color when TTY
--jsonMachine-readable snapshot line (stderr stays human)JSON · pipe to jq
--issue / --pasteNo colors, markdown-safe — for GitHub / SlackPaste-ready report
--no-snapshotChecks only; skips snapshot block (CI narrow parsing)OK / FAIL lines only
driftRegistry vs deployed skill.json — thin-workstation passthrough to toolkitDrift report

Profile-aware swarm gate

install_group_swarm=false → missing herdr is a warning (tmux fallback exists).
install_group_swarm=true → missing tmux is a FAIL, missing herdr is a WARN. Verification: tmux -V, herdr --version, herdr integration list --json, agent-toolkit swarm doctor.

Toolkit owns orchestration — agent-toolkit swarm start --recipe pair --ui herdr|tmux --runner opencode "Task". Workstation only ensures host tools exist (isolated socket agent-toolkit-swarm-<run-id>, never touches ~/.tmux.conf).

Why capabilities live in toolkit · thin boundary

Capabilities belong to the toolkit — workstation stays thin

The thin workstation is not a branding choice. It is a contract: the workstation provisions the machine and runs the queue — the toolkit distributes every skill, agent, loop, MCP template and prompt that an AI tool can consume. No duplication. No drift.

Thin workstation = single source of truth

Workstation ships no skills/*, loops/*, mcp/*, prompts/*, agents/*, packs/teams. Catalog is provided by toolkit at runtime. Prevents duplication and version drift across machines.

Provisioning vs capabilities separation

Workstation owns machine provisioning (chezmoi, packages, shell, secrets, LLM policy, runner). Toolkit owns capability distribution. Clear L1 vs L1.5 responsibility — workstation stays lean, toolkit evolves independently.

Independent versioning & delivery

Toolkit updates via uv tool install --force agent-toolkit-cli && agent-toolkit install without reinstalling the workstation. Also ships as Claude Code / Cursor plugin marketplace bundles.

One sync, every AI tool

dots-skills sync (delegated) creates symlinks for Claude Code, OpenCode, Cursor, Copilot, Windsurf, Pi, Codex from the same catalog. No manual per-tool copies.

Verified · thin workstation

Terminology check — what “thin” means in this repo

“Thin workstation delegates all capabilities to agent-toolkit via uv tool install --force agent-toolkit-cli && agent-toolkit install. The SKILL.md catalog is provided by the toolkit at runtime. Workstation-only runner logic (dev-companion/runner) is retained.”

No embedded

  • skills/*
  • loops/*
  • mcp/*
  • prompts/*
  • agents/*
  • packs/teams

Workstation keeps only

  • dev-companion/runner
  • scopes/
  • telemetry/
  • pacman-hooks/

Install path (sole)

uv tool install --force agent-toolkit-cli && agent-toolkit install

Sources:docs/ARCHITECTURE.md · docs/AGENT_TOOLKIT.md · home/dot_local/share/agentic-workstation/skills/README.md

Delivery flow — workstation installs, toolkit owns orchestration

  1. chezmoi init --apply → run_once_after_50-install-agent-toolkit.sh.tmpl →uv tool install --force agent-toolkit-cli
  2. agent-toolkit install → catalog (SKILL.md) + symlinks (dots-skills sync delegated)
  3. agent-toolkit loop run / swarm start --recipe pair --ui herdr|tmux → isolatedagent-toolkit-swarm-<run-id> worktree + trace
  4. dots-doctor --json | jq + agent-toolkit swarm doctor → heartbeat after every upgrade

Verified thin workstation — start here

One command installs the machine, another installs every capability. Verify before queuing background jobs.

1 · Provision the machine

chezmoi init --apply ulises-jeremias/agentic-workstation

Idempotent chezmoi apply · profile-driven (technical / data / ai / minimal).

agentic-workstation → machine provisioning ↗

2 · Install capabilities (sole path)

uv tool install --force agent-toolkit-cli && agent-toolkit install

61 skills · 16 agents · 10 loops · MCP · plugins. Delegated via toolkit — no AUR/pipx fallback.

agent-toolkit → 61 skills ↗

3 · Verify health

dots-doctor
dots-doctor --json | jq
agent-toolkit swarm doctor

Profile-aware swarm gate · snapshot + machine report · drift check.

HorneroConfig → dotfiles ↗

4 · Gate LLM policy (before queue)

dots-devcompanion llm-status

Machine-level provider allowlist · DOTS_AI_DEVCOMPANION_LLM_ALLOWLIST + STRICT=1. Never invokes model.

ai-workspace → harness runtime ↗

Full docs: docs/ARCHITECTURE.md + docs/AGENT_TOOLKIT.md in agentic-workstation. Tokens fromsrc/styles/tokens.css · layout via SectionLayout.