juniper

Source of truth for infrastructure and host-specific configuration on this Mac (juniper).

Reusable user configuration belongs in /Users/xrisk/dot. Juniper records the machine-specific services, LaunchAgents, live links, paths, topology, desired state, and verification commands that make those reusable sources operational on this host.

Start here

• .wiki/_index.md: source-backed task routing.
• infra/host.json: machine-readable desired state.
• scripts/verify-host: read-only drift and health check.
• host-state/disabled-startup-items.md: intentionally disabled vendor items.
• host-state/decommissioned-services.md: dated service retirement record.

Run the host verifier with:

scripts/verify-host

Run the secret scan before committing or exporting:

scripts/trufflehog-scan

Ownership boundary

/Users/xrisk/dot owns durable, reusable Codex configuration. The live /Users/xrisk/.codex directory remains a runtime directory because it contains credentials, sessions, databases, memories, logs, caches, installed payloads, and sockets. Only the allowlisted durable paths in infra/host.json are symlinked into Dot.

Homebrew-generated service definitions are not copied here. Custom LaunchAgent definitions and sanitized service configuration are tracked here and linked to their live host paths. Secret values stay outside both repositories.