| macOS defaults, Homebrew brews/casks | nix-darwin/configuration.nix | Use for system-level macOS behavior and brew/cask declarations |
| darwin user/host profile wiring | nix-darwin/flake.nix | Touch when changing mkDarwinConfig users or outputs |
| shared user packages, stable aliases, HM programs | home-manager/home.nix | Use for stable shell aliases and Home-Manager-managed programs |
| dev runtimes and CLI toolchain versions | chezmoi/dot_config/mise/config.toml | Prefer Mise for node/python/go/rust and many CLIs |
global agent skills for ~/.agents/skills | chezmoi/dot_agents/skills/ | Use for skills that should be available across repos/tools on this machine |
| repo-local dotfiles skills | top-level .agents/skills/ | Use only for skills specific to maintaining this dotfiles repo |
| personal shell behavior and fast iteration aliases | chezmoi/dot_config/shell/*.sh | Use plain .sh for non-secret config |
| secret-backed env vars | chezmoi/dot_config/shell/*.sh.tmpl | Use onepasswordRead templates, never hardcode secrets |
| zsh load order/path wiring | chezmoi/dot_config/zsh/custom.zsh | Update when adding a new shell module file |
| automation workflow scripts | scripts/*.sh | Keep idempotent and non-destructive defaults |
| operator guidance for scripts | scripts/AGENTS.md | Update when behavior/contracts change |
| tmux docs/config guidance | docs/tmux.md and/or chezmoi/dot_config/tmux/tmux.conf | Keep docs and runtime behavior aligned |