homehub: rsync-based home-drive sync via Synology hub

DESIGN.md is the rationale; README.md the operations half.
Four data classes: files (mtime-arbitrated two-way), git repos (manifest +
clone, never byte-synced), the browser link bar (union merge), and everything
else denied by default.

rules/denylist

@@ -0,0 +1,134 @@
+# homehub denylist — DEFAULT DENY.  Emitted FIRST so it beats every set include
+# (rsync filter rules are first-match-wins).
+#
+# Syntax — plain paths, one per line, whole line is the pattern (comments on
+# their own lines only):
+#   /Foo/    directory at the home root + its whole subtree
+#   build/   any directory named build at ANY depth + its subtree
+#   /file    a single file
+# The trailing slash is what turns it into a subtree rule.
+#
+# Measured on g9, 2026-10-24.  Everything here is machine-local or rebuildable.
+
+# --- the big trees: class B owns repos; tmp/Downloads are out by decision ---
+/git/
+/src/
+/tmp/
+/Downloads/
+
+# --- toolchains and package caches (rebuilt by the toolchain, never shared) --
+/.cache/
+/.cargo/
+/.rustup/
+/.npm/
+/.nvm/
+/.bun/
+/.deno/
+/.yarn/
+/.espressif/
+/.platformio/
+/.conan/
+/.gradle/
+/.m2/
+/go/
+/zephyr-sdk-0.17.4/
+/zephyr-sdk-0.17.0/
+/.dotnet/
+/.emscripten/
+/.emscripten_cache/
+/.dartServer/
+/.dartium/
+/.android/
+/.docker/
+/.var/
+/.local/state/homehub/
+/.local/lib/
+/.local/bin/
+/.local/share/virtualenvs/
+/.venv/
+/.pixi/
+
+# --- games / wine ----------------------------------------------------------
+/.steam/
+/.steamrt/
+/.local/share/Steam/
+/Steam/
+/.minecraft/
+/.wine/
+/.wine_games/
+/.wine_firefly/
+/.googleearth/
+/.adobe/
+/.freeeciv-placeholder/
+
+# --- browser / editor / desktop profile state: local by default (§8) --------
+# The ONLY browser data that crosses machines is the bookmark bar (class C).
+/.config/
+/.mozilla/
+/.mozilla/
+/.mozilla/
+/.thunderbird/
+/.icedove/
+/.thunderbird/
+/.thunderbird/
+/.claws-mail/
+/.icedove/
+/.electron/
+/.electron-vite/
+/.dbus/
+/.macromedia/
+/.mozilla/
+/.cache/
+/.nv/
+/.pki/
+/.lesshst/
+/.ssh/agent/
+/.claude/
+/.codex/
+/.cache/
+
+# --- build artifacts (defence in depth; class B makes most of this moot) ----
+build/
+target/
+dist/
+out/
+node_modules/
+__pycache__/
+.venv/
+.pixi/
+.zig-cache/
+.ccache/
+.meson-cache/
+_deps/
+CMakeFiles/
+_results/
+
+# --- filesystem metadata from other OSes / the NAS itself -------------------
+# @eaDir is Synology's per-directory metadata; without this rule a pull litters
+# an @eaDir directory into every synced directory it touches.
+@eaDir/
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# --- build/packaging output that lives at the home root ---------------------
+# ~/debian is a dpkg work area: 150 M of .deb/.dsc/.orig.tar.xz and extracted
+# upstream trees.  It was 86% of the first dry-run push list — build output, not
+# personal data.  Anchored so it only means ~/debian, not every debian/ subdir.
+/debian/
+
+# --- junk, locks, transient -----------------------------------------------
+.gksu.lock
+.gconfd.lock
+/core
+/lost+found/
+*.tmp
+*.swp
+*.swo
+*.bak
+*.backup
+*~
+*.log
+*.lock
+*.part
+*.crdownload

rules/hosts/_laptop-template

@@ -0,0 +1,5 @@
+# host: TEMPLATE for the laptop.  Copy to rules/hosts/<hostname> on that machine
+# (or edit this repo there, since rules/ itself travels in git).
+# Deliberately NOT including: media, misc, and everything under the denylist.
+base
+docs

rules/hosts/g9

@@ -0,0 +1,6 @@
+# host: g9  (desktop, always at home, no disk-space pressure)
+# One set name per line; must match a file in rules/sets.d/
+base
+docs
+media
+misc

rules/sets.d/base.list

@@ -0,0 +1,42 @@
+# set: base — the minimum every machine (laptop included) syncs both ways.
+# Plain home-relative paths; trailing slash = directory subtree.
+# Remember: denylist wins, so anything under /.config/ can never appear here (§8).
+
+# identity + credentials (accepted in decision D1: the hub then holds every key
+# you own, which is why the hub copy is forced 700/600 and the NAS must stay LAN-only)
+/.ssh/
+/.gitconfig
+/.gitignore_global
+/.hgrc
+
+# shell / terminal
+/.bashrc
+/.bash_profile
+/.bash_logout
+/.profile
+/.inputrc
+/.screenrc
+/.tmux.conf
+/.p10k.zsh
+/.vimrc
+/.alsoftrc
+/.gtk-bookmarks
+
+# personal scripts
+/bin/
+
+# pi agent STATE only — never install/ bin/ npm/ (§8: state vs config vs cache)
+/.pi/agent/sessions/
+/.pi/agent/settings.json
+/.pi/agent/models.json
+/.pi/agent/models-store.json
+/.pi/agent/AGENTS.md
+/.pi/agent/extensions/
+/.pi/agent/prompts/
+/.pi/agent/skills/
+
+# homehub's shared state root: the ONE directory whose contents are shared
+# verbatim, and the anchor that survives the NixOS migration unchanged (§8).
+# It is deliberately NOT ~/.local/state/homehub — that is homehub's own private
+# scratch (filters, markers, error logs), and syncing it makes machines fight.
+/.local/state/shared/

rules/sets.d/docs.list

@@ -0,0 +1,2 @@
+# set: docs — real documents. On the laptop too (decision D4).
+/Documents/

rules/sets.d/media.list

@@ -0,0 +1,2 @@
+# set: media — desktops only for now; 323 M and grows sideways.
+/Pictures/

rules/sets.d/misc.list

@@ -0,0 +1,7 @@
+# set: misc — small hand-written trees that are not git repos.
+# Anything here that later becomes a repo must be REMOVED from this set and picked
+# up by `homehub git inventory` instead (§6).
+/journal/
+/projects/
+/mu_code/
+/public_html/