# set: base — the minimum every machine (laptop included) syncs both ways.
# Plain home-relative paths; trailing slash = directory subtree.
# Remember: denylist wins, so anything under /.config/ can never appear here (§8).

# identity + credentials (accepted in decision D1: the hub then holds every key
# you own, which is why the hub copy is forced 700/600 and the NAS must stay LAN-only)
/.ssh/
/.gitconfig
/.gitignore_global
/.hgrc

# shell / terminal
/.bashrc
/.bash_profile
/.bash_logout
/.profile
/.inputrc
/.screenrc
/.tmux.conf
/.p10k.zsh
/.vimrc
/.alsoftrc
/.gtk-bookmarks

# personal scripts
/bin/

# pi agent STATE only — never install/ bin/ npm/ (§8: state vs config vs cache)
/.pi/agent/sessions/
/.pi/agent/settings.json
/.pi/agent/models.json
/.pi/agent/models-store.json
/.pi/agent/AGENTS.md
/.pi/agent/extensions/
/.pi/agent/prompts/
/.pi/agent/skills/

# homehub's shared state root: the ONE directory whose contents are shared
# verbatim, and the anchor that survives the NixOS migration unchanged (§8).
# It is deliberately NOT ~/.local/state/homehub — that is homehub's own private
# scratch (filters, markers, error logs), and syncing it makes machines fight.
/.local/state/shared/