skill

flake.lock

@@ -1531,6 +1531,7 @@
         "nixvim": "nixvim",
         "noctalia": "noctalia",
         "services-flake": "services-flake",
+        "skills": "skills",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
         "systems": "systems_9",
@@ -1598,6 +1599,22 @@
         "type": "github"
       }
     },
+    "skills": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1786045791,
+        "narHash": "sha256-pseSJJb5nBBGPzpxA1GzjGLB9OrT+u0At1saJ4NqZ1E=",
+        "owner": "mattpocock",
+        "repo": "skills",
+        "rev": "84fdeffd12f2ee307994d1eb6feb48173b6e0502",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mattpocock",
+        "repo": "skills",
+        "type": "github"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -104,6 +104,11 @@
 
     codex-session-usage.url = "github:moons-14/codex-session-usage";
 
+    skills = {
+      url = "github:mattpocock/skills";
+      flake = false;
+    };
+
     # Index / Search
     nix-index-database = {
       url = "github:nix-community/nix-index-database";

modules/applications/codex/home.nix

@@ -309,9 +309,9 @@ let
         Use the configured Codex sandbox and Auto-review for command permissions.
         Do not create a second command-approval workflow.
 
+        Staging and committing are reserved to the primary.
+
         Unless explicitly assigned, do not:
-        - commit;
-        - stage;
         - push;
         - rebase;
         - deploy;
@@ -966,9 +966,9 @@ in
 
       Use the configured Codex sandbox and Auto-review for command permissions. Do not create a second command-approval workflow.
 
-      When the user explicitly authorizes commits, the primary performs authorization-sensitive Git metadata operations. Workers do not repeatedly attempt commits based on relayed authorization.
+      Commits require explicit user authorization or applicable standing authorization. Once authorized, the primary performs authorization-sensitive Git metadata operations with `git commit -S` at coherent, validated checkpoints. Workers do not repeatedly attempt commits based on relayed authorization.
 
-      Keep commits logically coherent. Avoid chains of small review-fix commits while a change is still being reviewed. Never push, deploy, switch, or activate unless explicitly requested.
+      Split unrelated concerns into separate commits. Avoid noisy, broken, or premature checkpoint commits, including chains of small review-fix commits while a change is still being reviewed. Never push, deploy, switch, or activate unless explicitly requested.
 
       ## Completion gate
 
@@ -992,7 +992,13 @@ in
   #
   # Match programs.codex's XDG behavior so this also works if
   # home.preferXdgDirectories is changed later.
-  home.file = lib.mkIf (!config.home.preferXdgDirectories) (mkAgentTargets ".codex");
+  home.file = lib.mkMerge [
+    (lib.mkIf (!config.home.preferXdgDirectories) (mkAgentTargets ".codex"))
+    {
+      ".agents/skills/grill-me".source = inputs.skills + "/skills/productivity/grill-me";
+      ".agents/skills/grilling".source = inputs.skills + "/skills/productivity/grilling";
+    }
+  ];
 
   xdg.configFile = lib.mkIf config.home.preferXdgDirectories (mkAgentTargets "codex");
 }