home-manager: Share Git and Jujutsu configuration

Move Git, Git LFS and `diff-so-fancy` into the common home module.
Enable Jujutsu with the same identity and add it to the devshell.

Document `jj` workflows and prefer them in Jujutsu workspaces.

AGENTS.md

@@ -187,6 +187,13 @@ in churn.
 
 ## Conventions
 
+- Prefer `jj` for status, diffs, history, commits, rebases and remote operations when it is
+  available and the checkout has a Jujutsu workspace. Use Git when `jj` is unavailable or the
+  checkout is Git-only, and for Git-specific tooling. The shared home config and devshell install
+  `jujutsu`; see [`docs/deployment.md#version-control`](docs/deployment.md#version-control) for
+  setup and the workflow. Inspect `jj status`, `jj diff` and `jj log` before editing; `jj`
+  snapshots working-copy changes automatically, so preserve existing user changes and use
+  explicit revisions when rewriting history or moving bookmarks.
 - Format with `nixpkgs-fmt` (`fmt`). 2-space indent, `inherit (...)` blocks at the top of `let` —
   prefer `inherit (lib) mkOption ...;` (and bare use) over qualifying inline as `lib.mkOption`.
   **Ask before running `fmt`** — some files aren't canonically formatted, so `fmt` can reindent a
@@ -212,11 +219,12 @@ in churn.
   command, option or upstream technical term such as QEMU's machine type.
 - Commit subjects follow `area/scope: Capitalized summary` (e.g. `nixos/home: ...`); keep logically
   distinct changes in separate commits. Aim for 50-character subjects and do not exceed 72
-  characters. Hard-wrap commit body lines at 72 characters; Git preserves an unwrapped `-m`
+  characters. Hard-wrap commit body lines at 72 characters; `-m` preserves unwrapped text, so
-  argument as one long line, so include literal line breaks or use a commit-message file. Before
+  include literal line breaks or use a commit-message file. Before reporting a commit, inspect
-  reporting a commit, inspect `git show -s --format=%B HEAD` and amend it if any line exceeds 72
+  `jj log --no-graph -r <revision> -T description` (or `git show -s --format=%B HEAD` in a Git-only
-  characters. A concise body describing the change and its rationale is welcome when the subject
+  checkout) and amend its description if any line exceeds 72 characters. A concise body describing
-  alone does not provide enough context — keep it to the essentials rather than restating the diff.
+  the change and its rationale is welcome when the subject alone does not provide enough context —
+  keep it to the essentials rather than restating the diff.
   `Co-Authored-By` is the only trailer used here; do **not** add a `Claude-Session` link (or any
   other session/tooling trailer).
 - **"Logically distinct" means unrelated** — two different applications, two boxes that have nothing

devshell/default.nix

@@ -32,5 +32,6 @@ in
       exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
     '')
     home-manager
+    jujutsu
   ];
 }

docs/README.md

@@ -24,7 +24,7 @@ Not every box fits this pattern, but **colony** and **home** are organised this
   nixpkgs channels, shared module inventory.
 - [`networking.md`](networking.md) — network assignments, domains, site topologies, router HA,
   the AS211024 L2 mesh, BGP, WireGuard, Tailscale.
-- [`deployment.md`](deployment.md) — deploy-rs, devshell commands, secrets workflow, CI.
+- [`deployment.md`](deployment.md) — deploy-rs, devshell commands, `jj` workflow, secrets, CI.
 - [`nixpkgs-upgrade.md`](nixpkgs-upgrade.md) — guided procedure for the periodic upgrade of the four
   nixpkgs channels and home-manager (fork rebase, stable bumps, input review).
 - [`install-box.md`](install-box.md) — guided procedure for installing a new box, from the booted

docs/deployment.md

@@ -62,6 +62,16 @@ Generated profiles deploy in this order:
 `ssh-machine <name> bash -s < script.sh`. If a flaky agent stalls public-key authentication, use
 `SSH_AUTH_SOCK= ssh-machine …`.
 
+## Codex
+
+The shared GUI home-manager module installs Codex from the `llm-agents` input, retaining
+that input's tested nixpkgs pin. Run `nix flake update llm-agents`, then switch the system
+or home configuration to use the updated package.
+
+`programs.codex.mutableSettings` merges the declared status-line settings into the writable
+`~/.codex/config.toml` during activation. Declared values take precedence on each switch;
+other settings, including model selection, providers and project trust, remain imperative.
+
 ## Devshell commands
 
 The repo ships a `numtide/devshell` ([`devshell/`](../devshell), entered via `direnv`). Run a
@@ -110,6 +120,43 @@ VM's unix sockets from `/run/vms/<vm>/` on `<host>` over SSH):
 | `vm-monitor <host> <vm>` | QEMU monitor socket in `minicom`. |
 | `vm-viewer <host> <vm>` | SPICE display in `virt-viewer` (not on Darwin). |
 
+## Version control
+
+The shared [Home Manager module](../home-manager/modules/common.nix) enables `programs.git`
+and `programs.jujutsu`, including Git LFS and `diff-so-fancy`, for graphical and non-graphical
+homes. Jujutsu uses the identity declared in `programs.git.settings.user`; Home Manager writes
+its `jj/config.toml`. The [devshell](../devshell/default.nix) also installs `jujutsu`, which
+provides `jj`. Prefer `jj` when it is available and the checkout has a Jujutsu workspace;
+use Git for Git-only checkouts and Git-specific tooling such as the installer-tag command
+and CI scripts.
+
+To use an existing Git checkout with both tools, run `jj git init --colocate` at its root.
+This creates local `.jj` metadata and keeps `.git` for Nix flake source discovery and existing
+Git tooling. Switch the home configuration to install the managed identity. When using only
+the devshell, configure your identity with `jj config set --user user.name '<name>'` and
+`jj config set --user user.email '<email>'` before creating commits.
+
+| Task | Command |
+|---|---|
+| Inspect the working copy and history | `jj status`, `jj diff`, `jj log` |
+| Describe the current change | `jj describe -m 'area/scope: Capitalized summary'` |
+| Start the next change | `jj new` |
+| Inspect a completed description | `jj log --no-graph -r <revision> -T description` |
+| Fetch remote history | `jj git fetch` |
+| Name a revision for publishing | `jj bookmark create <name> -r <revision>` |
+| Move an existing bookmark | `jj bookmark set <name> -r <revision>` |
+| Publish a bookmark | `jj git push --bookmark <name>` |
+
+`@` is the working-copy revision; after `jj new`, the completed change is normally `@-`.
+Working-copy edits are snapshotted automatically, without a staging step. Inspect existing
+changes before editing, keep unrelated work separate, and check the target revision before
+rewriting history or moving a bookmark. Follow the commit-message conventions in
+[`AGENTS.md`](../AGENTS.md#conventions).
+
+See the upstream [Jujutsu CLI reference](https://docs.jj-vcs.dev/latest/cli-reference/)
+for command options and [Git compatibility](https://docs.jj-vcs.dev/latest/git-compatibility/)
+for colocation details.
+
 ## Nix implementation
 
 Every context uses **Determinate Nix** as its `nix.package`, for its performance features

flake.lock

@@ -8,7 +8,7 @@
           "ragenix",
           "nixpkgs"
         ],
-        "systems": "systems_8"
+        "systems": "systems_9"
       },
       "locked": {
         "lastModified": 1761656077,
@@ -67,6 +67,40 @@
         "type": "github"
       }
     },
+    "bun2nix": {
+      "inputs": {
+        "flake-parts": [
+          "llm-agents",
+          "flake-parts"
+        ],
+        "nixpkgs": [
+          "llm-agents",
+          "nixpkgs"
+        ],
+        "systems": [
+          "llm-agents",
+          "systems"
+        ],
+        "treefmt-nix": [
+          "llm-agents",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790001035,
+        "narHash": "sha256-1/SLBjSYBzDdDhvLQ83wrzBakyS/xNGgtxHGNuveOEQ=",
+        "owner": "Mic92",
+        "repo": "bun2nix",
+        "rev": "07a5bfc8ac36c5370199343fa620b69f63186e33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "ref": "llm-agents",
+        "repo": "bun2nix",
+        "type": "github"
+      }
+    },
     "copyparty": {
       "inputs": {
         "flake-utils": "flake-utils_5",
@@ -295,6 +329,27 @@
       }
     },
     "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790898470,
+        "narHash": "sha256-zTwuwezD0w3hpga6a6P8emidzAZFyWqlNeRBlpWOOl8=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "024633cd702b10285db5cb19b40ad48d2399ba60",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "openwrt-imagebuilder",
@@ -434,7 +489,7 @@
     },
     "flake-utils_8": {
       "inputs": {
-        "systems": "systems_6"
+        "systems": "systems_7"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -452,7 +507,7 @@
     },
     "flake-utils_9": {
       "inputs": {
-        "systems": "systems_9"
+        "systems": "systems_10"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -582,11 +637,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787487906,
+        "lastModified": 1790989254,
-        "narHash": "sha256-zIdM+8teujHm5hc5MIPDnV7k2UeOOT/pFyFtWjOCwsY=",
+        "narHash": "sha256-ZN+riaeFuE+DZ5zfqJiXlM12jLwZzeIXiNkU1YeHMXI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cfba7ad5886b342b8dd63ba74354b3853ea4cfc9",
+        "rev": "acd21c5a3420a9d5fd0ed06299b10828267ef9ba",
         "type": "github"
       },
       "original": {
@@ -631,6 +686,28 @@
         "type": "github"
       }
     },
+    "llm-agents": {
+      "inputs": {
+        "bun2nix": "bun2nix",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_6",
+        "systems": "systems_6",
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1791001326,
+        "narHash": "sha256-pwJhtpRcNX1pJ9luUy3Eh1EYUFsZjv5m2xSqZ1hEhMU=",
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "rev": "83984ebbbe5322b261d9fdc24eb15cf44f23abec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "llm-agents.nix",
+        "type": "github"
+      }
+    },
     "nix": {
       "flake": false,
       "locked": {
@@ -840,6 +917,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1790600678,
+        "narHash": "sha256-6k3n7X2UsZ6tAlWTz99RimiZab+17tMUrw9sRUcELiA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "f45c6f04c2f013f004bf94e284e95d72898d9393",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "openwrt-feeds": {
       "inputs": {
         "nixpkgs": [
@@ -865,11 +958,11 @@
     },
     "openwrt-imagebuilder": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
-        "systems": "systems_7"
+        "systems": "systems_8"
       },
       "locked": {
         "lastModified": 1787474509,
@@ -946,6 +1039,7 @@
         "home-manager-unstable": "home-manager-unstable",
         "impermanence": "impermanence",
         "libnetRepo": "libnetRepo",
+        "llm-agents": "llm-agents",
         "nixGL": "nixGL",
         "nixpkgs-mine": "nixpkgs-mine",
         "nixpkgs-mine-stable": "nixpkgs-mine-stable",
@@ -992,6 +1086,21 @@
         "type": "github"
       }
     },
+    "systems_10": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "systems_2": {
       "locked": {
         "lastModified": 1681028828,
@@ -1068,21 +1177,6 @@
       }
     },
     "systems_7": {
-      "locked": {
-        "lastModified": 1680978846,
-        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
-        "owner": "nix-systems",
-        "repo": "x86_64-linux",
-        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "x86_64-linux",
-        "type": "github"
-      }
-    },
-    "systems_8": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1097,6 +1191,21 @@
         "type": "github"
       }
     },
+    "systems_8": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
     "systems_9": {
       "locked": {
         "lastModified": 1681028828,
@@ -1133,6 +1242,27 @@
         "type": "github"
       }
     },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "utils": {
       "inputs": {
         "systems": "systems_3"

flake.nix

@@ -69,6 +69,8 @@
     openwrt-feeds.inputs.openwrt-imagebuilder.follows = "openwrt-imagebuilder";
 
     # Packages not in nixpkgs
+    # Keep its tested nixpkgs pin so packages can use the upstream binary cache.
+    llm-agents.url = "github:numtide/llm-agents.nix";
     borgthin.url = "github:devplayer0/borg";
     # TODO: Update borgthin so this works
     # borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";

home-manager/modules/common.nix

@@ -67,6 +67,24 @@ in
         # never care about.
         home-manager.enable = true;
 
+        git = {
+          enable = true;
+          settings = {
+            user = {
+              email = "jackos1998@gmail.com";
+              name = "Jack O'Sullivan";
+            };
+            pull.rebase = true;
+          };
+          lfs.enable = true;
+        };
+        diff-so-fancy.enable = true;
+
+        jujutsu = {
+          enable = true;
+          settings.user = config.programs.git.settings.user;
+        };
+
         lsd = {
           enable = mkDefault true;
           enableFishIntegration = mkDefault true;

home-manager/modules/gui/default.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs', pkgs, config, ... }:
+{ lib, pkgs', pkgs, inputs, config, ... }:
 let
   inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault mkDefault optional;
   inherit (lib.my) mkOpt' mkBoolOpt';
@@ -187,6 +187,26 @@ in
             };
           };
 
+          codex = {
+            enable = true;
+            package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
+            mutableSettings = true;
+            settings.tui = {
+              status_line = [
+                "model-with-reasoning"
+                "current-dir"
+                "five-hour-limit"
+                "weekly-limit"
+                "context-used"
+                "context-window-size"
+                "total-input-tokens"
+                "total-output-tokens"
+                "used-tokens"
+              ];
+              status_line_use_colors = true;
+            };
+          };
+
           claude-code = {
             enable = true;
             settings = {
@@ -485,19 +505,6 @@ in
         };
 
         programs = {
-          git = {
-            enable = true;
-            settings = {
-              user = {
-                email = "jackos1998@gmail.com";
-                name = "Jack O'Sullivan";
-              };
-              pull.rebase = true;
-            };
-            lfs.enable = true;
-          };
-          diff-so-fancy.enable = true;
-
           waybar = import ./waybar.nix { inherit lib pkgs config font; };
           rofi = {
             enable = true;