feat!: add per-user role profiles

.github/workflows/verify.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Install verification tools
-        run: brew install actionlint shellcheck
+        run: brew install actionlint chezmoi shellcheck
 
       - name: Verify repository
         run: ./scripts/verify/repo.sh --skip-security

.mise/tasks/audit/personal/_default

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-#MISE description="Run the live personal Mac drift and secret-boundary audit"
+#MISE description="Compatibility alias for the workstation audit"
 set -euo pipefail
 
-./scripts/audit/personal.sh
+./scripts/audit/workstation.sh

.mise/tasks/audit/personal/json

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-#MISE description="Run the live personal Mac audit and print a JSON summary"
+#MISE description="Compatibility alias for the workstation audit JSON summary"
 set -euo pipefail
 
-./scripts/audit/personal.sh --json
+./scripts/audit/workstation.sh --json

.mise/tasks/audit/workstation/_default

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run the live workstation drift and secret-boundary audit"
+set -euo pipefail
+
+./scripts/audit/workstation.sh

.mise/tasks/audit/workstation/json

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run the live workstation audit and print a JSON summary"
+set -euo pipefail
+
+./scripts/audit/workstation.sh --json

.mise/tasks/verify/bootstrap/assistant

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Verify a live assistant user bootstrap"
+set -euo pipefail
+
+./scripts/verify/bootstrap.sh --profile assistant

.mise/tasks/verify/bootstrap/personal

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-#MISE description="Verify a live personal Mac bootstrap"
+#MISE description="Compatibility alias for workstation bootstrap verification"
 set -euo pipefail
 
-./scripts/verify/bootstrap.sh --profile personal
+./scripts/verify/bootstrap.sh --profile workstation

.mise/tasks/verify/bootstrap/workstation

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Verify a live workstation Mac bootstrap"
+set -euo pipefail
+
+./scripts/verify/bootstrap.sh --profile workstation

AGENTS.md

@@ -4,12 +4,14 @@ Guidance for agents helping with this repo.
 
 ## Role
 
-This is a public Mac bootstrap repo for uinaf machines. Help the user install
-tools, apply chezmoi-managed dotfiles, configure local identity, and verify a machine without
-turning private machine state into repository state.
+This is a vendor-neutral public macOS bootstrap framework for any person,
+team, or organization. Help the user install tools, apply chezmoi-managed
+dotfiles, configure local identity, and verify a machine without turning
+private machine state into repository state.
 
 Start with [README](README.md). Use [Bootstrap guide](docs/bootstrap.md) for
-install steps, [Devbox setup](docs/devbox.md) for shared agent hosts, and
+install steps, [User profiles](docs/profiles.md) for per-user role boundaries,
+[Devbox setup](docs/devbox.md) for shared agent hosts, and
 [Agent readiness](docs/agent-readiness.md) for verification expectations. Use
 [Chezmoi source state](docs/chezmoi.md) for dotfile changes and
 [Mise tasks](docs/mise.md) for task/runtime boundaries.
@@ -40,9 +42,11 @@ service-account refresh stacks.
 ## Agent Operating Checklist
 
 1. Run `git status --short --branch` before editing.
-2. Identify the target profile: `personal`, `devbox`, or repo-only docs/scripts.
+2. Identify the target profile: `workstation`, `devbox`, `assistant`, or
+   repo-only docs/scripts.
 3. Read only the relevant deep doc:
-   - personal or first-machine setup: [Bootstrap guide](docs/bootstrap.md)
+   - workstation or first-machine setup: [Bootstrap guide](docs/bootstrap.md)
+   - user-role boundaries: [User profiles](docs/profiles.md)
    - shared agent host: [Devbox setup](docs/devbox.md)
    - dotfile source changes: [Chezmoi source state](docs/chezmoi.md)
    - mise task or runtime changes: [Mise tasks](docs/mise.md)
@@ -60,7 +64,7 @@ service-account refresh stacks.
 
 ## Setup Flow
 
-For a human-operated Mac, follow [Personal Mac](docs/bootstrap.md#personal-mac).
+For a human-operated Mac, follow [Workstation Mac](docs/bootstrap.md#workstation-mac).
 
 For a shared agent host, follow [Devbox Mac](docs/bootstrap.md#devbox-mac) and
 then [Devbox setup](docs/devbox.md). Devbox commit signing is expected and must
@@ -82,6 +86,9 @@ Do not put identity-specific values in tracked files. `configure-git.sh` writes
 them to `~/.gitconfig.local`. On devboxes, use the human-provisioned local SSH
 key file for GitHub SSH auth; `configure-git.sh` writes the matching
 `~/.ssh/github.config` override when the signing key is a local path.
+Assistants use explicit workload authorship, unsigned commits, HTTPS remotes,
+and ephemeral GitHub App installation tokens through `git-as-github-app`; never
+invent the workload name, email, App identity, or token.
 
 ## Verification
 
@@ -106,8 +113,9 @@ To install the same fast gate as a local pre-push hook:
 For a live machine that should use these dotfiles:
 
 ```zsh
-./scripts/verify/bootstrap.sh --profile personal
+./scripts/verify/bootstrap.sh --profile workstation
 ./scripts/verify/bootstrap.sh --profile devbox
+./scripts/verify/bootstrap.sh --profile assistant
 ```
 
 For devbox users:
@@ -117,21 +125,26 @@ For devbox users:
 ./scripts/audit/devbox.sh
 ```
 
-For personal security drift:
+For workstation security drift:
 
 ```zsh
-./scripts/audit/personal.sh
+./scripts/audit/workstation.sh
 ```
 
 ## Repo Rules
 
 - Use Conventional Commits.
-- Keep `Brewfile` shared and profile-neutral.
-- Put laptop-only apps in `Brewfile.personal`.
-- Put shared agent-host and devbox tools in `Brewfile.devbox`.
-- Keep this repository standalone. Do not clone, install, invoke, or validate
-  `uinaf/agents` or `uinaf/workspace-kit`. They are optional companion tools
-  with their own setup and verification.
+- Keep `Brewfile` minimal and identity-safe.
+- Put the shared coding stack in `Brewfile.developer`.
+- Put role-specific software in `Brewfile.workstation`, `Brewfile.devbox`, or
+  `Brewfile.assistant`.
+- Keep this repository standalone. Do not require, clone, install, invoke, or
+  validate an agent framework or workspace manager.
+- Keep portable interfaces vendor-neutral. Do not add `uinaf` or another owner
+  name to installed paths, commands, config keys, template data, service labels,
+  example identities, or prose that describes the framework. Owner names are
+  allowed only for real external coordinates such as the upstream repository,
+  package tap, security contact, copyright, or a bounded legacy migration.
 - Keep Codex setup install-only here. Agent rules, skills, and workspace policy
   belong to whichever independent tools the machine owner chooses.
 - Treat Git tags and GitHub Releases as the canonical version. Do not add a
@@ -142,5 +155,5 @@ For personal security drift:
   [Mise tasks](docs/mise.md).
 - Update docs when scripts, profile behavior, audit behavior, or workflow names
   change.
-- Follow the uinaf repo-doc voice: proper-case headings, sentence-case body,
+- Follow the repo-doc voice: proper-case headings, sentence-case body,
   short direct prose, no emoji, no marketing copy.

Brewfile

@@ -1,57 +1,12 @@
-# Shared Homebrew layer for every uinaf Mac.
-# Install with one profile:
-#   ./scripts/bootstrap/brew-bundle.sh personal
-#   ./scripts/bootstrap/brew-bundle.sh devbox
+# Minimal Homebrew layer for every managed Unix user on macOS.
+# Profile-specific software belongs in Brewfile.developer and Brewfile.<profile>.
 
-# Taps
-tap "f1bonacc1/tap"
-tap "teamookla/speedtest"
-tap "uinaf/tap"
-
-# Terminal, browser, and agent apps
+# Identity-safe bootstrap tools
 brew "age"
-cask "ghostty"
-cask "zed"
-cask "google-chrome"
-cask "codex"
-cask "claude-code@latest"
-
-# Core CLI
 brew "git"
-brew "gh"
 brew "chezmoi"
 brew "mise"
 brew "direnv"
 brew "infisical"
 brew "btop"
 brew "ripgrep"
-brew "git-crypt"
-brew "git-filter-repo"
-brew "actionlint"
-brew "shellcheck"
-brew "xcodes"
-
-# Download and media helpers
-brew "aria2"
-brew "ffmpeg"
-brew "mole"
-
-# Containers
-brew "colima"
-brew "docker"
-brew "docker-buildx"
-brew "docker-compose"
-
-# Networking and diagnostics
-brew "fping"
-brew "teamookla/speedtest/speedtest"
-
-# Security
-brew "gitleaks"
-brew "lynis"
-brew "trufflehog"
-
-# uinaf tools
-
-# Process supervision
-brew "f1bonacc1/tap/process-compose"

Brewfile.assistant

@@ -0,0 +1,11 @@
+# Minimal unattended assistant layer.
+# Workload repositories own OpenClaw, Hermes, and provider-specific installs.
+
+tap "f1bonacc1/tap"
+
+# Browser and media capabilities used by assistant runtimes
+cask "google-chrome"
+brew "ffmpeg"
+
+# User-level process supervision
+brew "f1bonacc1/tap/process-compose"

Brewfile.devbox

@@ -1,9 +1,10 @@
 # Devbox Homebrew layer.
-# Run through ./scripts/bootstrap/brew-bundle.sh so the shared Brewfile installs first.
+# Run through brew-bundle.sh so base and developer layers install first.
 
 # Taps
 tap "steipete/tap"
 tap "openclaw/tap"
+tap "uinaf/tap"
 
 # Cloud CLI
 cask "gcloud-cli"

Brewfile.developer

@@ -0,0 +1,43 @@
+# Shared development layer for workstation and devbox users.
+
+# Taps
+tap "f1bonacc1/tap"
+tap "teamookla/speedtest"
+
+# Terminal, browser, and coding agents
+cask "ghostty"
+cask "zed"
+cask "google-chrome"
+cask "codex"
+cask "claude-code@latest"
+
+# Development CLI
+brew "gh"
+brew "git-crypt"
+brew "git-filter-repo"
+brew "actionlint"
+brew "shellcheck"
+brew "xcodes"
+
+# Download and media helpers
+brew "aria2"
+brew "ffmpeg"
+brew "mole"
+
+# Containers
+brew "colima"
+brew "docker"
+brew "docker-buildx"
+brew "docker-compose"
+
+# Networking and diagnostics
+brew "fping"
+brew "teamookla/speedtest/speedtest"
+
+# Security
+brew "gitleaks"
+brew "lynis"
+brew "trufflehog"
+
+# Process supervision
+brew "f1bonacc1/tap/process-compose"

Brewfile.personal → Brewfile.workstation

@@ -1,5 +1,5 @@
-# Personal Mac Homebrew layer.
-# Run through ./scripts/bootstrap/brew-bundle.sh so the shared Brewfile installs first.
+# Human-operated workstation Homebrew layer.
+# Run through brew-bundle.sh so base and developer layers install first.
 
 # Taps
 tap "openclaw/tap"

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 ## Scope
 
-This repo is a public Mac bootstrap layer for uinaf machines.
+This repo is a reusable public macOS bootstrap layer.
 
 Keep changes portable. Machine identity, secrets, tokens, keys, certificates,
 Codex state, browser profiles, app caches, and project checkouts stay local.
@@ -15,10 +15,10 @@ the [Bootstrap guide](docs/bootstrap.md), then choose the profile for this Mac:
 ```zsh
 gh auth login
 
-gh repo clone uinaf/dotfiles ~/projects/uinaf/dotfiles
-cd ~/projects/uinaf/dotfiles
-profile=personal # use devbox on a shared agent host
-./scripts/bootstrap/brew-bundle.sh --shared-only "$profile"
+gh repo clone uinaf/dotfiles ~/projects/dotfiles
+cd ~/projects/dotfiles
+profile=workstation # use devbox for a remote coding identity
+./scripts/bootstrap/brew-bundle.sh "$profile"
 ```
 
 For full machine bootstrap, or for a fresh Mac that does not have `git` or
@@ -40,10 +40,10 @@ but run the full command before committing or pushing.
 
 ## Brewfiles
 
-- `Brewfile` is the shared app and CLI set for every uinaf Mac.
-- `Brewfile.personal` contains shared personal Mac apps and local development
-  extras, not one-user preferences.
-- `Brewfile.devbox` contains shared Mac mini/devbox tools.
+- `Brewfile` is the minimal identity-safe base.
+- `Brewfile.developer` contains the shared coding stack.
+- `Brewfile.workstation`, `Brewfile.devbox`, and `Brewfile.assistant` contain
+  role-specific software.
 
 Keep one-machine personalization local. Use a fork for durable personal
 preferences, and send a focused pull request when a preference should become