refactor(dsk): rename the desktop tier and give its agents a category

Every desk- role becomes dsk-, and the three coding agents move to dsk-gnt- under a category of their own. The category carries a title, hanzi and icon but no invokable flag: an invokable child under an invokable parent is rejected outright, which is also why web itself is not invokable. Three things a search and replace would have broken without a sound. get_entity_name now strips dsk-gnt-, so the primary entity keys agnt-claude, agnt-cursor and agnt-pi no longer resolved and all three roles dropped out of the CI plan. Eighteen run_once guards carried the old name against a convention its own test enforces. DESKTOP_ROLE_PREFIX in the addon spec lint is a literal, so the desktop exemption it grants would have matched nothing and the lint would have moved to the wrong rule in silence. docs/requirements/035 is not a historical document but a register a lint holds to every role with an application_id, so its list carries the new ids. In 026 only the links move; the prose stays as a statement about the tree at the time it was written. Measured against the plan with the rename normalised, the deployed role#variant set is unchanged. A stale id in an inventory is caught before any deploy starts: the pre-flight validator reports Invalid group 'desk-firefox' (not in application_ids). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-11-09 20:26:33 +00:00 · 2026-09-24 22:15:41 +02:00
1 parent dc815bdaf1
commit 53c120aaac
@@ -1,6 +1,6 @@
 ## Summary

-Briefly describe the `desk-*` change and the user workflow it affects.
+Briefly describe the `dsk-*` change and the user workflow it affects.

 Examples:

@@ -24,7 +24,7 @@ Select the primary intent of this PR:

 List the impacted roles and workstation context.

-* Primary `desk-*` role(s):
+* Primary `dsk-*` role(s):
 * Related `dev-*`, `drv-*`, `user-*`, or `sys-*` role(s):
 * Distro(s) and desktop environment(s) tested:

@@ -36,7 +36,7 @@ Optional. Ignored unless a maintainer applies the **🧩 Subset** label; without

 ```yaml
 roles:
-  # - desk-firefox
+  # - dsk-firefox
  # - sys-version
 ```

@@ -8,7 +8,7 @@
 Then select the template that best matches your change:

 [![Server](https://img.shields.io/badge/Server-web--*-0A7B83?style=for-the-badge)](?quick_pull=1&template=server.md)
-[![Workstation](https://img.shields.io/badge/Workstation-desk--*-2E6F40?style=for-the-badge)](?quick_pull=1&template=workstation.md)
+[![Workstation](https://img.shields.io/badge/Workstation-dsk--*-2E6F40?style=for-the-badge)](?quick_pull=1&template=workstation.md)
 [![System](https://img.shields.io/badge/System-sys%2Fsvc%2Fdev-8B5E3C?style=for-the-badge)](?quick_pull=1&template=system.md)

 [![Pipeline](https://img.shields.io/badge/Pipeline-CI%2FCD-7A3E9D?style=for-the-badge)](?quick_pull=1&template=pipeline.md)
@@ -76,13 +76,13 @@ Every invokable role in the tested lifecycle envelope, with its upstream homepag
 | [Bridgy Fed](roles/web-app-bridgy-fed/) | beta | Federation bridge connecting ActivityPub (Fediverse), the AT Protocol (Bluesky), and the IndieWeb | [🌐](https://fed.brid.gy/) [🛠️](roles/web-app-bridgy-fed/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Checkmk](roles/web-app-checkmk/) | beta | Open-source IT and application monitoring server behind SSO with native LDAP user management | [🌐](https://checkmk.com/) [🎬](https://www.youtube.com/watch?v=opO-SOgOJ1I) [🛠️](roles/web-app-checkmk/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Hermes Agent](roles/web-app-hermes/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [Open WebUI](roles/web-app-openwebui/), [OpenClaw](roles/web-app-openclaw/), [OpenLDAP](roles/svc-db-openldap/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Chess](roles/web-app-chess/) | beta | Federated chess server for playing and following rule-validated games over ActivityPub across the Fediverse | [🌐](https://castling.club/) [🛠️](roles/web-app-chess/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Matomo](roles/web-app-matomo/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
-| [Claude Code](roles/desk-agnt-claude/) | alpha | Terminal coding agent from Anthropic, pointed at the platform's own model gateway instead of the vendor API | [🌐](https://code.claude.com/) [🛠️](roles/desk-agnt-claude/README.md#quick-setup) |  |
-| [Code](roles/desk-code/) | alpha | Visual Studio Code workstation editor in a selectable flavor, carrying the extensions of the agents the host deploys | [🌐](https://github.com/microsoft/vscode) [🛠️](roles/desk-code/README.md#quick-setup) |  |
+| [Claude Code](roles/dsk-gnt-claude/) | alpha | Terminal coding agent from Anthropic, pointed at the platform's own model gateway instead of the vendor API | [🌐](https://code.claude.com/) [🛠️](roles/dsk-gnt-claude/README.md#quick-setup) |  |
+| [Code](roles/dsk-code/) | alpha | Visual Studio Code workstation editor in a selectable flavor, carrying the extensions of the agents the host deploys | [🌐](https://github.com/microsoft/vscode) [🛠️](roles/dsk-code/README.md#quick-setup) |  |
 | [Collabora](roles/web-svc-collabora/) | beta | Self-hosted online office backend for real-time in-browser editing of documents, spreadsheets, and presentations | [🌐](https://www.collaboraonline.com/) [🎬](https://www.youtube.com/watch?v=8pqkclWG2BY) [🛠️](roles/web-svc-collabora/README.md#quick-setup) | [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Content Delivery Network](roles/web-svc-cdn/) | beta | Nginx-based content delivery network for serving shared static assets to internal web applications | [🛠️](roles/web-svc-cdn/README.md#quick-setup) | [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Corporate Design](roles/web-svc-css/) | beta | Service-registry role owning the canonical `css` flag and redirecting the CSS hostname to the CDN upstream | [🛠️](roles/web-svc-css/README.md#quick-setup) | [Content Delivery Network](roles/web-svc-cdn/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Coturn](roles/web-svc-coturn/) | beta | Free and open-source TURN/STUN relay server for NAT traversal in WebRTC and real-time communication | [🌐](https://github.com/coturn/coturn) [🛠️](roles/web-svc-coturn/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Prometheus](roles/web-app-prometheus/) |
-| [Cursor](roles/desk-agnt-cursor/) | alpha | AI-first code editor installed on the workstation, whose endpoint override stays an operator step | [🌐](https://cursor.com/) [🛠️](roles/desk-agnt-cursor/README.md#quick-setup) |  |
+| [Cursor](roles/dsk-gnt-cursor/) | alpha | AI-first code editor installed on the workstation, whose endpoint override stays an operator step | [🌐](https://cursor.com/) [🛠️](roles/dsk-gnt-cursor/README.md#quick-setup) |  |
 | [Dashboard](roles/web-app-dashboard/) | beta | Self-hosted portal for unified access to all deployed applications via a customizable tile and menu interface | [🛠️](roles/web-app-dashboard/README.md#quick-setup) | [Assets Server](roles/web-svc-asset/), [Content Delivery Network](roles/web-svc-cdn/), [Corporate Design](roles/web-svc-css/), [Keycloak](roles/web-app-keycloak/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Simple Icons](roles/web-svc-simpleicons/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Decidim](roles/web-app-decidim/) | beta | Open-source participatory democracy platform for public consultations, civic processes, and community voting | [🌐](https://decidim.org/) [🎬](https://www.youtube.com/watch?v=luSdPZ-wUIY) [🛠️](roles/web-app-decidim/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Redis](roles/svc-db-redis/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [Discourse](roles/web-app-discourse/) | beta | Open-source discussion and community forum platform with moderation, notifications, and plugin support | [🌐](https://www.discourse.org/) [🎬](https://www.youtube.com/watch?v=z3qp_uB46FA) [🛠️](roles/web-app-discourse/README.md#quick-setup) | [Assets Server](roles/web-svc-asset/), [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [LiteLLM Gateway](roles/svc-ai-litellm/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Redis](roles/svc-db-redis/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
@@ -160,7 +160,7 @@ Every invokable role in the tested lifecycle envelope, with its upstream homepag
 | [Penpot](roles/web-app-penpot/) | beta | Self-hosted design and prototyping platform for UI/UX work, real-time collaboration, and developer handoff | [🌐](https://penpot.app/) [🎬](https://www.youtube.com/watch?v=vAkb4QQmbfk) [🛠️](roles/web-app-penpot/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [OpenLDAP](roles/svc-db-openldap/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Redis](roles/svc-db-redis/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [pgAdmin](roles/web-app-pgadmin/) | beta | Web-based administration and development platform for managing multiple PostgreSQL servers, with optional OAuth2 login | [🌐](https://www.pgadmin.org/) [🎬](https://www.youtube.com/watch?v=WFT5MaZN6g4) [🛠️](roles/web-app-pgadmin/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [Matomo](roles/web-app-matomo/), [PostgreSQL](roles/svc-db-postgres/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [PhpMyAdmin](roles/web-app-phpmyadmin/) | beta | Web-based administration tool for MySQL and MariaDB with schema management, querying, and import/export | [🌐](https://www.phpmyadmin.net/) [🛠️](roles/web-app-phpmyadmin/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [MariaDB](roles/svc-db-mariadb/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
-| [Pi Coding Agent](roles/desk-agnt-pi/) | alpha | Minimal terminal coding agent with a lazy-loading skill system, wired to the platform's own model gateway | [🌐](https://github.com/earendil-works/pi) [🛠️](roles/desk-agnt-pi/README.md#quick-setup) |  |
+| [Pi Coding Agent](roles/dsk-gnt-pi/) | alpha | Minimal terminal coding agent with a lazy-loading skill system, wired to the platform's own model gateway | [🌐](https://github.com/earendil-works/pi) [🛠️](roles/dsk-gnt-pi/README.md#quick-setup) |  |
 | [Pixelfed](roles/web-app-pixelfed/) | beta | Decentralized, federated platform for photo sharing and image feeds across the fediverse | [🌐](https://pixelfed.org/) [🛠️](roles/web-app-pixelfed/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Mailu](roles/web-app-mailu/), [MariaDB](roles/svc-db-mariadb/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Redis](roles/svc-db-redis/), [SeaweedFS](roles/web-app-seaweedfs/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
 | [PostgreSQL](roles/svc-db-postgres/) | beta | Containerized relational database with automated database, user, and privilege provisioning | [🌐](https://www.postgresql.org/) [🛠️](roles/svc-db-postgres/README.md#quick-setup) | [Backup Docker Volumes](roles/svc-bkp-volume-2-local/), [Tor Onion Service](roles/svc-net-tor/) |
 | [Postmarks](roles/web-app-postmarks/) | beta | Single-user ActivityPub bookmarking site federating public bookmarks to Mastodon and the Fediverse | [🌐](https://github.com/ckolderup/postmarks) [🛠️](roles/web-app-postmarks/README.md#quick-setup) | [Corporate Design](roles/web-svc-css/), [Dashboard](roles/web-app-dashboard/), [Keycloak](roles/web-app-keycloak/), [Matomo](roles/web-app-matomo/), [Prometheus](roles/web-app-prometheus/), [Tor Onion Service](roles/svc-net-tor/), [Universal Logout](roles/web-svc-logout/) |
@@ -7,7 +7,7 @@ You MUST pick the template that matches your change. The table below links the a
 | Change type | Template |
 |---|---|
 | Server and `web-*` changes | [server.md](../../../../.github/PULL_REQUEST_TEMPLATE/server.md) |
-| Workstation and `desk-*` changes | [workstation.md](../../../../.github/PULL_REQUEST_TEMPLATE/workstation.md) |
+| Workstation and `dsk-*` changes | [workstation.md](../../../../.github/PULL_REQUEST_TEMPLATE/workstation.md) |
 | Shared system changes such as `sys-*`, `svc-*`, `dev-*`, `drv-*`, `pkgmgr`, `update-*`, or `user-*` | [system.md](../../../../.github/PULL_REQUEST_TEMPLATE/system.md) |
 | CI/CD and workflow changes | [pipeline.md](../../../../.github/PULL_REQUEST_TEMPLATE/pipeline.md) |
 | Documentation-only changes limited to `.md` or `.rst` files outside `AGENTS.md` and `docs/agents/*` | [documentation.md](../../../../.github/PULL_REQUEST_TEMPLATE/documentation.md) |
@@ -29,7 +29,7 @@ A role usually owns one capability:
 - `svc-*` for shared services such as databases, proxies, mail, DNS, VPN, backups, and identity support
 - `web-app-*` for end-user applications
 - `dev-*` for development tooling
- `desk-*` for workstation setup
+- `dsk-*` for workstation setup
 - `web-svc-*` and `web-opt-*` for web-facing helpers and redirects

 For example, `web-app-nextcloud` owns the Nextcloud deployment, `sys-svc-webserver-https` owns the HTTPS plumbing, and `sys-ctl-cln-docker` handles Docker cleanup.
@@ -15,7 +15,7 @@ The repository already deploys role-level extension units, but each role spells
 - [web-app-mediawiki](../../roles/web-app-mediawiki/) calls them `extensions` and hard-codes the list in [vars/main.yml](../../roles/web-app-mediawiki/vars/main.yml).
 - [web-app-xwiki](../../roles/web-app-xwiki/) calls them `plugins` (with nested `items[].id` + `version`) under `xwiki.plugins` in [meta/services.yml](../../roles/web-app-xwiki/meta/services.yml).
 - [web-app-joomla](../../roles/web-app-joomla/) builds a single OIDC `plugin` in [tasks/08_oidc_plugin.yml](../../roles/web-app-joomla/tasks/08_oidc_plugin.yml).
- [desk-gnome-extensions](../../roles/desk-gnome-extensions/) calls them `plugins`/`extensions` and loops over `services.gnome-extensions.plugins`.
+- [dsk-gnome-extensions](../../roles/dsk-gnome-extensions/) calls them `plugins`/`extensions` and loops over `services.gnome-extensions.plugins`.

 The [per-role meta layout](../contributing/design/role/services/layout.md) already lists `addons`, `plugins`, and `modules` among the keys *inlined* under the primary service entity. This requirement promotes that concept to a first-class, per-file `meta/addons/<addon_id>.yml` topic (one file per addon, file root IS the addon spec), the same move requirement 011 made for `meta/info.yml` and requirement 008/009 made for other meta topics.

@@ -61,10 +61,10 @@ Each row is a migration target. The "Bridges" column is the cross-role dependenc
 | [web-app-discourse](../../roles/web-app-discourse/) | `plugin` | `docker_manager, discourse-activity-pub, discourse-akismet, discourse-ldap-auth` | `discourse-ldap-auth` → `svc-db-openldap` | [meta/services.yml](../../roles/web-app-discourse/meta/services.yml) `discourse.plugins` |
 | [web-app-pretix](../../roles/web-app-pretix/) | `plugin` | `oidc` (v2.3.1) | `sso` → `web-app-keycloak` | [meta/services.yml](../../roles/web-app-pretix/meta/services.yml) `pretix.plugins` |
 | [web-app-mattermost](../../roles/web-app-mattermost/) | `plugin` | volume-managed plugins (`plugins`, `client-plugins`) | none declared today | [vars/main.yml](../../roles/web-app-mattermost/vars/main.yml), [meta/volumes.yml](../../roles/web-app-mattermost/meta/volumes.yml) |
-| [desk-chromium](../../roles/desk-chromium/) | `extension` | CRX ids, `force_installed` (e.g. uBlock Origin) | none (desktop role) | [meta/services.yml](../../roles/desk-chromium/meta/services.yml) `plugins` |
-| [desk-firefox](../../roles/desk-firefox/) | `extension` | XPI urls (uBlock Origin, KeePassXC) | none (desktop role) | [meta/services.yml](../../roles/desk-firefox/meta/services.yml) `plugins` |
-| [desk-gnome](../../roles/desk-gnome/) | `extension` | gnome-shell extensions (enable/disable tuples) | none (desktop role) | [meta/services.yml](../../roles/desk-gnome/meta/services.yml) `plugins` |
-| [desk-gnome-extensions](../../roles/desk-gnome-extensions/) | `extension` | configured list (`services.gnome-extensions.plugins`) | none (desktop role) | [meta/services.yml](../../roles/desk-gnome-extensions/meta/services.yml) |
+| [dsk-chromium](../../roles/dsk-chromium/) | `extension` | CRX ids, `force_installed` (e.g. uBlock Origin) | none (desktop role) | [meta/services.yml](../../roles/dsk-chromium/meta/services.yml) `plugins` |
+| [dsk-firefox](../../roles/dsk-firefox/) | `extension` | XPI urls (uBlock Origin, KeePassXC) | none (desktop role) | [meta/services.yml](../../roles/dsk-firefox/meta/services.yml) `plugins` |
+| [dsk-gnome](../../roles/dsk-gnome/) | `extension` | gnome-shell extensions (enable/disable tuples) | none (desktop role) | [meta/services.yml](../../roles/dsk-gnome/meta/services.yml) `plugins` |
+| [dsk-gnome-extensions](../../roles/dsk-gnome-extensions/) | `extension` | configured list (`services.gnome-extensions.plugins`) | none (desktop role) | [meta/services.yml](../../roles/dsk-gnome-extensions/meta/services.yml) |

 ### Out of scope: database/runtime engine extensions

@@ -271,9 +271,9 @@ Rules:
 - [ ] [web-app-discourse](../../roles/web-app-discourse/) declares its plugins in `meta/addons/` with `mechanism: plugin`; `discourse-ldap-auth` carries `bridges: [ldap]` resolving to the `ldap` service block, while `docker_manager`, `discourse-activity-pub`, and `discourse-akismet` carry no `bridges`.
 - [ ] [web-app-pretix](../../roles/web-app-pretix/) declares its `oidc` plugin in `meta/addons/` with `mechanism: plugin`, the `2.3.1` pin preserved as a string `version`, and `bridges: [sso]`.
 - [ ] [web-app-mattermost](../../roles/web-app-mattermost/) declares its plugins in `meta/addons/` with `mechanism: plugin`; the plugin volumes remain in `meta/volumes.yml`.
- [x] [desk-chromium](../../roles/desk-chromium/) and [desk-firefox](../../roles/desk-firefox/) declare their browser extensions in `meta/addons/` with `mechanism: extension`, no `bridges`, and ship NO Playwright specs (desktop roles have no web surface; the lint forbids specs under `desk-*`).
- [x] [desk-gnome](../../roles/desk-gnome/) declares its gnome-shell extensions in `meta/addons/` with `mechanism: extension` and no `bridges`.
- [ ] [desk-gnome-extensions](../../roles/desk-gnome-extensions/) declares its extensions in `meta/addons/` with `mechanism: extension` and no `bridges`.
+- [x] [dsk-chromium](../../roles/dsk-chromium/) and [dsk-firefox](../../roles/dsk-firefox/) declare their browser extensions in `meta/addons/` with `mechanism: extension`, no `bridges`, and ship NO Playwright specs (desktop roles have no web surface; the lint forbids specs under `dsk-*`).
+- [x] [dsk-gnome](../../roles/dsk-gnome/) declares its gnome-shell extensions in `meta/addons/` with `mechanism: extension` and no `bridges`.
+- [ ] [dsk-gnome-extensions](../../roles/dsk-gnome-extensions/) declares its extensions in `meta/addons/` with `mechanism: extension` and no `bridges`.
 - [x] [web-app-mobilizon](../../roles/web-app-mobilizon/) and [web-app-bookwyrm](../../roles/web-app-bookwyrm/) keep their `extensions:` (PostgreSQL/engine extensions) in `meta/services.yml`; they are classified `db-extension` and explicitly NOT migrated to `meta/addons/`.

 ### Cross-role integration (matrix backlog)
@@ -485,7 +485,7 @@ An adapter could reach these, and none has been curated yet. The five that used
 These roles remain out of shared MCP discovery.
 A future exception requires a new requirement with a fixed operation list, dedicated identity, isolation boundary, human approval for mutations, and audit trail.

-**`host_execution_boundary` (44):** `desk-agnt-claude`, `desk-agnt-cursor`, `desk-agnt-pi`, `desk-bluray-player`, `desk-chromium`, `desk-code`, `desk-copyq`, `desk-docker`, `desk-dotlinker`, `desk-firefox`, `desk-git`, `desk-gnome`, `desk-gnome-caffeine`, `desk-gnome-extensions`, `desk-gnome-terminal`, `desk-gnucash`, `desk-jrnl`, `desk-keepassxc`, `desk-laya`, `desk-libreoffice`, `desk-micro`, `desk-neovim`, `desk-nextcloud`, `desk-obs`, `desk-qbittorrent`, `desk-retroarch`, `desk-spotify`, `desk-ssh`, `desk-torbrowser`, `desk-virtualbox`, `desk-zoom`, `dev-arduino`, `dev-core`, `dev-java`, `dev-locales`, `dev-make`, `dev-nix`, `dev-nodejs`, `dev-python`, `drv-epson-multiprinter`, `drv-intel`, `drv-lid-switch`, `drv-non-free`, `gen-hunspell`.
+**`host_execution_boundary` (44):** `dev-arduino`, `dev-core`, `dev-java`, `dev-locales`, `dev-make`, `dev-nix`, `dev-nodejs`, `dev-python`, `drv-epson-multiprinter`, `drv-intel`, `drv-lid-switch`, `drv-non-free`, `dsk-bluray-player`, `dsk-chromium`, `dsk-code`, `dsk-copyq`, `dsk-docker`, `dsk-dotlinker`, `dsk-firefox`, `dsk-git`, `dsk-gnome`, `dsk-gnome-caffeine`, `dsk-gnome-extensions`, `dsk-gnome-terminal`, `dsk-gnt-claude`, `dsk-gnt-cursor`, `dsk-gnt-pi`, `dsk-gnucash`, `dsk-jrnl`, `dsk-keepassxc`, `dsk-laya`, `dsk-libreoffice`, `dsk-micro`, `dsk-neovim`, `dsk-nextcloud`, `dsk-obs`, `dsk-qbittorrent`, `dsk-retroarch`, `dsk-spotify`, `dsk-ssh`, `dsk-torbrowser`, `dsk-virtualbox`, `dsk-zoom`, `gen-hunspell`.
 These roles operate a workstation, developer toolchain, device, or host package; bridging them would amount to shared shell, filesystem, browser-session, device, or host execution without an application-specific remote identity.

 **`privileged_control_plane` (27):** `svc-ai-agent-broker`, `svc-ai-jupyter`, `svc-bkp-local-2-device`, `svc-bkp-nfs-2-local`, `svc-bkp-remote-2-local`, `svc-bkp-secrets-2-local`, `svc-bkp-volume-2-local`, `svc-dns-unbound`, `svc-net-firewall`, `svc-net-tor`, `svc-net-wireguard-core`, `svc-net-wireguard-firewalled`, `svc-net-wireguard-plain`, `svc-opt-keyboard-color`, `svc-opt-ssd-hdd`, `svc-opt-swapfile`, `svc-prx-openresty`, `svc-registry-cache`, `svc-registry-docker`, `svc-runner`, `svc-storage-nfs-client`, `svc-storage-nfs-server`, `svc-swarm-manager`, `svc-swarm-node`, `svc-virt-kata`, `update`, `web-app-openbao`.
@@ -20,6 +20,6 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
@@ -17,6 +17,6 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
@@ -13,9 +13,9 @@ all:
  hosts:
    workstation:
  children:
-    desk-chromium:
+    dsk-chromium:
      hosts:
        workstation:
-    desk-firefox:
+    dsk-firefox:
      hosts:
        workstation:
@@ -17,7 +17,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-arduino:
@@ -17,7 +17,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-core:
@@ -18,7 +18,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-core:
@@ -18,7 +18,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-core:
@@ -17,7 +17,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-python:
@@ -18,7 +18,7 @@ all:
  hosts:
    workstation:
  children:
-    desk-git:
+    dsk-git:
      hosts:
        workstation:
    dev-core:
@@ -29,6 +29,6 @@ all:
  hosts:
    workstation:
  children:
-    desk-retroarch:
+    dsk-retroarch:
      hosts:
        workstation:
@@ -17,12 +17,12 @@ all:
  hosts:
    workstation:
  children:
-    desk-libreoffice:
+    dsk-libreoffice:
      hosts:
        workstation:
-    desk-chromium:
+    dsk-chromium:
      hosts:
        workstation:
-    desk-firefox:
+    dsk-firefox:
      hosts:
        workstation:
@@ -150,7 +150,7 @@ roles:
    run_after: [drv]
    invokable: true

-  desk:
+  dsk:
    title: "Desktop"
    hanzi: "桌面" # Means "desktop" or literally "desk surface".
    description: "Desktop environment roles & apps (GNOME, browser, LibreOffice, etc.)"
@@ -158,6 +158,12 @@ roles:
    stage: workstation
    invokable: true

+    gnt:
+      title: "Agents"
+      hanzi: "代理" # Means "agent" or "proxy".
+      description: "Coding agents installed on the workstation (Claude Code, Cursor, Pi)"
+      icon: "fas fa-robot"
+
  web:
    title: "Web Infrastructure"
    hanzi: "网络" # Means "network" or "web".
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_agnt_claude is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-agnt-cursor
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_agnt_pi is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-bluray-player
@@ -1,3 +0,0 @@
---
-
-application_id: "desk-chromium"
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_code is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-docker
@@ -1,2 +0,0 @@
---
-application_id: desk-dotlinker
@@ -1,2 +0,0 @@
---
-application_id: desk-git
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_gnome_caffeine is not defined
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_gnome_extensions is not defined
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_gnome_terminal is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-gnome-terminal
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_gnome is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-gnucash
@@ -1,2 +0,0 @@
---
-application_id: desk-jrnl
@@ -1,2 +0,0 @@
---
-application_id: desk-keepassxc
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_laya is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-obs
@@ -1,2 +0,0 @@
---
-application_id: desk-qbittorrent
@@ -1,2 +0,0 @@
---
-application_id: desk-retroarch
@@ -1,2 +0,0 @@
---
-application_id: desk-spotify
@@ -1,3 +0,0 @@
---
- include_tasks: 00_core.yml
-  when: run_once_desk_ssh is not defined
@@ -1,2 +0,0 @@
---
-application_id: desk-torbrowser
@@ -1,2 +0,0 @@
---
-application_id: desk-virtualbox
@@ -1,2 +0,0 @@
---
-application_id: desk-zoom
@@ -18,9 +18,9 @@ flowchart LR
        svc_java["java"]
    end
    subgraph dependents [Dependents]
-        dpt_desk_bluray_player["desk-bluray-player 💻 ⚙️"]
+        dpt_dsk_bluray_player["dsk-bluray-player 💻 ⚙️"]
    end
-    svc_java -- "1:1" --> dpt_desk_bluray_player
+    svc_java -- "1:1" --> dpt_dsk_bluray_player
 ```

 Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (enabled only in matching deployments); red `0..0` edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in `meta/main.yml`.
@@ -22,7 +22,7 @@ flowchart LR
    subgraph deps [Dependencies]
        dep_dev_java["dev-java 💻 ⚙️"]
    end
-    subgraph role [desk-bluray-player 💻]
+    subgraph role [dsk-bluray-player 💻]
        svc_bluray_player["bluray-player"]
    end
    dep_dev_java -- "1:1" --> svc_bluray_player
@@ -57,7 +57,7 @@ Clone, set up the workstation, and deploy Blue-ray Disc onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-bluray-player full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-bluray-player full_cycle=false
 ```

 ### Production
@@ -71,7 +71,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-bluray-player
+APP=dsk-bluray-player
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -0,0 +1,2 @@
+---
+application_id: dsk-bluray-player
@@ -14,7 +14,7 @@ The diagram places Chromium in the Infinito.Nexus cosmos: the components it depl

 ```mermaid
 flowchart LR
-    subgraph role [desk-chromium 💻]
+    subgraph role [dsk-chromium 💻]
        svc_chromium["chromium"]
    end
 ```
@@ -43,7 +43,7 @@ Clone, set up the workstation, and deploy Chromium onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-chromium full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-chromium full_cycle=false
 ```

 ### Production
@@ -57,7 +57,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-chromium
+APP=dsk-chromium
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -3,10 +3,10 @@
  package_install:
    id: chromium

- name: 📂 Include dependency 'desk-keepassxc'
+- name: 📂 Include dependency 'dsk-keepassxc'
  include_role:
-    name: desk-keepassxc
-  when: run_once_desk_keepassxc is not defined
+    name: dsk-keepassxc
+  when: run_once_dsk_keepassxc is not defined

 - name: ✅ Ensure Chromium policies directory exists
  file:
@@ -0,0 +1,3 @@
+---
+
+application_id: "dsk-chromium"
@@ -8,9 +8,9 @@

 `services.code.flavor` picks one of `code-oss`, `vscodium` or `vscode`. The three builds conflict at package level, so the role removes the other two before installing the chosen one.

-The role also carries the editor extensions of the agents the same host deploys: when `desk-agnt-claude` is in the host's groups, the Claude Code extension is installed into the chosen flavor. Code - OSS and VSCodium resolve extensions through Open VSX, which carries that extension as well.
+The role also carries the editor extensions of the agents the same host deploys: when `dsk-gnt-claude` is in the host's groups, the Claude Code extension is installed into the chosen flavor. Code - OSS and VSCodium resolve extensions through Open VSX, which carries that extension as well.

-`desk-agnt-cursor` and `desk-agnt-pi` carry no entry in that map. Cursor is a full editor rather than an extension, and neither vendor publishes an extension on Open VSX, so there is nothing to install into Code for them. Both agents are used from their own binary.
+`dsk-gnt-cursor` and `dsk-gnt-pi` carry no entry in that map. Cursor is a full editor rather than an extension, and neither vendor publishes an extension on Open VSX, so there is nothing to install into Code for them. Both agents are used from their own binary.

 ## Cosmos

@@ -18,7 +18,7 @@ The diagram places Code in the Infinito.Nexus cosmos: the components it deploys

 ```mermaid
 flowchart LR
-    subgraph role [desk-code 💻]
+    subgraph role [dsk-code 💻]
        svc_code["code"]
    end
 ```
@@ -42,7 +42,7 @@ Clone, set up the workstation, and deploy Code onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-code full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-code full_cycle=false
 ```

 ### Production
@@ -56,7 +56,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-code
+APP=dsk-code
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -0,0 +1,3 @@
+---
+- include_tasks: 00_core.yml
+  when: run_once_dsk_code is not defined
@@ -1,5 +1,5 @@
 ---
-application_id: desk-code
+application_id: dsk-code
 code_flavor: "{{ lookup('config', application_id, 'services.code.flavor') }}"
 code_flavors:
  code-oss:
@@ -11,5 +11,5 @@ code_flavors:
 code_binary: "{{ code_flavors[code_flavor].binary }}"
 code_conflicting_flavors: "{{ code_flavors.keys() | reject('equalto', code_flavor) | list }}"
 code_agent_extensions:
-  desk-agnt-claude: anthropic.claude-code
+  dsk-gnt-claude: anthropic.claude-code
 code_wanted_extensions: "{{ code_agent_extensions | dict2items | selectattr('key', 'in', group_names) | map(attribute='value') | list }}"
@@ -14,7 +14,7 @@ The diagram places CopyQ in the Infinito.Nexus cosmos: the components it deploys

 ```mermaid
 flowchart LR
-    subgraph role [desk-copyq 💻]
+    subgraph role [dsk-copyq 💻]
        svc_copyq["copyq"]
    end
 ```
@@ -35,7 +35,7 @@ Clone, set up the workstation, and deploy CopyQ onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-copyq full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-copyq full_cycle=false
 ```

 ### Production
@@ -49,7 +49,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-copyq
+APP=dsk-copyq
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -1,3 +1,3 @@
 ---
-application_id: desk-copyq
+application_id: dsk-copyq
 copyq_server_enabled: "{{ lookup('config', application_id, 'services.copyq.server_enabled') }}"
@@ -6,7 +6,7 @@ Installs Docker and Docker Compose, and adds a user to the Docker group for non-

 ## Overview

-This playbook, `desk-docker`, is part of a larger collection housed within the `infinito` repository. It is specifically tailored for setting up Docker and Docker Compose on personal computers (PCs) used for development purposes. The primary goal is to facilitate a development environment on individual workstations rather than configuring servers for hosting or distributing Docker images.
+This playbook, `dsk-docker`, is part of a larger collection housed within the `infinito` repository. It is specifically tailored for setting up Docker and Docker Compose on personal computers (PCs) used for development purposes. The primary goal is to facilitate a development environment on individual workstations rather than configuring servers for hosting or distributing Docker images.

 ## Cosmos

@@ -14,7 +14,7 @@ The diagram places Workstation Docker in the Infinito.Nexus cosmos: the componen

 ```mermaid
 flowchart LR
-    subgraph role [desk-docker 💻]
+    subgraph role [dsk-docker 💻]
        svc_docker["docker"]
    end
 ```
@@ -23,7 +23,7 @@ Solid `1:1` edges are fixed relationships; dashed `0..1` edges are conditional (

 ## Features

-The `main.yml` file in the `desk-docker` role consists of two primary tasks:
+The `main.yml` file in the `dsk-docker` role consists of two primary tasks:

 1. **Install Docker**: This task uses the `community.general.pacman` module to install `docker` and `docker-compose` on the system. It ensures that these packages are present on the PC.

@@ -39,7 +39,7 @@ Clone, set up the workstation, and deploy Workstation Docker onto the local stac
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-docker full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-docker full_cycle=false
 ```

 ### Production
@@ -53,7 +53,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-docker
+APP=dsk-docker
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -82,7 +82,7 @@ The playbook is designed for developers who require Docker in their local develo
 To run this playbook:

 1. Clone the `infinito` repository.
-2. Navigate to the `roles/desk-docker` directory.
+2. Navigate to the `roles/dsk-docker` directory.
 3. Run the playbook using the appropriate Ansible commands, ensuring that you have the necessary privileges.

 ## Important Notes
@@ -0,0 +1,2 @@
+---
+application_id: dsk-docker
@@ -18,7 +18,7 @@ The diagram places Dotlinker in the Infinito.Nexus cosmos: the components it dep

 ```mermaid
 flowchart LR
-    subgraph role [desk-dotlinker 💻]
+    subgraph role [dsk-dotlinker 💻]
        svc_dotlinker["dotlinker"]
    end
 ```
@@ -39,7 +39,7 @@ Clone, set up the workstation, and deploy Dotlinker onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-dotlinker full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-dotlinker full_cycle=false
 ```

 ### Production
@@ -53,7 +53,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-dotlinker
+APP=dsk-dotlinker
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"
@@ -1,6 +1,6 @@
 ---
 # Install ONCE per play/host, but allow apply multiple times with different mappings
 - include_tasks: 01_install.yml
-  when: run_once_desk_dotlinker is not defined
+  when: run_once_dsk_dotlinker is not defined

 - include_tasks: 02_apply.yml
@@ -0,0 +1,2 @@
+---
+application_id: dsk-dotlinker
@@ -14,7 +14,7 @@ The diagram places Firefox in the Infinito.Nexus cosmos: the components it deplo

 ```mermaid
 flowchart LR
-    subgraph role [desk-firefox 💻]
+    subgraph role [dsk-firefox 💻]
        svc_firefox["firefox"]
    end
 ```
@@ -42,7 +42,7 @@ Clone, set up the workstation, and deploy Firefox onto the local stack:
 git clone https://github.com/infinito-nexus/core.git
 cd core
 make onboard
-make compose-deploy mode=reinstall apps=desk-firefox full_cycle=false
+make compose-deploy mode=reinstall apps=dsk-firefox full_cycle=false
 ```

 ### Production
@@ -56,7 +56,7 @@ bash scripts/install/package.sh
 make install
 source scripts/meta/env/load.sh

-APP=desk-firefox
+APP=dsk-firefox
 DOMAIN=<your-domain>
 TLS_MODE=self_signed
 SSH_PUBLIC_KEY="<your-ssh-public-key>"