Declarative macOS defaults with drift detection

.editorconfig

@@ -17,10 +17,14 @@ indent_size = 4
 [{Makefile,.gitmodules}]
 indent_style = tab
 
-[.macos]
+[scripts/macos-bootstrap.sh]
 # Shell continuations in this inherited macOS settings script use tabs.
 indent_style = tab
 
+[macos-defaults]
+# Columns are tab-separated data, not indentation.
+indent_style = unset
+
 [*.md]
 # Markdown indentation and trailing spaces are structural.
 indent_style = unset

CLAUDE.md

@@ -12,13 +12,15 @@ This repo is also consumed downstream by the user's agentic alter-ego, @nonreage
 
 - `make test` — full suite: `test/test_deploy.sh` + `test/test_shell.sh`. Run either script directly for one suite; both sandbox a throwaway `$HOME` under mktemp and never touch the real one.
 - `./deploy.sh apply|audit [--dry-run]` — manifest-driven symlink deploy/verify. `make deploy` = apply plus re-asserting the skip-worktree flag (see Gotchas).
+- `./scripts/macos-defaults.sh doctor|check|audit|apply|accept [--dry-run] [domain [key]]` — the `macos-defaults` table. **`make macos-doctor` first on any new Mac**: this tooling needs Full Disk Access granted to your terminal, or Safari's and Mail's rows cannot be read and silently skip. `make macos-audit` reports drift and needs no sudo; `make macos-apply` writes; `make macos-accept` rewrites rows to match the machine. `make macos` = doctor, then apply, then the imperative remainder in `scripts/macos-bootstrap.sh`, then a restart.
 - `make check-symlinks` — fail on any dangling tracked symlink; `make check-skills` — same, scoped to `home/.agents/skills` (safe in CI); `make check-copilot-instructions` — self-heals the per-file mirror of rules into `home/.copilot/instructions/` (run after renaming anything in `home/.agents/rules/`); `make check-skill-frontmatter` — needs PyYAML; `make check-editorconfig` — needs `editorconfig-checker`.
 - `make preflight` — the one definition of "safe to commit": `test`, every `check-*` target, and the offline eval checks (`eval-validate`, `eval-test`; Node ≥ 24, whose npm 11 wrote the lockfile). CI runs this same target (plus a deploy apply+audit against a temp `$HOME`, kept separate since it exercises the deploy mechanism rather than checking committed content), on macOS and ubuntu — a new `check-*` target is picked up by both without a second edit to `ci.yml`.
 - `make eval SKILL=<name>` — full keyed run of one skill's `evals.json` through promptfoo, gated by `evals/bin/check-gate.mjs`; spends subscription usage. `make eval-compare SKILL=<name>` runs skill vs baseline side by side. Unset `ANTHROPIC_API_KEY` first, or `claude -p` bills the API instead.
 
 ## Architecture
 
 - **`manifest` + `deploy.sh`** — three whitespace columns: source, target, optional condition (`os=Darwin|Linux`, `host=<name>`, `tool=<name>`). deploy.sh is symlink-only by design: apply is `ln -s`, audit is a readlink comparison. Do not add copy/concat/generate behavior to it — that is a parked decision recorded in `docs/superpowers/specs/2026-07-06-manifest-deploy-spike-design.md`.
+- **`macos-defaults` + `scripts/macos-defaults.sh`** — tab-delimited (keys contain spaces, so this one is not whitespace-columned like `manifest`): domain, key, type, value, optional status. `apply` writes every row; `audit` skips a `noaudit=complex` row always (a container value has no comparable scalar form) and skips a `noaudit=tcc` or `noaudit=unset` row only when it will not read. Those two markers record *why* a row might be unreadable, not a decision to ignore it: TCC visibility depends on whether the terminal has Full Disk Access, and an unset key appears once its app first writes preferences. **Grant Full Disk Access to your terminal** (`make macos-doctor` checks) or 39 Safari and Mail rows skip instead of being audited. `scripts/macos-bootstrap.sh` keeps only what has no domain/key/value shape. Design and probe numbers: `docs/superpowers/specs/2026-08-25-macos-defaults-declarative-design.md`.
 - **`home/.agents` is the source of truth for agent config** (rules + skills), shared across harnesses through symlink shims: `~/.claude/rules` and `~/.claude/skills` point into it, as does `home/.gemini/antigravity-cli/skills`. `home/.copilot/instructions/*.instructions.md` are per-file symlinks mirroring `home/.agents/rules/*.md` — a rename in rules dangles them silently, which is exactly what `check-copilot-instructions` and `check-skills` guard. Design and parked decisions: `docs/superpowers/specs/2026-07-16-agents-source-of-truth-design.md`.
 - **Many skills are vendored, not local.** `home/.agents/ext/mattpocock-skills` is a git submodule; most entries in `home/.agents/skills/` are symlinks into it. Only the real directories there (e.g. `issue-sweep`, `ux-review`, `find-inspiration`, `prose-register`) are editable in this repo.
 - **OS/host branching is by filename**: `.Darwin`/`.Linux` suffixes, `.bashrc.<hostname>`, `bin.Darwin` → `~/bin`. Shell is bash-first (Homebrew bash via `chsh`); zsh files exist but are secondary. Shell chain per window: `.bash_profile` → `.bashrc` → `.bashrc.<platform>` → `.bashrc.<host>`.

Makefile

@@ -11,8 +11,23 @@ brew-bundle:
 	/opt/homebrew/bin/brew shellenv > /tmp/brew-shell.env
 	source /tmp/brew-shell.env && which brew && brew update && brew bundle
 
-macos:
-	sh .macos
+macos-doctor:
+	@./scripts/macos-defaults.sh doctor
+
+macos-audit:
+	@./scripts/macos-defaults.sh audit
+
+macos-apply:
+	./scripts/macos-defaults.sh apply
+
+macos-accept:
+	./scripts/macos-defaults.sh accept
+
+check-macos-defaults:
+	@./scripts/macos-defaults.sh check
+
+macos: macos-doctor macos-apply
+	./scripts/macos-bootstrap.sh
 	osascript -e 'tell app "loginwindow" to «event aevtrrst»'
 
 macos-reset-dock:
@@ -67,6 +82,7 @@ test:
 	./test/test_shell.sh
 	./test/test_clipboard_bridge.sh
 	./test/test_tmux.sh
+	./test/test_macos_defaults.sh
 
 deploy:
 	./deploy.sh apply
@@ -129,7 +145,7 @@ check-copilot-instructions:
 
 # The one definition of "safe to commit" -- CI runs this same target, so a
 # new check-* target is covered by both the moment it's added here.
-preflight: test check-symlinks check-skills check-skill-frontmatter check-editorconfig check-copilot-instructions eval-validate eval-test
+preflight: test check-symlinks check-skills check-skill-frontmatter check-editorconfig check-copilot-instructions check-macos-defaults eval-validate eval-test
 
 # Skill eval suite (evals/). eval-validate and eval-test are offline and free,
 # and run in preflight. eval and eval-compare spend subscription usage: a
@@ -199,4 +215,4 @@ init-submodules:
 	git submodule update --init --recursive
 
 # grep '^\w' Makefile | sed 's/:.*//g' | tr '\n' ' ' | pbcopy
-.PHONY: default macos-setup init-post-reboot brew-install brew-bundle macos-reset-dock macos check-symlinks check-skills check-skill-frontmatter check-editorconfig check-copilot-instructions preflight test deploy eval-validate eval-test eval eval-compare clipboard-bridge link-karabiner link-sublime backup-preferences restore-preferences disable-restore-apps-on-login set-file-associations
+.PHONY: default macos-setup init-post-reboot brew-install brew-bundle macos-reset-dock macos macos-doctor macos-audit macos-apply macos-accept check-macos-defaults check-symlinks check-skills check-skill-frontmatter check-editorconfig check-copilot-instructions preflight test deploy eval-validate eval-test eval eval-compare clipboard-bridge link-karabiner link-sublime backup-preferences restore-preferences disable-restore-apps-on-login set-file-associations