Move standalone repository docs from the root into docs/ and add a documentation index that links the moved docs and the code-local runbooks.
Update Markdown links, source comments, and the root entry points to the new locations. Keep README.md and AGENTS.md at the root as required entry points.
Assisted-by: DeepSeek Harness (deepseek-flash)
* feat(nixpak): sandbox six desktop apps
* chore(nixpak): trim OBS plugin set
* fix(nixpak): enable OBS on aarch64
* fix(nixpak): let imv read the full home directory
* fix(home): drop redundant freerdp package
* fix(nixpak): grant OBS access to V4L2 camera devices
* fix(nixpak): expose V4L2 sysfs to OBS
* fix(nixpak): expose NVIDIA encode library to OBS
* docs(nixpak): record OBS interactive validation
* docs(nixpak): record OBS RTMP validation
* fix(nixpak): run MuseScore via XWayland and PulseAudio
* docs(nixpak): explain app sandboxing rationale
* fix(nixpak): route MuseScore ALSA through PipeWire
* refactor(nixpak): split policy checks into per-app suites
Make hardening/tests/policy.nix a small loader that auto-discovers one suite per app under hardening/tests/policy. Shared checks live in policy-lib.nix and common expectations are generated by mkAppPolicy; app files only declare differences and special cases. The loader also discovers wrappers from hardening/nixpaks and fails when wrapper/suite inventory or check names diverge.
Assisted-by: DeepSeek Harness (deepseek-flash)
* fix(nixpak): reject duplicate per-app policy checks
mkAppPolicy merges generated and custom checks, so an extraChecks key could silently override a standard assertion. Fail explicitly when a per-app check name is defined twice.
Assisted-by: DeepSeek Harness (deepseek-flash)
Merge the three runtime-validation files into one concise record, update the interactive browser and Zoom results, and document the intentional Chromium host-loopback and Brave/Edge no-media exceptions. Tighten the remaining cookie-crypto workaround and the smoke-test prerequisites.
Assisted-by: DeepSeek Harness (deepseek-flash)
Switch to the native deb package from nixpkgs-patched (#560225), remove the AppImage/FHS bwrap layer, and enable native Wayland while keeping the X11 fallback.
Keep only WeChat state under one app-scoped HOME and bind the host Documents and Downloads directories like the other desktop apps. User-selected files also go through the XDG FileChooser portal. Remove the launcher, activation script, and compatibility symlinks.
Assisted-by: DeepSeek Harness (deepseek-flash)
* refactor(nixpak): unify desktop app sandboxes
Move common GUI, portal, and network policy into reusable modules and migrate browsers plus Zoom/WeChat/QQ/Telegram to the same boundary.
Assisted-by: DeepSeek Harness (deepseek-flash)
Ryan Yin
ryan4yin | 二花