Tool ownership matrix

This matrix records which layer owns each class of tool, package, extension, theme asset, and future desktop mutation. It is not a generated inventory and does not resolve future CachyOS package or AUR names.

Owner vocabulary

Owner	Boundary
mise	Versioned developer runtimes, portable CLIs, and quality tools.
apt	WSL and droplet OS packages, platform prerequisites, and distro-owned integration.
pacman	CachyOS or Arch-family official packages, libraries, and desktop/runtime dependencies.
aur	CachyOS AUR packages only after current package-name and source verification.
scoop	Native Windows command-line tools and bootstrap utilities listed in windows/tools.json.
winget	Native Windows GUI applications and official Windows installers listed in windows/tools.json.
direct	User-local upstream asset installs or direct-download exceptions with a narrow documented reason.
editor	Editor extension/package managers such as Zed and VS Code.
manual	Human-owned state that the repo documents but does not install or mutate automatically.
repo-script	Repo-maintained helper commands, renderers, sync commands, and future explicit desktop apply commands.

Matrix

Tool or asset	Lane	Owner	Install path	Upgrade path	Apply behavior	Validation	Notes
Versioned runtimes and portable developer CLIs	shared	mise	Mise-managed data directory and shims on PATH	Mise maintenance policy and just upgrade where that lane supports it	Install makes binaries available; project-local tool versions still win	just mise-policy-check, just check	Covers Node, pnpm, Python, uv, Rust, quality CLIs, agent CLIs, and portable workstation CLIs. Droplet normal upgrade does not run this broad shared inventory.
Repo quality and documentation CLIs	shared	mise	Mise-managed package installs and shims	Mise maintenance policy	No user config mutation beyond tool availability	just check, just docs-check, focused validator scripts	Keeps validation tooling out of OS package managers unless the OS must own it.
WSL platform prerequisites	wsl	apt	Distro package database and system paths	WSL prerequisite and upgrade scripts	Install-only unless the specific package owns system integration	Source-only smoke checks and lane validation	Use for distro packages, GitHub CLI apt setup, and platform libraries.
Droplet platform prerequisites	droplet	apt	Distro package database and system paths	scripts/upgrade.sh droplet path and scripts/install-prereqs-droplet.sh --core	Install-only; leaves login shell unchanged and does not install GUI assets	Source-only smoke checks, droplet render assertions, and dry-run bootstrap preview	Uses official GitHub CLI, mise, and Ubuntu Fish 4 apt sources where applicable. Normal upgrade runs apt update/upgrade plus core bootstrap only.
Droplet agent/SSH toolset	droplet	mise	Apt-managed /usr/bin/mise installs into the user's mise data and shims	Explicit scripts/install-prereqs-droplet.sh --codex-tools only, preferably after --dry-run --codex-tools	Installs only the named droplet agent/SSH toolset under timeout, lock, one-tool-at-a-time, and process-summary guards	Source-only static checks and guarded dry-run preview	Normal droplet upgrade prints this command but never runs it automatically. It must not call broad mise install, mise upgrade, mise prune, or mise reshim.
CachyOS platform and official desktop/runtime packages	cachyos	pacman	System package database and system paths	CachyOS prerequisite and upgrade scripts	Install-only unless a future explicit desktop command applies user config	Source-only smoke checks now; CachyOS host checks later	Use for official packages, system libraries, and desktop engine/runtime dependencies after verification.
CachyOS AUR-only package candidates	cachyos	aur	System package database and package-owned paths	Future explicit installer after package-name and source verification	Install-only; must not apply Plasma, KWin, Kvantum, GTK, panel, or SDDM settings by itself	Future CachyOS dry-run/status validation	Do not resolve or document current AUR package names in this phase.
Windows CLI/bootstrap tools	windows	scoop	Scoop apps, shims, and bucket state declared in windows/tools.json	Windows upgrade script and Scoop update path	Install makes binaries available; no profile startup installs	just windows-tool-inventory-check, Windows smoke validation	micro is a core terminal-editor fallback in this layer.
Windows GUI applications	windows	winget	Per-app Windows install locations	Windows upgrade script and winget path	Install application only; app settings remain separately managed or manual	just windows-tool-inventory-check, Windows smoke validation	Use official IDs where the GUI app is the platform owner, such as Zed during GUI bootstrap.
Windows direct-download exceptions	windows	direct	Exception-specific install path recorded in windows/tools.json	Windows upgrade script or documented manual refresh	Install-only unless the exception explicitly documents otherwise	just windows-tool-inventory-check	Keep exceptions narrow; prefer Scoop or winget when either is a stable owner.
Windows manual tools or settings	windows	manual	Human-managed location	Human action, documented in the tool inventory or workflow docs	Repo documents expectations but does not install or mutate	Inventory validation plus manual confirmation	Use when automation would be brittle, privileged, or outside repo scope.
Zed extensions and VS Code extensions	shared	editor	Editor-managed extension directories	Editor extension manager	Editor installs extensions; repo manages settings, keymaps, tasks, and extension manifests	Editor render validation and source-only smoke checks	Neovim has no managed plugin layer in this repo.
Fish plugins	shared	repo-script	Managed fish_plugins file and Fisher-managed plugin install state	dotfiles-sync-fish-plugins	Explicit sync only; shell startup must not install plugins	Source-only smoke checks and shell tests	Starship owns the prompt; Fisher remains a small plugin manager.
Repo helper commands	shared	repo-script	Rendered from home/dot_local/bin/ to ~/.local/bin	Chezmoi render/apply and repo maintenance	Behavior depends on the command; helper scripts must declare host boundaries	Source-only smoke checks and focused tests	Host-only helpers belong behind templates or .chezmoiignore.
Terminal, editor, and CLI Catppuccin theme data	shared	repo-script	Rendered from home/.chezmoidata/theme.toml into terminal, editor, Yazi, bat, delta, vivid, Starship, and related config	Edit repo theme data, render, and apply with chezmoi	Normal chezmoi apply updates tracked config; CachyOS KDE ricing must not overwrite this layer	Docs build, source-only smoke checks, terminal/editor render checks	Existing Catppuccin theme ownership is unchanged by CachyOS desktop ricing.
Terminal profile color-scheme assets	shared	repo-script	Rendered terminal config and checked-in terminal color files	Repo edits and render helpers	Chezmoi apply updates terminal config; no KDE desktop mutation	Terminal render checks and source-only smoke checks	Konsole and Ghostty remain terminal-owned, not Plasma global theme state.
CachyOS Breeze safety reference	cachyos	repo-script	User state under ~/.local/state/dotfiles/kde-reference	dotfiles-cachyos-theme capture-breeze-reference after a manual Breeze restore	Captures reference snapshots only; does not mutate live KDE settings	diff-breeze-reference, source-only desktop checks, manual desktop review after capture	This is the active KDE safety baseline. It captures only user-level KDE/KWin/Plasma/Kvantum/GTK/KSplash config in the backup model.
CachyOS Breeze user appearance reset	cachyos	repo-script	User config under ~/.config	dotfiles-cachyos-theme reset-breeze and restore-backup	Explicit reset only after backup; not from chezmoi apply, just upgrade, or asset install	Source-only desktop checks, status/plan output, backup validation, diff-breeze-reference, and manual GUI review	Resets Breeze Dark KDE/GTK/icon/cursor/KWin state with stable commands and selected key writes. Wallpaper, fonts, scaling, Flatpak, SDDM, and boot splash stay out of scope.
CachyOS Breeze panel reference restore	cachyos	repo-script	Plasma shell config such as plasma-org.kde.plasma.desktop-appletsrc and plasmashellrc	dotfiles-cachyos-theme reset-breeze --from-reference latest --reset-panels and restore-backup	Separate explicit panel restore only after backup	Source-only desktop checks plus manual KDE session validation	Restores captured Breeze reference panel files. It does not synthesize panels, use Latte Dock, or apply MacTahoe/macOS-like layout.
CachyOS theme engine dependencies	cachyos	pacman	System package database and package-owned runtime paths	Deferred MacTahoe/WhiteSur install-assets path verifies or installs kvantum and kvantum-qt5 only when those families are explicitly selected	Install-only; desktop appearance does not change until an explicit apply command runs	Theme status, install-assets dry-run, source-only desktop checks	Breeze uses system KDE assets and does not require user-local asset installation.
CachyOS user-local MacTahoe and WhiteSur assets	cachyos	direct	User-local theme paths such as ~/.local/share, ~/.local/share/plasma/layout-templates, ~/.themes, ~/.local/share/icons, and ~/.config/Kvantum	Deferred `dotfiles-cachyos-theme install-assets --theme mactahoe	whitesur	all` clones upstream Git and copies/extracts assets	Installs or refreshes assets only; does not select or apply them
CachyOS verified theme asset packages	cachyos	aur	Package-managed theme asset paths or user-local package output, depending on verified package behavior	Possible future explicit installer if AUR packages become the better owner	Install-only; must not select global theme, panel layout, or SDDM	Future dry-run/status validation	AUR theme packages are not part of the active Breeze baseline.
CachyOS Better Blur and rounded-corner KWin effects	cachyos	manual	User-selected KWin effect packages and effect settings	Manual installation/configuration only in this phase	Not installed or enabled by repo commands	audit-upstream reports current recommendation and verified AUR package names	Upstream recommends Better Blur/force blur and rounded corners; this repo keeps effects out of normal theme/layout mutation for now.
CachyOS Flatpak GTK theme overrides	cachyos	repo-script	User Flatpak override state	Future explicit Flatpak override command or docs-only procedure	Optional explicit override only	Future docs-first validation and manual app checks	Prefer documenting first; do not hide Flatpak mutation inside package refresh or theme apply.
CachyOS SDDM/login theming	cachyos	repo-script	Future verified SDDM config and theme paths, including possible root-owned locations	Future dotfiles-cachyos-theme plan-sddm, backup-sddm, apply-sddm, and rollback-sddm	Later privileged explicit phase only; fail with the exact required command when elevation is needed	Future privilege-gated validation, manual logout/login check, and TTY recovery test	No display-manager service, autologin, GPU, boot splash, GRUB, kernel, driver, or initramfs changes.

Theme asset boundaries

Asset class	Preferred owner	Boundary
Theme engine dependency	pacman first, aur only when verified	Package manager installs dependencies; it does not apply user-visible desktop state.
Breeze safety reference	repo-script	Capture and diff user-level KDE reference state under ~/.local/state/dotfiles/kde-reference; live settings are not changed by capture or diff.
Breeze user config writes	repo-script	Only explicit dotfiles-cachyos-theme reset-breeze, rollback, reference restore, or backup restore commands may mutate KDE, KWin, Kvantum, GTK, panel, or KSplash config after backup.
MacTahoe and WhiteSur theme assets	direct user-local install first, aur only when verified	Deferred asset installation may place files under user-local theme directories, including MacTahoe Plasma layout templates, but must not select or apply them.
Plasma/KDE config writes	repo-script	Active writes belong to Breeze reset/reference restore. Deferred apply-* paths must stay explicit and backed up. SDDM/login and boot splash remain separate.
Terminal/editor Catppuccin themes	repo-script and editor	Existing home/.chezmoidata/theme.toml and editor extension managers remain separate from KDE ricing.

Normal upgrade paths may install or refresh packages and assets, but they must not apply or re-apply desktop themes, panel layouts, Flatpak overrides, or SDDM/login themes. Droplet is narrower than the workstation lanes: normal upgrade may refresh apt packages and rerun the core bootstrap, but the droplet agent/SSH mise toolset stays behind the explicit --codex-tools command.