Quartz 5

laptop-tci-hardening-plan

2 min read

Implementation Plan: Laptop TCI Hardening & Quota Alignment

Status: 🚀 READY FOR EXECUTION Author: Lead Architect

🎯 Objective

Align the Laptop Client (book) with the physical Desktop Box (box) environment standards. We will purge all hardcoded plaintext keys, delete legacy configuration clutter, and verify that the local agy instance dynamically authenticates via 1Password—completely resolving the local quota limit issue.

🏗️ Architecture Mapping

The Laptop must be hardened to match the following directory states:

~/.gemini/
├── gemini-credentials.json  <-- (762B, Bootstrapped securely from 1Password)
├── mcp-wrapper.sh           <-- (Nix Symlink, Dynamic 1Password injector)
└── [No Plaintext Secrets or Legacy Backups]

~/.antigravity-ide/
└── [Nix Managed extensions and settings.json symlinks]

🛠️ Step-by-Step Execution Plan

Step 1: Pull and Align Declarative Configs

Run sync-all to pull the latest Nix declarative configurations (shell.nix, home.nix) and helpers (bootstrap-credentials.sh, waycup.env):

sync-all

Step 2: Purge Redundant/Loose Configuration Files

Remove legacy, hardcoded plaintext files that cause variable leaks and conflict with Nix:

# Delete plaintext keys and old env files
rm -f ~/.gemini/.env
rm -f ~/dotfiles/secrets/.op_service_account
rm -f ~/dotfiles/antigravity/.env
rm -f ~/dotfiles/antigravity/gemini.env
rm -f ~/dotfiles/gemini/gemini.env
 
# Delete old backup clutter
rm -rf ~/.gemini/tci_report_latest.md ~/.gemini/test_write.txt ~/.gemini/clasp_backup ~/.gemini/exa-mcp-server_backup

Step 3: Bootstrap Google Credentials

Retrieve your Google OAuth credentials dynamically into your clean local directory:

# Ensure the bootstrapper pulls the secure document directly from 1Password
~/dotfiles/bin/bootstrap-credentials.sh

Step 4: Clear Session Memory and Reload

Unset the old cached environment variables and load the new 1Password-driven aliases:

# Clear memory cache
unset GEMINI_API_KEY OP_SERVICE_ACCOUNT_TOKEN
 
# Reload shell configuration
reload

Step 5: The Quota Test

Launch the interactive CLI on the Laptop to confirm that the quota error is completely resolved:

agy

📜 CTO Certification & Validation Checklist

  • Terminal loads instantly (no blocking startup network queries).
  • printenv | grep GEMINI returns empty (secrets are not in plaintext memory).
  • ls -la ~/.gemini/mcp-wrapper.sh points to the Nix store.
  • agy launches successfully with no quota or licensing warnings.

Graph View