Planning Sovereign Workstation Migration
# Sovereign Workstation — Migration Spec
Wipe Windows off the Alienware. Install single-boot Ubuntu LTS. Migrate a decade of development across without loss. Hand the agent real authority across workstation, remote servers, GitHub, and phone.
Two operators: **🤖 agent** (machine-side work) and **👤 you** (physical actions and irreversible decisions). **⚠️ = irreversible.** Format does not happen until Phase 1 is complete, copied off-disk twice, and verified against a manifest.
The machine holds **two environments — Windows and WSL2**. Both are destroyed by the format. Every phase sweeps both.
---
## Phase 0 — Software audit (before anything is wiped)
Goal: no installed tool is discovered missing after the wipe. The agent finds everything; you decide what carries across.
- 🤖 Enumerate all installed software across **both Windows and WSL2**. Produce `app-inventory.md`.
- 🤖 For each program, flag one of: native Linux build available / Flatpak / Snap / Linux-native equivalent / runs under Wine / no Linux option.
- 🤖 For each, note license/reinstall implications (e.g. perpetual license reinstallable as-is, subscription, or config to preserve).
- 🤖 Present the list to you. Do not assume; flag for decision.
- 👤 Go through the flagged list and decide per program: carry across, replace, or drop.
- 🤖 For every "carry across" item: stage its installer, license/config, and any settings export into the backup folder (Phase 1) so it survives the wipe.
Output of Phase 0: a decided list — every installed program has a resolution (reinstall / replace / drop) and everything needed to reinstall is staged for backup.
---
## Phase 1 — Capture (must be complete before any format)
Sweep **both Windows and WSL2**. Collect everything that dies on format and lives in no repo.
### Staging folder
- 🤖 Create one staging folder (`~/migration-backup/`). Structure:
```
migration-backup/
ssh-keys/ # both environments
gpg-keys/
env-files/ # every .env, both environments, all repos
nginx/ # config files
supervisor/ # local supervisor configs
dotfiles/ # shell configs, git config, aliases
installers/ # from Phase 0: installers, license/config, settings exports
db-dumps/ # local Postgres not already on remote
browser/ # bookmarks, saved passwords, 2FA/authenticator seeds
app-inventory.md # from Phase 0
repos-status.md
MANIFEST.md # checklist of everything captured
```
### Collect (across both environments)
- 🤖 **SSH keys** — WSL2 `~/.ssh/` and Windows `.ssh/`, PuTTY `.ppk`, Pageant. Private + public keys, `config`, `known_hosts`.
- 🤖 **GPG keys** — export secret + public from both.
- 🤖 **All `.env` / secrets files** — sweep every repo in both environments.
- 🤖 **nginx configs** — sites-available/enabled and custom conf.
- 🤖 **Supervisor configs** — local ones. Sweep **`/home/rswfire/.local/`** specifically, plus standard locations.
- 🤖 **Dotfiles** — `.bashrc`, `.zshrc`, `.profile`, `.gitconfig`, aliases, custom shell setup.
- 🤖 **Local databases** — `pg_dump` any Postgres not already on remote into `db-dumps/`.
- 🤖 **Phase 0 installers/licenses/config** — staged into `installers/`.
- 🤖 **Browser data** — bookmarks, saved passwords, and 2FA/authenticator seeds/backup codes.
- 🤖 **User files** — list Documents / Desktop / Downloads contents; you flag what to keep.
### Git repos
- 🤖 Enumerate every repo across both environments. For each, report in `repos-status.md`: branch, uncommitted changes, unpushed commits, untracked files.
- 🤖 Commit every dirty tree to a `wip/pre-migration` branch and push.
- 🤖 Flag the **Autonomy Realms tree (~10k uncommitted lines)** explicitly — branch and push first.
- 🤖 Confirm every repo fully pushed to GitHub.
### Off-disk, twice
- 🤖 Write `MANIFEST.md` — a checklist of every captured item.
- 👤 Copy `migration-backup/` to the **external drive**.
- 👤 Copy `migration-backup/` to a **second location** (encrypted remote path or second drive).
- 👤 Spot-check both copies against `MANIFEST.md`: SSH private keys present, Autonomy `.env` present, installers open, DB dumps present.
**✅ Gate:** manifest fully satisfied and external copy verified readable. Nothing past here is reversible.
---
## Phase 2 — Install media
- 🤖 Provide current Ubuntu LTS ISO link + checksum + USB-write steps.
- 🤖 Instruct: **"Burn the Ubuntu USB now."**
- 👤 Burn the Ubuntu USB.
- 👤 Boot it **live** on the Alienware — do not install. Confirm WiFi, keyboard, trackpad, external display, internal drive all work while Windows is still intact.
- 👤 Keep a **Windows recovery USB** on hand.
**✅ Gate:** live boot clean on this hardware; recovery option in hand.
---
## Phase 3 — Format + install ⚠️
- 👤 Wipe the **entire disk** — delete all existing partitions, including Dell OEM/recovery, Windows recovery, EFI, and any factory restore partitions. No Dell/Windows artifacts remain. Use "erase disk" / manual partitioning to remove every existing partition, not an install-alongside option.
- 👤 Install **Ubuntu LTS** on the now-empty disk with:
- **LUKS full-disk encryption** (checkbox at install; not addable later).
- **Btrfs** filesystem for snapshots.
- A fresh GPT partition table with only Ubuntu's own EFI + root (+ swap) partitions.
**⚠️ Point of no return. Only proceed after both gates above are green.**
---
## Phase 4 — Rebuild
- 👤 Copy `migration-backup/` from external drive onto the new machine.
- 🤖 System update; install `git`, `curl`, build tools, `openssh-client`, `ufw` (firewall on), editor.
- 🤖 Restore SSH keys to `~/.ssh/` (correct permissions), import GPG keys, place dotfiles, return `.env` files to their repos.
- 🤖 Install **JetBrains Toolbox**; install owned versions of the flagged JetBrains products; restore IDE settings.
- 🤖 Install everything else marked "carry across" in Phase 0.
- 🤖 Install runtime stack: Node via `nvm`, PHP (required version), Postgres client, Docker if used, **Claude Code CLI**.
- 🤖 Reclone repos from GitHub.
- 🤖 Rebuild nginx + supervisor configs adapted to native Linux paths; recreate `~/.local/` layout.
- 🤖 Restore local databases from `db-dumps/`.
- 🤖 Configure snapshots (Timeshift or snapper) **before** any agent autonomy is enabled.
- 👤 **Sanity gate:** run the full loop by hand — clone, edit, run a project locally, SSH to a remote server, push to GitHub, open a project in the restored IDE.
---
## Phase 5 — Agent authority (guardrails before autonomy)
- 🤖/👤 Configure Claude Code for elevated autonomy on routine work.
- 🤖 Branch discipline: agent works on branches, never `main`.
- 🤖 Snapshot before large autonomous runs.
- 🤖 Scoped credentials: GitHub fine-grained token limited to repos in play; server access as app user, not root, where possible.
- 🤖 Destructive verbs gated: delete, force-push, production DB, destructive infra require explicit confirmation even in autonomous mode.
- 🤖 Audit trail: command history, git history, session transcript.
---
## Phase 6 — Remote control (phone)
- 🤖 Confirm Claude Code CLI version supports Remote Control + push notifications; confirm the coding account's plan has it.
- 🤖/👤 Run `claude remote-control` on the workstation (or enable auto-connect in `/config`). Session surfaces in the Claude app; execution stays local; outbound connection, survives sleep/network drop, reconnects.
- 👤 Phone app → **coding account**. Assistant-chat → browser/desktop on the **chat account**. No account-switching on the phone.
- 👤 (Optional) raw shell from phone for non-Claude work: `tmux` + `mosh` + Tailscale.
- 👤 Run one real task end-to-end from the phone to prove it.
---
## Phase 7 — Close out
- 👤 After a week of stable Ubuntu, retire the Windows recovery USB.
---
## Build-time confirmations (verify live, don't assume)
- Current Ubuntu **LTS version**; Btrfs snapshot tool (Timeshift vs snapper) for that release.
- Minimum **Claude Code CLI** version for Remote Control + push; coding account plan has it enabled.
- Native-Linux availability for each Phase 0 "carry across" program.
- If using the optional shell path: current Tailscale + mosh setup for Ubuntu.