Identity profiles

Keep git, ssh, commit signing, and gh naming the same person in any given directory — one identity per tree, applied automatically. The model is derive, don't repeat: a tree (~/work/) is the single declaration, and every other surface is configured once to follow it. Move a repo into the tree → it gets the whole identity.

The golden rule is verification-first: prove coordination by resolving every surface from inside a real repo in that tree and confirming they agree — never by reading the config files and assuming they compose.

Route to a workflow

No workflow named? (a bare /identity-profiles) — triage first: run scripts/profile_audit.py:

• profiles (none…) → setup (nothing is declared yet).
• any 🔴 gap → repair.
• only 🟡 gaps → offer optimize.
• no gaps → report it and stop.

The four surfaces, and who owns each

The scripts (call these, don't re-derive them)

Read-only inspectors in scripts/. The mutation is editing gitconfig includes and ~/.ssh/config; these are the audit and proof around it.

Core principles

1. The tree is the declaration. One includeIf "gitdir:" rule per profile; everything else derives from it. Never set identity per-repo — that's the state this skill exists to remove.
2. A profile is only real if every surface agrees. The right email with the wrong key is not a working profile; it is a push that authenticates as someone else. profile_audit.py checks the join, which is the one thing neither git-setup nor ssh-config can see alone.
3. Distinct keys need distinct pairings. A second identity with its own signing key needs its own allowed_signers line, or its commits sign and show Unverified. This is the single most common failure and it is silent.
4. ssh aliases, not hostnames. Per-tree key selection only works when remotes point at a Host alias (git@github-work:…); an https remote bypasses key selection entirely.
5. Prove it from inside the tree. includeIf "gitdir:" only applies inside a real repo, so a check run anywhere else is measuring the wrong thing. Both scripts probe from a repo in the tree and say undetermined when they can't find one.

Settings

Read ~/.config/devenv/config.toml; if an [identity-profiles] section exists, use it as defaults (precedence: explicit > config > ask). Managed by the devenv skill. Keys honored:

• default — the profile that applies outside any declared tree (e.g. personal).
• probe_remote — true to include the network probe in verification (default false).

The declarations themselves live in git's own config, not here: git config --global --get-regexp '^includeif\.' is the source of truth, which is why profile_audit.py discovers profiles instead of being told about them.

Boundaries with the other skills

• git-setup owns global git config, signing setup, and git_identity.py (which include file won, for the git surface alone). This skill owns the cross-surface join. For a git-only question, use git-setup directly.
• ssh-config owns key generation, permissions, passphrases, and the agent. This skill never creates or inspects a private key — it only compares the paths ssh reports.
• dotfiles tracks the resulting files (~/.gitconfig, ~/.config/git/*.gitconfig, ~/.ssh/config) so profiles are reproducible on the next machine.

Safety

• Back up ~/.gitconfig and ~/.ssh/config (timestamped copy) before editing either.
• Confirm before changing a global identity. Changing user.email globally silently re-attributes every future commit outside a declared tree.
• Never write a private key path into a tracked file beyond ~/.ssh/config, and never move key material between machines through this skill — that's ssh-config's keys workflow, out of band.
• --probe-remote makes a network call to a git host. It is opt-in, never part of the default audit, and it authenticates as you — don't run it against a host the user hasn't already used.