add tasks under method org-headers and sorted by priority

1 files changed, 160 insertions, 163 deletions

diff --git a/TODO.org b/TODO.org
index 30ed106..244f1d8 100644
--- a/TODO.org
+++ b/TODO.org
@@ -1,5 +1,5 @@
-#+TITLE: ArchSetup V2MOM - Strategic Framework
-#+AUTHOR: Craig Jennings & Claude
+#+TITLE: ArchSetup V2MOM
+#+AUTHOR: Craig Jennings
 #+DATE: 2025-11-06
 #+FILETAGS: :v2mom:strategy:archsetup:
 
@@ -35,7 +35,6 @@ With the environment fully configured:
 **The end state:**
 I can lose my laptop, borrow any computer, install Arch minimal, run archsetup, and within a few hours have my complete working environment back—a system that empowers me to get things done at the speed of thinking. Then I clone my git projects and resume work exactly where I left off.
 
-
 * Values
 
 ** Resilient
@@ -110,7 +109,6 @@ Every change is automatically tested, so I trust the script because it's proven
 - Discovering broken packages during emergency restore
 - Relying on manual memory of what to fix post-install
 
-
 * Methods
 
 ** Method 1: Achieve Fail-Proof Execution
@@ -121,149 +119,149 @@ The script handles edge cases gracefully, provides detailed error messages with
 
 *Why this is Method 1:* Can't build testing infrastructure or maintain packages if the script doesn't work. This is the foundation—everything else depends on reliable execution.
 
-** TODO [#A] Fix critical bug: typo in yay installation (archsetup:336)
+*** TODO [#A] Fix critical bug: typo in yay installation (archsetup:336)
 BLOCKS all AUR installs - script cannot install any AUR packages until this is fixed
 Line 336 has ~sudo -u "$username" -D "$build_dir"~ which is invalid - the -D flag doesn't exist for sudo in this context
 Should be ~cd "$build_dir" && sudo -u "$username"~ or similar
 
-** TODO [#A] Fix: no dotfiles were set up on last run
+*** TODO [#A] Fix: no dotfiles were set up on last run
 CRITICAL - system is unusable without dotfiles; all 50+ scripts and configs missing
 
-** TODO [#A] Add root check at script start
+*** TODO [#A] Add root check at script start
 Prevents running with wrong permissions that cause silent failures
 Script will fail if not run as root but doesn't check until first privileged command
 Add at top of script: ~[ "$EUID" -ne 0 ] && echo "Must run as root" && exit 1~
 
-** TODO [#A] Fix git pull --force data loss risk
+*** TODO [#A] Fix git pull --force data loss risk
 Could destroy user's uncommitted changes in repos during dotfile setup
 Using ~git pull --force origin master~ can destroy local modifications without warning (archsetup:128)
 Should use ~git pull~ or ~git fetch && git reset --hard origin/master~ with user confirmation
 
-** TODO [#B] Resolve all 8 failed packages from last run
-*** TODO [#B] adwaita-color-schemes (CMake compatibility issue)
+*** TODO [#A] Add pre-flight checks before installation starts
+Validate system requirements: disk space, network connectivity, Arch version, tool dependencies (curl, stow, git, make)
+
+*** TODO [#A] Implement state tracking for install progress
+Track what completed vs failed mid-run to enable targeted recovery and resume capability
+
+*** TODO [#A] Fix sleep/suspend on Framework Laptop
+Critical functionality for laptop use - current battery drain unacceptable
+Add kernel parameter: ~rtc_cmos.use_acpi_alarm=1~ (will become systemd default)
+Consider: ~acpi_mask_gpe=0x1A~ for battery drain, suspend-then-hibernate config
+See Framework community notes on logind.conf and sleep.conf settings
+
+*** TODO [#A] Disable installing -debug packages
+Currently archsetup downloads a -debug package for every package installed, doubling install time
+Add ~!debug~ to OPTIONS in /etc/makepkg.conf or create ~/.config/pacman/makepkg.conf with the setting
+Critical performance issue - cuts install time in half
+
+*** TODO [#B] Resolve all 8 failed packages from last run
+**** TODO [#B] adwaita-color-schemes (CMake compatibility issue)
 Error: "Compatibility with CMake < 3.5 has been removed" - qgnomeplatform build fails
-*** TODO [#B] geoclue (service doesn't exist)
+**** TODO [#B] geoclue (service doesn't exist)
 Failed to enable unit: Unit geoclue-agent@cjennings.service does not exist - check if service name is correct
-*** TODO [#B] tor-browser (PGP key import failure)
+**** TODO [#B] tor-browser (PGP key import failure)
 PGP key EF6E286DDA85EA2A4BA7DE684E2C6E8793298290 required but keyserver receive failed: No data
-*** TODO [#B] multimarkdown (CMake compatibility issue)
+**** TODO [#B] multimarkdown (CMake compatibility issue)
 Same CMake < 3.5 compatibility error as adwaita-color-schemes
-*** TODO [#B] vagrant (deprecated/not found in repos)
+**** TODO [#B] vagrant (deprecated/not found in repos)
 Error: target not found: vagrant - package no longer in official repos, may need AUR alternative
-*** TODO [#B] anki (missing .gitconfig during build)
+**** TODO [#B] anki (missing .gitconfig during build)
 Cargo build failed: "failed to stat '/home/cjennings/.gitconfig'" - .gitconfig doesn't exist yet during build
-*** TODO [#B] figlet-fonts (FTP download with curl error)
+**** TODO [#B] figlet-fonts (FTP download with curl error)
 curl: option --ftp-pasv: is unknown - FTP download from ftp://ftp.figlet.org fails
 
-** TODO [#B] Improve error handling: UFW firewall, rmmod pcspkr, mkdir missing quotes
-*** TODO [#B] Fix UFW firewall error handling (archsetup:395,410)
+*** TODO [#B] Improve error handling: UFW firewall, rmmod pcspkr, mkdir missing quotes
+**** TODO [#B] Fix UFW firewall error handling (archsetup:395,410)
 Firewall failures use ~|| error "error"~ which logs but continues - system may be left exposed
 Should use ~|| error "crash"~ or validate rules were applied successfully
-*** TODO [#B] Fix rmmod pcspkr error (archsetup:588)
+**** TODO [#B] Fix rmmod pcspkr error (archsetup:588)
 ~rmmod pcspkr~ doesn't check if module is loaded, produces error if already unloaded
 Should use ~rmmod pcspkr 2>/dev/null || true~ or check with ~lsmod~
-*** TODO [#B] Fix mkdir missing quotes (archsetup:247)
+**** TODO [#B] Fix mkdir missing quotes (archsetup:247)
 Line 247: ~mkdir -p $source_dir~ should be ~mkdir -p "$source_dir"~ - fails if path contains spaces
 
-** TODO [#B] Test complete end-to-end run on fresh VM
+*** TODO [#B] Test complete end-to-end run on fresh VM
 Validates the script actually works in a clean environment (blocks claiming Method 1 complete)
 
-** TODO [#C] Fix duplicate package installations (mediainfo, obsidian)
-Wastes time and could mask package issues
-
-** TODO [#C] Add backup before system file modifications
-Safety net for /etc/X11/xorg.conf.d and other system file edits
-Files like ~/etc/sudoers~, ~/etc/pacman.conf~, ~/etc/default/grub~ modified without backup
-If modifications fail or are incorrect, difficult to recover - should backup files to ~.backup~ before modifying
-
-** TODO [#A] Add pre-flight checks before installation starts
-Validate system requirements: disk space, network connectivity, Arch version, tool dependencies (curl, stow, git, make)
-
-** TODO [#A] Implement state tracking for install progress
-Track what completed vs failed mid-run to enable targeted recovery and resume capability
-
-** TODO [#B] Make all error messages actionable with recovery steps
+*** TODO [#B] Make all error messages actionable with recovery steps
 Currently just reports errors without guidance on how to fix them
 
-** TODO [#B] Improve progress indicators throughout install
+*** TODO [#B] Improve progress indicators throughout install
 Enhance existing indicators to show what's happening in real-time
 
-** TODO [#B] Check that full install logs have timestamps
+*** TODO [#B] Check that full install logs have timestamps
 Verify timestamps exist for debugging failures
 
-** TODO [#B] Add retry logic to git_install function
+*** TODO [#B] Add retry logic to git_install function
 pacman_install and aur_install have retry logic, but git_install doesn't
 
-** TODO [#C] Parse and improve AUR error reporting
-Parse yay errors and provide specific, actionable fixes instead of generic error messages
-
-** TODO [#B] Add input validation for username and paths
+*** TODO [#B] Add input validation for username and paths
 Variables like ~$username~, ~$source_dir~, and paths are not validated
 Special characters or malicious input could break the script or cause security issues
 Should validate inputs match expected patterns (alphanumeric, valid paths, etc.)
 
-** TODO [#A] Fix sleep/suspend on Framework Laptop
-Critical functionality for laptop use - current battery drain unacceptable
-Add kernel parameter: ~rtc_cmos.use_acpi_alarm=1~ (will become systemd default)
-Consider: ~acpi_mask_gpe=0x1A~ for battery drain, suspend-then-hibernate config
-See Framework community notes on logind.conf and sleep.conf settings
-
-** TODO [#B] Enable TLP power management for Framework Laptop
+*** TODO [#B] Enable TLP power management for Framework Laptop
 TLP manages power-saving modes for Wi-Fi, USB, PCIe, Bluetooth, CPU scheduler
 Install tlp, enable service, add custom Framework 13 config to /etc/tlp.d/01-custom.conf
 Improves battery life and prevents power-related issues during install/post-install
 
-** TODO [#B] Fix "at" error during install
+*** TODO [#B] Fix "at" error during install
 Package fails with yay - appears to be in extra repository, may need to change to AUR install or verify correct source
 
-** TODO [#A] Disable installing -debug packages
-Currently archsetup downloads a -debug package for every package installed, doubling install time
-Add ~!debug~ to OPTIONS in /etc/makepkg.conf or create ~/.config/pacman/makepkg.conf with the setting
-Critical performance issue - cuts install time in half
-
-** TODO [#B] Ensure locale is set properly
+*** TODO [#B] Ensure locale is set properly
 Errors during install: "setlocale: LC_ALL: cannot change locale (en_US.UTF-8): No such file or directory"
 Perl warnings about locale settings not supported/installed on system
 Need to properly configure locale generation and LC_* environment variables
 
-** TODO [#D] Add cpupower installation and enabling to archsetup
-cpupower service configures the default CPU scheduler (powersave or performance)
-Install cpupower, configure /etc/default/cpupower, enable service: ~systemctl enable --now cpupower.service~
-
-** TODO [#B] Add opus codec to archsetup
+*** TODO [#B] Add opus codec to archsetup
 All music is in opus format - system needs opus codec to play music files
 Install opus package to prevent audio playback issues
 
-** TODO [#B] Improve logging consistency
+*** TODO [#B] Improve logging consistency
 Some operations log to ~$logfile~, others don't - standardize logging
 All package installs should log, all system modifications should log, all errors should log with context
 Makes debugging failed installations easier
 
-** TODO [#B] Complete Rofi integration
+*** TODO [#B] Complete Rofi integration
 Rofi installed but needs testing and polish to ensure no friction
-*** TODO [#B] Match Rofi CSS style to notification CSS and move into proper place
-*** TODO [#C] Consider rofi-wayland for future Wayland migration
+**** TODO [#B] Match Rofi CSS style to notification CSS and move into proper place
+**** TODO [#C] Consider rofi-wayland for future Wayland migration
 ~rofi~ doesn't support Wayland - evaluate ~rofi-wayland~, ~wofi~, or ~fuzzel~ for future
 
-** TODO [#B] Complete Warpinator setup for file transfers
+*** TODO [#B] Complete Warpinator setup for file transfers
 Exploring Warp/Packet/Warpinator for file transfers with Christine (Linux Mint user)
 Starting with Warpinator - needs testing and integration into archsetup
 
-** VERIFY [#C] FZF works everywhere
-Especially the ** expander for all files - may already be fixed, needs verification
-
-** TODO [#B] Install desktop files using proper utility
+*** TODO [#B] Install desktop files using proper utility
 Some packages expect desktop files installed with ~desktop-file-install --dir=$HOME/.local/share/applications~/app.desktop~
 Ensure picked up with ~update-desktop-database ~/.local.share/applications~
 Prevents friction from packages that don't recognize improperly installed desktop files
 
-** TODO [#B] Add Proton Mail Bridge and setup mail to Emacs
+*** TODO [#B] Add Proton Mail Bridge and setup mail to Emacs
 Bridge is how mu4e connects to Proton mail - essential for email workflow
 Install and configure Proton Mail Bridge, integrate with mu4e in Emacs
 
-** VERIFY [#C] All mail secrets files added to dotfiles
+*** TODO [#C] Fix duplicate package installations (mediainfo, obsidian)
+Wastes time and could mask package issues
+
+*** TODO [#C] Add backup before system file modifications
+Safety net for /etc/X11/xorg.conf.d and other system file edits
+Files like ~/etc/sudoers~, ~/etc/pacman.conf~, ~/etc/default/grub~ modified without backup
+If modifications fail or are incorrect, difficult to recover - should backup files to ~.backup~ before modifying
+
+*** TODO [#C] Parse and improve AUR error reporting
+Parse yay errors and provide specific, actionable fixes instead of generic error messages
+
+*** VERIFY [#C] FZF works everywhere
+Especially the ** expander for all files - may already be fixed, needs verification
+
+*** VERIFY [#C] All mail secrets files added to dotfiles
 Verify mail configuration and secrets are properly tracked in dotfiles
 
+*** TODO [#D] Add cpupower installation and enabling to archsetup
+cpupower service configures the default CPU scheduler (powersave or performance)
+Install cpupower, configure /etc/default/cpupower, enable service: ~systemctl enable --now cpupower.service~
+
 ** Method 2: Establish Continuous Validation
 
 Every change to archsetup is automatically tested in a fresh environment. CI/CD runs the full install, captures logs, and reports what succeeded and what failed—with actionable recovery information. When packages fail to install (which will happen—that's outside my control), the test reports exactly which packages failed and provides a recovery script I can run post-install. Success isn't zero failures; success is clear, accurate reporting of failures.
@@ -274,52 +272,52 @@ The testing infrastructure catches regressions, deprecated packages, and broken
 
 *Why this is Method 2:* Once script works, lock in that reliability with automated testing. Prevents regressions and catches deprecated packages early.
 
-** TODO [#A] Research container-based testing approaches
+*** TODO [#A] Research container-based testing approaches
 Evaluate Docker, systemd-nspawn, Distrobox for fresh Arch install simulation
 
-** TODO [#A] Create minimal test environment that mimics fresh Arch install
+*** TODO [#A] Create minimal test environment that mimics fresh Arch install
 Foundation for all automated testing - must accurately replicate target environment
 
-** TODO [#A] Define test assertions for validation
-*** TODO [#A] All packages install successfully
-*** TODO [#A] Dotfiles are stowed correctly (verify symlinks exist)
-*** TODO [#A] Critical services start (X11, networking, audio)
-*** TODO [#A] Custom scripts are executable and in PATH
+*** TODO [#A] Define test assertions for validation
+**** TODO [#A] All packages install successfully
+**** TODO [#A] Dotfiles are stowed correctly (verify symlinks exist)
+**** TODO [#A] Critical services start (X11, networking, audio)
+**** TODO [#A] Custom scripts are executable and in PATH
 
-** TODO [#A] Build CI/CD pipeline that runs archsetup on every commit
+*** TODO [#A] Build CI/CD pipeline that runs archsetup on every commit
 Core automation infrastructure - enables continuous validation
 
-** TODO [#B] Set up automated test schedule
+*** TODO [#A] Generate recovery scripts from test failures
+Auto-create post-install fix scripts for failed packages - makes failures actionable
+
+*** TODO [#B] Set up automated test schedule
 Weekly full run to catch deprecated packages even without commits
 
-** TODO [#B] Implement manual test trigger capability
+*** TODO [#B] Implement manual test trigger capability
 Allow on-demand test runs when automation is toggled off
 
-** TODO [#B] Create test results dashboard/reporting
+*** TODO [#B] Create test results dashboard/reporting
 Make test outcomes visible and actionable
 
-** TODO [#B] Block merges to main if tests fail
+*** TODO [#B] Block merges to main if tests fail
 Enforce quality gate - broken changes don't enter main branch
 
-** TODO [#B] Add network failure testing to test suite
+*** TODO [#B] Add network failure testing to test suite
 Simulate network disconnect mid-install to verify resilience
 
-** TODO [#C] Document testing process in README
-Help future maintainers understand and modify test infrastructure
-
-** TODO [#A] Generate recovery scripts from test failures
-Auto-create post-install fix scripts for failed packages - makes failures actionable
-
-** TODO [#B] Keep container base images up to date
+*** TODO [#B] Keep container base images up to date
 Regular updates to Arch base image with review process and schedule
 
-** TODO [#B] Persist test logs for historical analysis
+*** TODO [#B] Persist test logs for historical analysis
 Archive logs with review process and schedule to identify failure patterns and trends
 
-** TODO [#B] Implement automated deprecation detection
+*** TODO [#B] Implement automated deprecation detection
 Parse package warnings and repo metadata to catch upcoming deprecations proactively
 
-** TODO [#C] Monitor and optimize test execution time
+*** TODO [#C] Document testing process in README
+Help future maintainers understand and modify test infrastructure
+
+*** TODO [#C] Monitor and optimize test execution time
 Keep test runs performant as installs and post-install tests grow (target < 2 hours)
 
 ** Method 3: Maintain System Hygiene
@@ -334,46 +332,46 @@ The system remains as intentional and minimal as the day archsetup first install
 
 *Why this is Method 3:* Depends on Method 2's automation to generate accurate package inventories. With reliable execution and testing in place, now maintain quality. Prevent accumulation of cruft that slows system and complicates maintenance.
 
-** TODO [#A] Create package inventory system
-*** TODO [#A] List all packages archsetup would install (including dependencies)
-*** TODO [#A] List all packages currently installed on live system
-*** TODO [#A] Generate diff showing what's in archsetup vs what's on system
+*** TODO [#A] Create package inventory system
+**** TODO [#A] List all packages archsetup would install (including dependencies)
+**** TODO [#A] List all packages currently installed on live system
+**** TODO [#A] Generate diff showing what's in archsetup vs what's on system
+
+*** TODO [#A] Establish monthly review workflow
+**** TODO [#A] For packages in archsetup but not on system: determine if still needed
+**** TODO [#A] For packages on system but not in archsetup: decide add or remove
+**** TODO [#A] Schedule monthly package diff review
 
-** TODO [#A] Establish monthly review workflow
-*** TODO [#A] For packages in archsetup but not on system: determine if still needed
-*** TODO [#A] For packages on system but not in archsetup: decide add or remove
-*** TODO [#A] Schedule monthly package diff review
+*** TODO [#A] Automate the inventory comparison
+Make package diff a runnable script instead of manual process
 
-** TODO [#B] Audit dotfiles/system directory
-*** TODO [#B] Review all 50+ scripts in ~/.local/bin - remove unused scripts
-*** TODO [#B] Check dotfiles for uninstalled packages - remove orphaned configs
-*** TODO [#B] Verify all stowed files are actually used
+*** TODO [#B] Audit dotfiles/system directory
+**** TODO [#B] Review all 50+ scripts in ~/.local/bin - remove unused scripts
+**** TODO [#B] Check dotfiles for uninstalled packages - remove orphaned configs
+**** TODO [#B] Verify all stowed files are actually used
 
-** TODO [#B] Replace deprecated ntp with chrony
+*** TODO [#B] Replace deprecated ntp with chrony
 ~ntp~ and ~ntpdate~ are deprecated - modern alternatives:
 - ~chrony~: More accurate, better for laptops (handles sleep/wake)
 - ~systemd-timesyncd~: Built into systemd, simpler for desktop use
 Recommendation: Use ~chrony~ for better accuracy and laptop compatibility
 
-** TODO [#B] Identify and replace packages no longer in repos
+*** TODO [#B] Identify and replace packages no longer in repos
 Systematic check for availability issues
 
-** TODO [#C] Set up alerts for deprecated packages
-Proactive monitoring integrated with Method 2 testing
-
-** TODO [#A] Automate the inventory comparison
-Make package diff a runnable script instead of manual process
-
-** TODO [#B] Verify package origin for all packages
+*** TODO [#B] Verify package origin for all packages
 Ensure packages are installed from correct source (official repos vs AUR) - prevent installing from wrong place
 
-** TODO [#B] Automate script usage tracking
+*** TODO [#B] Automate script usage tracking
 Parse shell history files for ~/.local/bin script names to identify last usage date and unused scripts
 
-** TODO [#B] Automate dotfile validation
+*** TODO [#B] Automate dotfile validation
 Parse config files for binary/command references and verify those binaries exist - catch orphaned references
 
-** TODO [#C] Cleanup dotfiles repository
+*** TODO [#C] Set up alerts for deprecated packages
+Proactive monitoring integrated with Method 2 testing
+
+*** TODO [#C] Cleanup dotfiles repository
 The .dotfiles repo has configuration for applications no longer used - remove stale configs
 
 ** Method 4: Ensure Secure AND Functional System
@@ -388,52 +386,52 @@ I work in cafes without anxiety about whether my laptop is an easy target.
 
 *Why this is Method 4:* Security is foundational, but requires working functionality first (Methods 1-2). With reliable execution and testing (Methods 1-2) and system hygiene (Method 3), now ensure the system is properly secured without breaking workflow.
 
-** TODO [#A] Implement full disk encryption in archsetup
+*** TODO [#A] Implement full disk encryption in archsetup
 If laptop is stolen, data remains protected
 
-** TODO [#A] Review and fix UFW firewall configuration
-*** TODO [#A] Ensure firewall is enabled by default
-*** TODO [#A] Document which ports need to be open (SSH, Proton Bridge, etc.)
-*** TODO [#A] Test that all needed services work with firewall enabled
+*** TODO [#A] Review and fix UFW firewall configuration
+**** TODO [#A] Ensure firewall is enabled by default
+**** TODO [#A] Document which ports need to be open (SSH, Proton Bridge, etc.)
+**** TODO [#A] Test that all needed services work with firewall enabled
 
-** TODO [#A] Complete security education within 3 months
+*** TODO [#A] Complete security education within 3 months
 Read recommended resources to make informed security decisions (see metrics for Claude suggestions)
 
-** TODO [#B] Test security + functionality together
-*** TODO [#B] Verify SSH to remote server works
-*** TODO [#B] Verify Proton Mail Bridge retrieves email
-*** TODO [#B] Verify no unexpected open ports or services
-
-** TODO [#B] Security audit tooling
-*** TODO [#B] Implement port scanning check
-*** TODO [#B] Create security posture verification script
-*** TODO [#B] Set up intrusion detection monitoring
-
-** TODO [#B] Document threat model and mitigations within 6 months
-Identify attack vectors, what's mitigated, what remains
-
-** TODO [#C] Create security checklist for cafe/public wifi scenarios
-Practical guidelines for working in public spaces
-
-** TODO [#C] Build security dashboard command
-Single command shows: encryption status, firewall status, open ports, running services
-
-** TODO [#A] Prevent X termination and VT switching (security risk)
+*** TODO [#A] Prevent X termination and VT switching (security risk)
 If someone grabs laptop at cafe and hits ctrl+alt+backspace, they kill screensaver/X and get console access
 Need to disable: ctrl+alt+backspace (zap X) and ctrl+alt+F# (VT switching)
 Previous attempts to configure in xorg.conf.d failed - need to investigate what's overriding the settings
 Tried: /etc/X11/xorg.conf.d/00-no-vt-or-zap.conf with DontVTSwitch and DontZap options
 Removed conflicting setxkbmap statements, gdm, and keyd configs - still didn't work
 
-** TODO [#B] Add net-tools to archsetup for network connection monitoring
+*** TODO [#B] Test security + functionality together
+**** TODO [#B] Verify SSH to remote server works
+**** TODO [#B] Verify Proton Mail Bridge retrieves email
+**** TODO [#B] Verify no unexpected open ports or services
+
+*** TODO [#B] Security audit tooling
+**** TODO [#B] Implement port scanning check
+**** TODO [#B] Create security posture verification script
+**** TODO [#B] Set up intrusion detection monitoring
+
+*** TODO [#B] Document threat model and mitigations within 6 months
+Identify attack vectors, what's mitigated, what remains
+
+*** TODO [#B] Add net-tools to archsetup for network connection monitoring
 Install net-tools package to enable ~netstat -nlp~ for checking open network connections
 Useful for security auditing and verifying no unexpected services are listening
 
-** TODO [#B] Verify package signature verification not bypassed by --noconfirm
+*** TODO [#B] Verify package signature verification not bypassed by --noconfirm
 Packages installed with ~--noconfirm~ may skip signature checks
 AUR had issues previously requiring --noconfirm workaround - verify this doesn't compromise security
 Ensure package signatures are still verified despite --noconfirm flag
 
+*** TODO [#C] Create security checklist for cafe/public wifi scenarios
+Practical guidelines for working in public spaces
+
+*** TODO [#C] Build security dashboard command
+Single command shows: encryption status, firewall status, open ports, running services
+
 ** Method 5: Modernize Software Stack
 
 My software stack evolves naturally as I discover better alternatives. When I see a tool being used elsewhere that solves a problem more elegantly, or when I identify a deficiency in what I'm currently using (like lack of ligature support in my terminal), I have a clear process to evaluate whether the new tool is worth adopting.
@@ -444,34 +442,33 @@ When I decide to adopt a new tool, it's thoroughly tested and integrated into ar
 
 *Why this is Method 5:* With secure, reliable, tested, and maintained system in place (Methods 1-4), now enhance it opportunistically. Better tools = more frictionless workflow. This is lowest priority because it's about improvement, not fixing what's broken.
 
-** TODO [#C] Evaluate modern CLI tool replacements
+*** TODO [#B] Document evaluation criteria and trade-offs
+Establish clear process for tool evaluation decisions
+
+*** TODO [#B] Test each modernization thoroughly before replacing
+Ensure new tools integrate with DWM environment and don't break workflow
+
+*** TODO [#C] Evaluate modern CLI tool replacements
 bat, eza, zoxide, dust, ripgrep-all - only adopt if clear friction reduction
 
-** TODO [#C] Consider paru instead of yay
+*** TODO [#C] Consider paru instead of yay
 Evaluate if paru offers meaningful improvements for AUR management
 
-** TODO [#C] Evaluate terminal emulator alternatives
+*** TODO [#C] Evaluate terminal emulator alternatives
 ghostty for ligature support - addresses known deficiency
 
-** TODO [#C] Review file manager options alongside ranger
+*** TODO [#C] Review file manager options alongside ranger
 lf, nnn, yazi - evaluate if any reduce friction vs current ranger setup
 
-** TODO [#B] Document evaluation criteria and trade-offs
-Establish clear process for tool evaluation decisions
-
-** TODO [#B] Test each modernization thoroughly before replacing
-Ensure new tools integrate with DWM environment and don't break workflow
-
-** TODO [#C] Review current tool pain points annually
+*** TODO [#C] Review current tool pain points annually
 Once-yearly systematic inventory of known deficiencies and friction points in current toolset
 
-** TODO [#C] Install Zoxide and dotfiles in archsetup
+*** TODO [#C] Install Zoxide and dotfiles in archsetup
 Modern replacement for ~cd~ with frecency-based directory jumping
 Install: ~pacman_install zoxide~ - remembers frequently used directories, faster navigation
-*** TODO [#C] Install Zoxide integration into Ranger
+**** TODO [#C] Install Zoxide integration into Ranger
 https://github.com/jchook/ranger-zoxide - enables zoxide jumping within ranger file manager
 
-
 * Obstacles
 
 ** Limited Security Knowledge
@@ -504,7 +501,6 @@ Package maintainers sometimes release broken packages to the AUR, especially whe
 
 *Stakes:* Even with perfect testing, archsetup could work one week and break the next due to upstream package issues. Can't prevent this, but can mitigate with better error reporting and recovery mechanisms (Method 1). Testing (Method 2) helps catch these issues before I need the script in an emergency.
 
-
 * Metrics
 
 ** Method 1: Achieve Fail-Proof Execution
@@ -677,4 +673,5 @@ Package maintainers sometimes release broken packages to the AUR, especially whe
 - *Target:* Regular retrospective on adopted tools - did they actually reduce friction?
 - *Measure:* Post-install assessment: is the new tool better? Did it solve the problem? Worth the switching cost?
 - *Frequency:* Quarterly retrospective on tools adopted in past 3 months
+* ArchSetup Inbox