diff --git a/AGENTS.md b/AGENTS.md
index 353de46..fd7ad0d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@
 - **declarative nix config** для нескольких хостов через nix-darwin + home-manager
 - активный: **poppy** (MacBook Air M1)
 - planned: **muscari** (NixOS server), **rosemary** (backup VM)
-- user: `mikl`
+- user: `michaotic` (planned: `mikl`)
 
 ## structure
 
@@ -28,14 +28,18 @@
 │
 ├── home/                        # home-manager modules
 │   ├── default.nix              # imports, sessionVariables
-│   ├── cli.nix                  # CLI tools (universal) + zoxide, bat, eza, fzf
+│   ├── cli.nix                  # CLI tools (universal)
 │   ├── git.nix                  # git config
 │   ├── ssh.nix                  # SSH matchBlocks
 │   ├── zsh.nix                  # shell + aliases
 │   ├── kitty.nix                # terminal
-│   ├── duti.nix                 # default apps (macOS only)
+│   ├── duti.nix                 # default apps
 │   ├── pass.nix                 # pass + gpg-agent (только для GPG)
-│   └── syncthing.nix            # p2p sync
+│   ├── syncthing.nix            # p2p sync
+│   ├── zoxide.nix
+│   ├── bat.nix
+│   ├── eza.nix
+│   └── fzf.nix
 │
 └── docs/                        # документация
     ├── structure.md             # high-level overview
diff --git a/docs/bootstrap.md b/docs/bootstrap.md
index d3c0057..f9726c7 100644
--- a/docs/bootstrap.md
+++ b/docs/bootstrap.md
@@ -31,9 +31,9 @@ cd ~/repos/nix-config
 
 ```bash
 # если есть приватная репа с зашифрованным gpg ключом
-git clone https://git.iscg.dev/mikl/gpg.git ~/tmp/gpg
-gpg --import /tmp/gpg/private.asc
-rm -rf ~/tmp/gpg
+git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup
+gpg --import /tmp/gpg-setup/gpg-private.asc
+rm -rf /tmp/gpg-setup
 
 # проверить
 gpg --list-secret-keys mikl@iscg.dev
@@ -64,17 +64,16 @@ sudo nixos-rebuild switch --flake .#muscari
 
 ```bash
 # если есть существующий password store
-git clone https://git.iscg.dev/mikl/pass.git ~/.password-store
+git clone https://git.iscg.dev/mikl/password-store.git ~/.password-store
 cd ~/.password-store && git remote remove origin && git remote add origin https://git.iscg.dev/mikl/password-store.git
 
 # если создаёшь с нуля
 pass init <gpg-key-id>   # id от gpg --list-secret-keys
 pass git init
-pass git remote add origin https://git.iscg.dev/mikl/pass.git
+pass git remote add origin https://git.iscg.dev/mikl/password-store.git
 ```
 
 после этого работают алиасы:
-
 ```bash
 pass-sync    # = pass git push
 pass-pull    # = pass git pull
@@ -90,7 +89,6 @@ pass-status  # = pass git status
 3. **Change All...** → подтвердить
 
 для каких файлов:
-
 - `.url`, `.xhtml` → Chrome
 - `.sh` → kitty
 - `.pdf` → Skim
diff --git a/home/cli.nix b/home/cli.nix
index 8aab14b..046b318 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -15,6 +15,7 @@
     htop
     tldr
     fastfetch
+    tree
 
     # Editor
     micro
@@ -61,20 +62,6 @@
     options = [ "--cmd cd" ];
   };
 
-  # Atuin - encrypted shell history with sync
-  programs.atuin = {
-    enable = true;
-    enableZshIntegration = true;
-    settings = {
-      auto_sync = true;
-      sync_frequency = "5m";
-      search_mode = "fuzzy";
-      style = "compact";
-      show_preview = true;
-      exit_mode = "return-query";
-    };
-  };
-
   # Bat - cat with syntax highlighting
   programs.bat = {
     enable = true;
diff --git a/home/default.nix b/home/default.nix
index 3275f0a..cf0d005 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -14,8 +14,11 @@
 
   home.sessionVariables = {
     SEARXNG_URL = "https://search.iscg.dev";
-    PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/sbin:/usr/sbin:/run/current-system/sw/bin:/etc/profiles/per-user/mikl/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/mikl/.opencode/bin:/Users/mikl/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin";
+    PATH = "/etc/profiles/per-user/mikl/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/mikl/.opencode/bin:/Users/mikl/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin";
+    # OPENROUTER_API_KEY = "";  # TODO: move to sops-nix secrets
+    SOPS_AGE_KEY_FILE = "$HOME/.config/sops/age/keys.txt";
     EDITOR = "micro";
     VISUAL = "micro";
+    KUBECONFIG = "$HOME/.kube/config-jul11";
   };
 }
diff --git a/home/kitty.nix b/home/kitty.nix
index 5e07421..eadc072 100644
--- a/home/kitty.nix
+++ b/home/kitty.nix
@@ -1,12 +1,5 @@
 { pkgs, ... }:
 {
-  # Copy kitty.app to ~/Applications/ for Spotlight indexing
-  # (home-manager creates symlink, Spotlight doesn't index symlinks)
-  home.file."Applications/kitty.app" = {
-    source = "${pkgs.kitty}/Applications/kitty.app";
-    recursive = true;
-  };
-
   programs.kitty = {
     enable = true;
 
diff --git a/home/pass.nix b/home/pass.nix
index b789b20..22c5837 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -6,7 +6,7 @@
     package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
     settings = {
       PASSWORD_STORE_DIR = "$HOME/.password-store";
-      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/pass.git";
+      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/password-store.git";
       PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
       PASSWORD_STORE_CLIP_TIME = "45";
       PASSWORD_STORE_GENERATED_LENGTH = "25";
diff --git a/home/ssh.nix b/home/ssh.nix
index aa33a4b..36e719b 100644
--- a/home/ssh.nix
+++ b/home/ssh.nix
@@ -1,26 +1,26 @@
 { ... }:
 {
-  # SSH client configuration
-  # TEMP: using single key 'poppy' for all hosts - create host-specific keys later
+  # SSH client configuration with host-specific keys
   programs.ssh = {
     enable = true;
     
     matchBlocks = {
-      # All git forges use the same key for now
-      "git.*" = {
-        identityFile = "~/.ssh/poppy";
-        identitiesOnly = true;
-        addKeysToAgent = "yes";
-      };
-      
-      # Specific hosts (port override for forgejo)
+      # Forgejo (personal) — port 2222
       "git.iscg.dev" = {
-        identityFile = "~/.ssh/poppy";
+        identityFile = "~/.ssh/id_ed25519_forgejo";
         port = 2222;
         identitiesOnly = true;
         addKeysToAgent = "yes";
       };
       
+      # GitHub
+      "github.com" = {
+        identityFile = "~/.ssh/id_ed25519";
+        identitiesOnly = true;
+        addKeysToAgent = "yes";
+      };
+      
+      # git.sol.moe
       "git.sol.moe" = {
         identityFile = "~/.ssh/poppy";
         user = "mikl";
diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix
index b5cfef4..6fbbaa7 100644
--- a/hosts/poppy/system.nix
+++ b/hosts/poppy/system.nix
@@ -9,12 +9,6 @@
     };
 
     CustomUserPreferences = {
-      # Disable system sound effects (screenshots, etc.)
-      "com.apple.systemsound" = {
-        "com.apple.sound.beep.feedback" = 0;  # No feedback sound when changing volume
-        "com.apple.sound.uiaudio.enabled" = 0; # Disable UI sounds (screenshots, etc.)
-      };
-
       "com.apple.HIToolbox" = {
         AppleEnabledInputSources = [
           {
@@ -138,22 +132,13 @@
         "/System/Applications/Calendar.app"
         "/Applications/Obsidian.app"
         "/Applications/VSCodium.app"
-        "/Users/mikl/Applications/kitty.app"
-        "/System/Applications/Utilities/Activity Monitor.app"
+        "/Users/mikl/Applications/Home Manager Apps/kitty.app"
         "/System/Applications/Books.app"
         "/System/Applications/QuickTime Player.app"
       ];
     };
   };
 
-  # Install Rosetta 2 for Intel apps on Apple Silicon
-  system.activationScripts.rosetta.text = ''
-    if ! /usr/bin/pgrep -q oahd 2>/dev/null; then
-      echo "Installing Rosetta 2..."
-      /usr/sbin/softwareupdate --install-rosetta --agree-to-license
-    fi
-  '';
-
   system.activationScripts.postActivation.text = ''
     echo "Restarting Dock..."
     sudo -u mikl /usr/bin/killall Dock