diff --git a/AGENTS.md b/AGENTS.md
index fd7ad0d..353de46 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@
 - **declarative nix config** для нескольких хостов через nix-darwin + home-manager
 - активный: **poppy** (MacBook Air M1)
 - planned: **muscari** (NixOS server), **rosemary** (backup VM)
-- user: `michaotic` (planned: `mikl`)
+- user: `mikl`
 
 ## structure
 
@@ -28,18 +28,14 @@
 │
 ├── home/                        # home-manager modules
 │   ├── default.nix              # imports, sessionVariables
-│   ├── cli.nix                  # CLI tools (universal)
+│   ├── cli.nix                  # CLI tools (universal) + zoxide, bat, eza, fzf
 │   ├── git.nix                  # git config
 │   ├── ssh.nix                  # SSH matchBlocks
 │   ├── zsh.nix                  # shell + aliases
 │   ├── kitty.nix                # terminal
-│   ├── duti.nix                 # default apps
+│   ├── duti.nix                 # default apps (macOS only)
 │   ├── pass.nix                 # pass + gpg-agent (только для GPG)
-│   ├── syncthing.nix            # p2p sync
-│   ├── zoxide.nix
-│   ├── bat.nix
-│   ├── eza.nix
-│   └── fzf.nix
+│   └── syncthing.nix            # p2p sync
 │
 └── docs/                        # документация
     ├── structure.md             # high-level overview
diff --git a/docs/bootstrap.md b/docs/bootstrap.md
index f9726c7..d3c0057 100644
--- a/docs/bootstrap.md
+++ b/docs/bootstrap.md
@@ -31,9 +31,9 @@ cd ~/repos/nix-config
 
 ```bash
 # если есть приватная репа с зашифрованным gpg ключом
-git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup
-gpg --import /tmp/gpg-setup/gpg-private.asc
-rm -rf /tmp/gpg-setup
+git clone https://git.iscg.dev/mikl/gpg.git ~/tmp/gpg
+gpg --import /tmp/gpg/private.asc
+rm -rf ~/tmp/gpg
 
 # проверить
 gpg --list-secret-keys mikl@iscg.dev
@@ -64,16 +64,17 @@ sudo nixos-rebuild switch --flake .#muscari
 
 ```bash
 # если есть существующий password store
-git clone https://git.iscg.dev/mikl/password-store.git ~/.password-store
+git clone https://git.iscg.dev/mikl/pass.git ~/.password-store
 cd ~/.password-store && git remote remove origin && git remote add origin https://git.iscg.dev/mikl/password-store.git
 
 # если создаёшь с нуля
 pass init <gpg-key-id>   # id от gpg --list-secret-keys
 pass git init
-pass git remote add origin https://git.iscg.dev/mikl/password-store.git
+pass git remote add origin https://git.iscg.dev/mikl/pass.git
 ```
 
 после этого работают алиасы:
+
 ```bash
 pass-sync    # = pass git push
 pass-pull    # = pass git pull
@@ -89,6 +90,7 @@ pass-status  # = pass git status
 3. **Change All...** → подтвердить
 
 для каких файлов:
+
 - `.url`, `.xhtml` → Chrome
 - `.sh` → kitty
 - `.pdf` → Skim
diff --git a/home/cli.nix b/home/cli.nix
index 046b318..8aab14b 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -15,7 +15,6 @@
     htop
     tldr
     fastfetch
-    tree
 
     # Editor
     micro
@@ -62,6 +61,20 @@
     options = [ "--cmd cd" ];
   };
 
+  # Atuin - encrypted shell history with sync
+  programs.atuin = {
+    enable = true;
+    enableZshIntegration = true;
+    settings = {
+      auto_sync = true;
+      sync_frequency = "5m";
+      search_mode = "fuzzy";
+      style = "compact";
+      show_preview = true;
+      exit_mode = "return-query";
+    };
+  };
+
   # Bat - cat with syntax highlighting
   programs.bat = {
     enable = true;
diff --git a/home/default.nix b/home/default.nix
index cf0d005..3275f0a 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -14,11 +14,8 @@
 
   home.sessionVariables = {
     SEARXNG_URL = "https://search.iscg.dev";
-    PATH = "/etc/profiles/per-user/mikl/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/mikl/.opencode/bin:/Users/mikl/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin";
-    # OPENROUTER_API_KEY = "";  # TODO: move to sops-nix secrets
-    SOPS_AGE_KEY_FILE = "$HOME/.config/sops/age/keys.txt";
+    PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/sbin:/usr/sbin:/run/current-system/sw/bin:/etc/profiles/per-user/mikl/bin:$HOME/.nix-profile/bin:$HOME/bin:$HOME/.local/bin:$HOME/.npm-global/bin:/Users/mikl/.opencode/bin:/Users/mikl/.local/share/pi-node/node-v22.23.1-darwin-arm64/bin";
     EDITOR = "micro";
     VISUAL = "micro";
-    KUBECONFIG = "$HOME/.kube/config-jul11";
   };
 }
diff --git a/home/kitty.nix b/home/kitty.nix
index eadc072..5e07421 100644
--- a/home/kitty.nix
+++ b/home/kitty.nix
@@ -1,5 +1,12 @@
 { pkgs, ... }:
 {
+  # Copy kitty.app to ~/Applications/ for Spotlight indexing
+  # (home-manager creates symlink, Spotlight doesn't index symlinks)
+  home.file."Applications/kitty.app" = {
+    source = "${pkgs.kitty}/Applications/kitty.app";
+    recursive = true;
+  };
+
   programs.kitty = {
     enable = true;
 
diff --git a/home/pass.nix b/home/pass.nix
index 22c5837..b789b20 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -6,7 +6,7 @@
     package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
     settings = {
       PASSWORD_STORE_DIR = "$HOME/.password-store";
-      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/password-store.git";
+      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/pass.git";
       PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
       PASSWORD_STORE_CLIP_TIME = "45";
       PASSWORD_STORE_GENERATED_LENGTH = "25";
diff --git a/home/ssh.nix b/home/ssh.nix
index 36e719b..aa33a4b 100644
--- a/home/ssh.nix
+++ b/home/ssh.nix
@@ -1,26 +1,26 @@
 { ... }:
 {
-  # SSH client configuration with host-specific keys
+  # SSH client configuration
+  # TEMP: using single key 'poppy' for all hosts - create host-specific keys later
   programs.ssh = {
     enable = true;
     
     matchBlocks = {
-      # Forgejo (personal) — port 2222
+      # All git forges use the same key for now
+      "git.*" = {
+        identityFile = "~/.ssh/poppy";
+        identitiesOnly = true;
+        addKeysToAgent = "yes";
+      };
+      
+      # Specific hosts (port override for forgejo)
       "git.iscg.dev" = {
-        identityFile = "~/.ssh/id_ed25519_forgejo";
+        identityFile = "~/.ssh/poppy";
         port = 2222;
         identitiesOnly = true;
         addKeysToAgent = "yes";
       };
       
-      # GitHub
-      "github.com" = {
-        identityFile = "~/.ssh/id_ed25519";
-        identitiesOnly = true;
-        addKeysToAgent = "yes";
-      };
-      
-      # git.sol.moe
       "git.sol.moe" = {
         identityFile = "~/.ssh/poppy";
         user = "mikl";
diff --git a/hosts/poppy/system.nix b/hosts/poppy/system.nix
index 6fbbaa7..b5cfef4 100644
--- a/hosts/poppy/system.nix
+++ b/hosts/poppy/system.nix
@@ -9,6 +9,12 @@
     };
 
     CustomUserPreferences = {
+      # Disable system sound effects (screenshots, etc.)
+      "com.apple.systemsound" = {
+        "com.apple.sound.beep.feedback" = 0;  # No feedback sound when changing volume
+        "com.apple.sound.uiaudio.enabled" = 0; # Disable UI sounds (screenshots, etc.)
+      };
+
       "com.apple.HIToolbox" = {
         AppleEnabledInputSources = [
           {
@@ -132,13 +138,22 @@
         "/System/Applications/Calendar.app"
         "/Applications/Obsidian.app"
         "/Applications/VSCodium.app"
-        "/Users/mikl/Applications/Home Manager Apps/kitty.app"
+        "/Users/mikl/Applications/kitty.app"
+        "/System/Applications/Utilities/Activity Monitor.app"
         "/System/Applications/Books.app"
         "/System/Applications/QuickTime Player.app"
       ];
     };
   };
 
+  # Install Rosetta 2 for Intel apps on Apple Silicon
+  system.activationScripts.rosetta.text = ''
+    if ! /usr/bin/pgrep -q oahd 2>/dev/null; then
+      echo "Installing Rosetta 2..."
+      /usr/sbin/softwareupdate --install-rosetta --agree-to-license
+    fi
+  '';
+
   system.activationScripts.postActivation.text = ''
     echo "Restarting Dock..."
     sudo -u mikl /usr/bin/killall Dock