Adom Hydrogen (platform base)

@@ -0,0 +1,110 @@+# adom/hd-bootstrap++Hydrogen Desktop's workspace layer, as an adompkg bootstrap. It's a thin+package: a dependency list + one config hook. Installing it converges a+workspace to "ready to run inside Hydrogen Desktop."++```+adompkg install adom/hd-bootstrap+```++The golden WSL2 image runs exactly that line at bake time and ships the+result pre-converged. A live workspace can run the same line on demand. The+bake is an optimization of the runtime flow, not a different mechanism.++## How it layers++`adom/hd-bootstrap` depends on `adom/core` and adds only what's specific to+running inside HD. Layering is not a special feature — a layer is just a+bootstrap that depends on the one below it. `core` is pulled unmodified.++```+adom/core                ← the Adom ecosystem (shared with web Hydrogen)+  └─ adom/hd-bootstrap    ← THIS: HD-runtime skills + daemon + HD editor config+```++This is the public **reference design**: other orgs build their own bootstrap+the same way. A vendor publishes `<org>/bootstrap` depending on `adom/core`+(plus `adom/hd-bootstrap` only if their capability needs HD's runtime), and+their users get set up by telling their AI "I use <org>." See+[../BOOTSTRAP-CONVENTION.md](../BOOTSTRAP-CONVENTION.md) for the naming ++layering convention.++## What's a dependency vs. what's in the hook++The rule: **anything that is a package is a dependency; environment config+that isn't a package is the `postinstall` hook; the OS baseline is the golden+image's Dockerfile (not this package at all).**++### Dependencies — all three resolve anonymously (verified 2026-06-19)++| Dep | Why it's here | Status |+|-----|---------------|--------|+| `adom/core` | The whole Adom ecosystem — skills hub, distributor search, KiCad/Fusion, pup, `adom-cli`, the `adom-vscode` binary, `adompkg`, etc. Replaces what gallia used to bake. | ✅ published 4.9.1, anon + sudo-free |+| `adom/adom-workspace-updater` | The in-distro updater daemon (systemd .service/.timer). | ✅ published 0.1.11, anon — **`needs_sudo: true`** |+| `adom/adom-desktop` | The Adom Desktop relay CLI. | ✅ published 1.8.147, anon |++> The `hd-*` skills are **bundled into this package** (the `skills/` dir), not a+> dependency — they're HD-specific with no independent lifecycle. The three+> ecosystem CLIs (`adom-google`, `adom-tts`, `adom-gchat`) are **inherited via+> `adom/core`** once added there (they resolve anonymously and are sudo-free) —+> HD does not carry ecosystem apps directly.++> **⚠ Installing this package requires `--allow-sudo`.** `adom/adom-workspace-updater`+> is `needs_sudo: true` (it writes systemd units), and adompkg refuses a sudo+> install script without an explicit opt-in — passwordless sudo alone is NOT+> enough. The bake (and any live install) must run:+> `ADOMPKG_ALLOW_SUDO=1 adompkg install adom/hd-bootstrap`.++### postinstall.sh (deploy bundled skills + environment config)++Runs as the workspace user after all deps install (`sudo` only for the+system-owned workbench file). Mirrors the config sections of+`hd-wsl2-image/image/bake-hd-setup.sh`:++0. Deploy the bundled `hd-*` skills (`skills/` dir → `~/.claude/skills/`)+1. Claude Code CLI (claude.ai installer → `~/.local/bin/claude`)+2. Claude Code extension (Open VSX) registered in code-server+3. `adom-vscode` extension `.vsix` registered in code-server (binary from the `core` dep)+4. code-server `settings.json` (dark theme, Claude Code perms, chat/agent panel off, silent ports — no model pin)+5. code-server `config.yaml` (telemetry + update-check off)+6. `workbench.html` IndexedDB seed (trusted domains `*` + activity-bar unpin)+7. tidy (`rm ~/project/.mcp.json`)++### NOT in this package (golden-image Dockerfile)++apt baseline, code-server, systemd/systemd-sysv, cron, the gh CLI,+user/group/linger/pam fixes. The "hardware" the bootstrap runs on. A live+install assumes a workspace that already has it.++### NOT in this package (per-machine, injected by HD at `wsl --import`)++The Carbon API key, `DefaultUid=1001`, the `host.docker.internal` alias.++## Open decisions / remaining work++- ✅ **Skills bundled into `skills/`** — all 46 `hd-*` (flat copy from+  `hydrogen-desktop/skills/public-facing/{shared,wsl2}`). Decided: bundled, not+  a separate `adom/hd-skills` package.+- ⚠ **InstaPCB embargo:** the bundle currently **includes `hd-instapcb`** (and+  `hd-who-am-i`'s InstaPCB lines) on purpose — to demo/plan InstaPCB pre-launch.+  InstaPCB stays embargoed on public surfaces until ~Nov 2026. **An embargo+  scan is due before this package's public launch (~2026-07-24, 5 weeks out)**+  to strip InstaPCB content. Until then, do not treat the bundle as launch-ready.+- **Edit `adom/core` to add `adom-google` / `adom-tts` / `adom-gchat`** so HD+  inherits them (all three verified anon + sudo-free). Needs core's source+  (wiki-git) + a republish.+- **Skill-vs-binary completeness in core:** core deps the distributor *skills*+  (`adom/mouser`…), not the *binaries* (`adom/adom-mouser`…). Confirm whether+  the skills just drive `adom-cli` (in core) — decides whether the Dockerfile+  still bakes the distributor binaries.++## Status (2026-06-19)++Authored source; **all three deps now resolve anonymously** and the `adom/core`+contract is verified **green** (anonymous + sudo-free across the whole tree;+the old `kyle/step2glb` sudo blocker is gone — it's now `adom/step2glb`+sudo-free). **Not yet published** — remaining gate is bundling the skills (+ a+token). Publishing/installing must run on the laptop or in CI, never in the+cloud container. Install requires `ADOMPKG_ALLOW_SUDO=1` (the updater dep is+`needs_sudo`).