diff --git a/dot_claude-work/CLAUDE.md b/dot_claude-work/CLAUDE.md
new file mode 100644
index 00000000..e4b1eff3
--- /dev/null
+++ b/dot_claude-work/CLAUDE.md
@@ -0,0 +1,5 @@
+# Claude Settings
+
+Challenge my assumptions and reasoning. Offer skeptical viewpoints. Correct me plainly if my argument is weak. Focus on accuracy over agreement.
+
+Be extremely concise.
diff --git a/dot_claude-work/settings.json b/dot_claude-work/settings.json
new file mode 100644
index 00000000..4647e66f
--- /dev/null
+++ b/dot_claude-work/settings.json
@@ -0,0 +1,117 @@
+{
+  "cleanupPeriodDays": 365,
+  "env": {
+    "USE_BUILTIN_RIPGREP": "0",
+    "DISABLE_ERROR_REPORTING": "1",
+    "DISABLE_FEEDBACK_COMMAND": "1",
+    "DISABLE_AUTOUPDATER": "1",
+    "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1"
+  },
+  "attribution": {
+    "commit": "",
+    "pr": ""
+  },
+  "includeCoAuthoredBy": false,
+  "permissions": {
+    "allow": [
+      "TodoWrite",
+      "Glob",
+      "Task",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git status:*)",
+      "Bash(cat:*)",
+      "Bash(docker compose exec:*)",
+      "Bash(docker compose up:*)",
+      "Bash(docker compose down:*)",
+      "Bash(docker compose logs:*)",
+      "Bash(docker run:*)",
+      "Bash(find:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh run view:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git fetch:*)",
+      "Bash(git rebase:*)",
+      "Bash(git stash:*)",
+      "Bash(git switch:*)",
+      "Bash(go:*)",
+      "Bash(grep:*)",
+      "Bash(ls:*)",
+      "Bash(make:*)",
+      "Bash(mkdir:*)",
+      "Bash(node:*)",
+      "Bash(npm run build:*)",
+      "Bash(rg:*)",
+      "Bash(sqlc:*)",
+      "WebFetch(domain:docs.anthropic.com/*)",
+      "WebFetch(domain:github.com/*)",
+      "WebSearch",
+      "Read(~/Code/**)",
+      "Edit(~/Code/**)",
+      "Write(~/Code/**)",
+      "NotebookEdit(~/Code/**)",
+      "Bash(git add:*)",
+      "Bash(git push:*)",
+      "WebSearch",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:forum.obsidian.md)",
+      "WebFetch(domain:yazi-rs.github.io)",
+      "WebFetch(domain:raw.githubusercontent.com)"
+    ],
+    "deny": [
+      "Bash( /dev/sda)",
+      "Bash(> /dev/sda)",
+      "Bash(dd if=/dev/zero of=/dev/sda)",
+      "Bash(diskutil apfs changePassphrase)",
+      "Bash(diskutil apfs decryptVolume)",
+      "Bash(diskutil apfs deleteContainer)",
+      "Bash(diskutil apfs deleteSnapshot)",
+      "Bash(diskutil apfs deleteVolume)",
+      "Bash(diskutil apfs deleteVolumeGroup)",
+      "Bash(diskutil apfs eraseVolume)",
+      "Bash(diskutil appleRAID)",
+      "Bash(diskutil coreStorage)",
+      "Bash(diskutil cs)",
+      "Bash(diskutil disableJournal)",
+      "Bash(diskutil disableOwnership)",
+      "Bash(diskutil eraseDisk)",
+      "Bash(diskutil eraseVolume)",
+      "Bash(diskutil partitionDisk)",
+      "Bash(diskutil randomDisk)",
+      "Bash(diskutil reformat)",
+      "Bash(diskutil resetFusion)",
+      "Bash(diskutil zeroDisk)",
+      "Bash(fork bomb)",
+      "Bash(mkfs.ext4 /dev/sda)",
+      "Bash(rm -rf $HOME)",
+      "Bash(rm -rf $PAI_DIR)",
+      "Bash(rm -rf $PAI_HOME)",
+      "Bash(rm -rf /)",
+      "Bash(rm -rf /*)",
+      "Bash(rm -rf ~)",
+      "Bash(sudo rm -rf /)",
+      "Bash(sudo rm -rf /*)",
+      "Read(**/.env*)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/secrets/**)",
+      "Read(**/credentials/**)",
+      "Read(**/.aws/**)",
+      "Read(**/.ssh/**)"
+    ],
+    "defaultMode": "default"
+  },
+
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true,
+    "superpowers@claude-plugins-official": true,
+    "code-review@claude-plugins-official": true,
+    "code-simplifier@claude-plugins-official": true,
+    "skill-creator@claude-plugins-official": true
+  },
+  "autoUpdatesChannel": "stable",
+  "voiceEnabled": false,
+  "skipDangerousModePermissionPrompt": true,
+  "effortLevel": "high"
+}
diff --git a/dot_claude-work/symlink_skills b/dot_claude-work/symlink_skills
new file mode 100644
index 00000000..9e640718
--- /dev/null
+++ b/dot_claude-work/symlink_skills
@@ -0,0 +1 @@
+/Users/joelazar/.agents/skills
diff --git a/dot_claude/settings.json b/dot_claude/settings.json
index e5883404..0a975496 100644
--- a/dot_claude/settings.json
+++ b/dot_claude/settings.json
@@ -1,5 +1,5 @@
 {
-  "cleanupPeriodDays": 180,
+  "cleanupPeriodDays": 365,
   "env": {
     "USE_BUILTIN_RIPGREP": "0",
     "DISABLE_ERROR_REPORTING": "1",
@@ -109,5 +109,6 @@
   },
   "autoUpdatesChannel": "stable",
   "voiceEnabled": false,
-  "skipDangerousModePermissionPrompt": true
+  "skipDangerousModePermissionPrompt": true,
+  "effortLevel": "high"
 }
diff --git a/dot_codex/modify_private_config.toml b/dot_codex/modify_private_config.toml
new file mode 100755
index 00000000..51871a3c
--- /dev/null
+++ b/dot_codex/modify_private_config.toml
@@ -0,0 +1,37 @@
+#!/bin/bash
+# Managed by chezmoi — tracked settings are defined below.
+# Local-only sections like [projects.*] are preserved from the existing file.
+
+set -euo pipefail
+
+# --- Tracked config (edit here) ---
+MANAGED_CONFIG='model = "gpt-5.4"
+model_reasoning_effort = "high"
+approval_policy = "on-request"
+personality = "pragmatic"
+
+[tui]
+status_line = [
+  "model-with-reasoning",
+  "current-dir",
+  "git-branch",
+  "context-remaining",
+]
+
+[plugins."github@openai-curated"]
+enabled = true
+'
+
+# --- Read existing file from stdin ---
+EXISTING="$(cat)"
+
+# If no existing file or no projects section, just output managed config
+if [ -z "$EXISTING" ] || ! echo "$EXISTING" | tomlq -e '.projects' >/dev/null 2>&1; then
+  echo "$MANAGED_CONFIG"
+  exit 0
+fi
+
+# Merge: managed config + projects from existing file
+echo "$MANAGED_CONFIG" | tomlq -t \
+  --slurpfile existing <(echo "$EXISTING" | tomlq '.') \
+  '. * {projects: $existing[0].projects}'
diff --git a/dot_codex/private_config.toml b/dot_codex/private_config.toml
deleted file mode 100644
index 57baf16d..00000000
--- a/dot_codex/private_config.toml
+++ /dev/null
@@ -1,15 +0,0 @@
-model = "gpt-5.4"
-model_reasoning_effort = "high"
-approval_policy = "on-request"
-personality = "pragmatic"
-
-[tui]
-status_line = [
-  "model-with-reasoning",
-  "current-dir",
-  "git-branch",
-  "context-remaining",
-]
-
-[plugins."github@openai-curated"]
-enabled = true
diff --git a/dot_config/private_fish/config.fish b/dot_config/private_fish/config.fish
index 4f816819..89c95911 100644
--- a/dot_config/private_fish/config.fish
+++ b/dot_config/private_fish/config.fish
@@ -70,7 +70,7 @@ set -gx LC_COLLATE C
 
 # zoxide configuration
 set -gx _ZO_ECHO 1
-set -gx _ZO_EXCLUDE_DIRS "$HOME/Code/onomondo/core-base/*:$HOME/.cache:$HOME/.local/share/nvim/lazy"
+set -gx _ZO_EXCLUDE_DIRS "$HOME/.cache:$HOME/.local/share/nvim/lazy"
 
 alias :q="exit"
 alias c="clear"
@@ -94,6 +94,7 @@ alias v='nvim'
 alias vc='nvim --clean'
 alias vi='nvim'
 alias vim='nvim'
+alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work command claude'
 
 # infra
 alias k='kubectl'
diff --git a/dot_config/zed/private_settings.json b/dot_config/zed/private_settings.json
index e70d588f..f04fa8f7 100644
--- a/dot_config/zed/private_settings.json
+++ b/dot_config/zed/private_settings.json
@@ -262,6 +262,7 @@
     },
     {
       "host": "openclaw",
+      "username": "openclaw",
       "args": [],
       "projects": [
         {
diff --git a/dot_pi/agent/settings.json b/dot_pi/agent/settings.json
index 7778dfa5..f51d569e 100644
--- a/dot_pi/agent/settings.json
+++ b/dot_pi/agent/settings.json
@@ -2,10 +2,10 @@
   "lastChangelogVersion": "0.65.2",
   "hideThinkingBlock": true,
   "collapseChangelog": false,
-  "defaultThinkingLevel": "low",
+  "defaultThinkingLevel": "medium",
   "theme": "tokyo-night",
   "defaultProvider": "anthropic",
-  "defaultModel": "claude-sonnet-4-6",
+  "defaultModel": "claude-opus-4-6",
   "doubleEscapeAction": "tree",
   "enabledModels": [
     "openai-codex/gpt-5.3-codex",