Workstation Environment Manifest

dot tool export produces a portable, schema-validated record of "what is installed on this machine" — the canonical input that downstream tooling consumes.

Schema

docs/schema/dot-env-v1.json is a JSON Schema 2020-12 file. Validate any manifest against it with:

dot tool export | jsonschema -i /dev/stdin docs/schema/dot-env-v1.json
# or
dot tool export | check-jsonschema --schemafile docs/schema/dot-env-v1.json /dev/stdin

(jsonschema from the jsonschema PyPI package; check-jsonschema from python-jsonschema/check-jsonschema. Either works.)

Quick reference

dot tool export                              # canonical JSON to stdout
dot tool export --format ndjson              # one tool per line, greppable
dot tool export --output /tmp/env.json       # atomic file write
dot tool export --compact                    # one-line JSON
dot tool export --help                       # flags + examples

Example output (truncated):

{
  "schema_version": "https://sebastienrousseau.github.io/dotfiles/schema/dot-env-v1.json",
  "manifest_version": "1.0.0",
  "emitted_at": "2026-05-17T10:22:46Z",
  "emitter": {
    "name": "dot tool export",
    "version": "0.2.503",
    "repo": "github.com/sebastienrousseau/dotfiles"
  },
  "host": {
    "hostname": "rousseau-mbp-m1",
    "os": "Darwin",
    "arch": "arm64"
  },
  "tools": [
    {
      "name": "node",
      "version": "24.14.0",
      "source": "<home>/.dotfiles/mise.toml",
      "source_type": "mise.toml",
      "requested_version": "24.14.0",
      "install_path": "<home>/.local/share/mise/installs/node/24.14.0",
      "active": true
    },
    ...
  ]
}

Why this exists

R3 §7.4 strategic-reversal call: ship dot tool export BEFORE dot fleet apply --attest. Three independent forces converge on a 2026-09-17 / 2026-09-11 window:

AgentSpec / AAIF public deadline at AGNTCon Amsterdam 2026-09-17. First-mover with the canonical "one signed manifest → AGENTS.md, agent.yaml, devcontainer-feature.json, mise.toml, Brewfile, flake.nix, in-toto subject list" generator owns the reference implementation.
EU CRA SBOM reporting binding 2026-09-11. A v1 manifest per workstation feeds the "demonstrate vulnerability response" story for any EU procurement team.
dotbot v3.5.0's workflow.yaml is 80% of the way to AgentEnv parity. The window before they generate the same manifest is measured in weeks.

Downstream consumers (planned)

The v1 manifest is the source-of-truth that subsequent emitters will re-render. Each emitter is a single jq filter from the v1 shape:

Target format	Use case	Status
`AGENTS.md`	Cross-harness AI agent context	shipped (`dot agent context apply`); not yet rendered from the v1 manifest
`devcontainer-feature.json`	Reproducible cloud-IDE setup	planned
`mise.toml`	Round-trip: re-create the same install set on a fresh host	planned
`Brewfile`	Hand off to a Homebrew-managed Mac	planned
`flake.nix`	Nix reproducibility	planned (input to nix-shell)
`in-toto subject list`	SLSA attestation subject array	planned (`dot fleet apply` has no `--attest` flag yet)
`CycloneDX SBOM`	Compliance reporting (EU CRA)	planned from this manifest (per-artifact attestation closes R3-N7). Releases already carry a CycloneDX SBOM of the packaged CLI tree, built by `release-package-dot.yml`, not from this manifest.

The schema is intentionally minimal — dot tool export records what is installed, not what is desired or what is approved. Downstream emitters add policy / approval / risk-score columns as they need them.

CI usage

No workflow in this repository runs this today; it is the intended shape:

- name: Snapshot environment manifest
  run: |
    dot tool export --output env.json
    # Attest the manifest as part of the next release
    cosign sign-blob --yes --output-signature env.json.sig \
      --output-certificate env.json.pem env.json

Attached to a release alongside the SBOM, the signed manifest would let any consumer answer "what software was on the runner that produced this release" and verify it cryptographically.