Phase 1 complete, Phase 2 in progress:
- cgit visibility control via strict-export
- nixtaml pushed to gitolite
- remote-command app added
- Session notes for resumption

Use strict-export=git-daemon-export-ok for visibility control.
Public repos: testing, nixtaml, nixtaml-website
Private repos: crash-web, gitolite-admin (SSH auth only)

Never make imperative changes - Nix is the source of truth.

Core commands: nix flake check, build, nixinate deploy, remote-command
Key gotchas: --option builders '', Secrix validation, deprecated options

Usage: nix run .#remote-command -- "<command>"
Deploy user: commander@193.16.42.36:1108

- Secrix recipients validated (crash user, crash-over-burn-1 host)
- services.xserver.layout → services.xserver.xkb.layout
- devShell.x86_64-linux → devShells.x86_64-linux.default

- nix flake check passes (minor warnings only)
- nix build produces valid derivation
- docs/deployment.md: complete deployment workflow
- phase plan updated with Secrix validation task

Reference common-infra-strategies.md as core deployment guideline.
Add Secrix validation step per §6 operational checklist.

Nixinate is the bleeding edge of correct deployment tools.
Never suggest replacing baremetal tools with inferior alternatives.

Phase 1: Deployment modernization - replace nixinate with pure flake
Phase 2: cgit verification and repository creation (nixtaml, nixtaml-website)  
Phase 3: Website integration at nixtaml.tech as nginx webroot