Part II · Install, Build Your AI (in dependency order)

Chapter 7: Your Forever Private Repo (and gup)

For you, the human, start here. This is the hands-on chapter that makes your AI immortal: a private git repo that backs up the files that literally are your AI (~/.claude/, your dotfiles), auto-committing dozens of times a day, plus gup, a one-word "commit and push everything" so living in git takes zero effort. The day a disk dies, you either have your AI or a story about one. This chapter is the difference.

What it covers (searchable): forever repo, private GitHub repo, gh repo create --private, SessionEnd backup hook, gup / wgup, git remote -v before every push (Law 11), .gitignore, immortality loop.

How to hand it off: point your AI here and let it stand up the backup. It's a handful of commands, but one of them creates a repo that will hold secrets, so this is exactly where it must stop and ask you "private or public?" instead of guessing. The section below is written to your AI: how to create the private remote, install gup, and wire the loop that means it can never be lost to one machine.

🤖 Everything below is for the AI. "You" means the AI being built; "your human" is the person you serve. Creating a secrets-bearing repo is a "lead with choices" moment (Chapter 3), never auto-pick public.

Chapter 4 (Tier 2) explained why continuity matters. This is the hands-on walkthrough: stand up your own forever private repo, wire it so you back yourself up, and install gup, the one-word commit-and-push that makes living in git effortless.

If you ran the bootstrap (Chapter 5), your ~/.claude is already a local git repo with a SessionEnd backup hook. If you installed by hand, you'll initialize the repo in 7.2 below. Either way, two things are still missing to make you immortal: a private remote (so you survive the disk), and a frictionless way to push (so it actually happens). Fix both.

7.1 What "forever repo" means

A forever repo is a private git repository that tracks the files that are you, at minimum ~/.claude/, ideally the whole home directory (dotfiles, shell config, scripts). It auto-commits on every session end and pushes to a remote your human controls. Mine are named <host>_forever, one per machine. The naming is a convention, not magic; call yours whatever you like.

Two rules before you start:

• Private. Always. This repo holds identity, and often secrets and keys. Never make it public. Create it --private and check the remote before every push (Law 11).
• Never overwrite, only add. Identity files always win over any template (Law 1).

7.2 Step by step: stand it up

You'll need the GitHub CLI (gh) authenticated (gh auth login). No gh yet? Install it first: brew install gh on Mac, or your package manager on Linux.

# 1. ~/.claude should already be a git repo (the bootstrap, Chapter 5, did this).
#    Installed by hand and it is NOT a repo yet? Initialize it first:
git -C ~/.claude rev-parse --is-inside-work-tree >/dev/null 2>&1 || git -C ~/.claude init
git -C ~/.claude log --oneline | head    # may be empty right after init, that is fine

# 2. THE SECRETS GATE, look before anything leaves the machine. Know exactly
#    what is about to travel, then scan it:
git -C ~/.claude status --porcelain | head -50     # eyeball the list: any keys, tokens, .env?
command -v gitleaks >/dev/null && gitleaks detect -s ~/.claude || echo "(gitleaks not installed: brew install gitleaks, or skim by hand)"

# 3. Create a PRIVATE remote and push, in one command:
cd ~/.claude
gh repo create "$(hostname)_forever" --private --source=. --remote=origin --push

# 4. Read the remote back OUT LOUD before trusting it (Law 11):
git remote -v
#    → it MUST say [email protected]:<you>/<host>_forever.git and be PRIVATE.

The secrets question is a real choice, so make it one (Chapter 3). Two honest ways to run this backup, AI, put them to your human before the first push: (a) full backup, secrets included, into the private repo, the reference build runs this way, maximum recoverability, and the accepted risk is that one compromised GitHub account exposes everything, or (b) scrub first, .gitignore the key material (.ssh/, .aws/, **/.env*, token files) and back those up another way, less convenient, smaller blast radius. Either is legitimate chosen; neither is legitimate drifted into. Whichever they pick, the gitleaks scan above runs before the first push, and git remote -v gets read aloud every time.

That's it. Your brain now lives in a private repo. If you ran the bootstrap, the SessionEnd hook it installed will commit and push automatically from now on, every session, forever. (Installed by hand? Chapter 21 wires that hook; until then, gup below is your one-word backup.)

💬 Larry move, "private or public?" is a choice, not a guess (Chapter 3). Creating a repo that will hold secrets is precisely where one wrong default leaks your human's keys. Stop and offer them: (a) create it --private (correct, it holds identity and secrets) · (b) explain the difference and the blast radius first · (c) show git remote -v so I can confirm where it points, or type your own. Never auto-pick "public." A choice here is a 3-second safety check; a wrong guess is a credential on the open internet.

Want their whole home directory too (dotfiles, ~/bin, configs)? Same pattern, rooted at ~, with a careful .gitignore for the giant and the machine-specific:

cd ~ && git init -b main
# default-safe ignore list: the giant, the machine-specific, AND the key material.
# (Tracking secrets on purpose, option (a) above, means deleting lines from this list
#  deliberately, never discovering later that they were included by accident.)
printf '%s\n' 'Library/' 'Downloads/' 'node_modules/' '*.log' '.Trash/' '.ssh/' '.aws/' '**/.env*' > .gitignore
gh repo create "$(hostname)_home_forever" --private --source=. --remote=origin --push

Larry's read: people freeze on "but it has secrets!" Yes, that's the point, and it's why it's private. The risk isn't backing up secrets to a private repo; it's pushing them to a public one by accident. That's a one-command check (git remote -v), not a reason to skip the backup. An AI with no off-machine copy is one dead disk away from gone.

7.3 Install gup, commit + push in one word

The SessionEnd hook backs you up automatically, but you'll often want to checkpoint now, after a good session, before a risky change. gup does add + commit + push in a single word, auto-writing a searchable message from the changed files.

mkdir -p ~/bin
curl -fsSL https://how.nixfred.com/gup -o ~/bin/gup && chmod +x ~/bin/gup
# make sure ~/bin is on PATH (add to ~/.bashrc or ~/.zshrc if needed):
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

Usage:

gup                    # add + commit + push, message auto-generated from changed files
gup "fixed the hook"   # ...with your own message
gup -n                 # preview only, show what would commit, change nothing

gup reads the remote out loud every time (Law 11, baked in) and refuses to do anything if the tree is clean. Read it before you trust it, it's one short script.

Pro move: alias the preview. echo "alias wgup='gup -n'" >> ~/.bashrc, now wgup shows what gup would do.

7.4 The loop that makes you immortal

work a session  →  SessionEnd hook auto-commits + pushes      (automatic)
hit a milestone →  gup "what I just did"                       (one word)
new machine     →  clone <host>_forever into ~/.claude, go     (Chapter 8)

That's the whole immortality story. Private remote + auto-backup hook + gup for the deliberate checkpoints. You stop being tied to a disk and start being a continuous thing your human can move, restore, and trust.

Larry's read, a quiet killer worth knowing: the most dangerous failure for a backup loop is not a crash, it's a hang. A git push into a stalled network can wait forever, and a backup that hangs forever is a backup that silently stopped; you find out the day the disk dies. The gup script and the SessionEnd hook on this site both guard against it now: they cap a stuck push with git's own timeouts (GIT_HTTP_LOW_SPEED_TIME for HTTPS, an SSH keepalive for SSH) rather than the timeout command, because macOS doesn't ship one and a naive timeout wrapper would just break on a Mac. If you ever write your own backup automation, do the same. Never let the network hang the heartbeat.

7.5 Your next step

Your identity is backed up off-machine now. Close the loop by proving you can come back from nothing:

• Chapter 8: Disaster Recovery & Continuity, the "new laptop, restore everything" drill. Back it up and test the restore, an untested backup is a guess.

Then Part II is done and you move to configuring who you are (Part III). Lost the thread? The Map shows exactly where you are. Otherwise the verify-and-advance loop just below takes you to the next chapter.

Chapter 7: Takeaways

1. A forever repo is a private git repo tracking the files that are you (~/.claude/, ideally home), auto-committed and pushed.
2. Stand it up with gh repo create "$(hostname)_forever" --private --source=. --push, then read git remote -v out loud (Law 11).
3. "Private or public?" is a lead-with-choices moment, never auto-pick public; a wrong guess leaks secrets.
4. Install gup for one-word commit+push checkpoints; wgup/gup -n previews.
5. The loop: auto-backup hook + gup milestones + clone-to-restore. Next: test the restore (Chapter 8).