M2: flip the profiles seam to source definitions from the profiles input #10

Merged

vnprc merged 1 commit from agent/archetypes-seam-flip into master

2026-07-17 22:32:40 +01:00

allod-agent commented

2026-07-17 22:27:18 +01:00

Member

Part of the archetypes/profiles repo split — Refs allod/strategy#18. This is M2: the seam flip that makes the framework source machine profile definitions, per-machine profileData, and the preferences module solely from the new profiles input (locked at the merged M1 rev 8e0b9a0), instead of its own in-tree hosts/ tree plus the secrets/inventory layers.

Changes:

Add the profiles input (follows nixpkgs); source definitions/profileData/preferences only from it. Every other input rev in flake.lock is untouched, so the parity comparison below is meaningful.
Delete outright, no or {} residue (stale layouts now fail loud at eval): publicProfileDefinitions, the secrets.lib.profileDefinitions / inventory.lib.profileDefinitions layer reads, the secrets.lib.profileData read (→ profiles.lib.profileData.<name> or {}; the or {} on the machine key stays), and the mkDevVm default preferencesModule ? / mkHypervisor hardcoded secrets.homeModules.preferences (→ the profiles module).
Replace the three-layer mergeProfileDefinitionLayers with the exported two-argument lib.composeProfileDefinitions { base, overlay } (override-collision rule kept; the old secrets-vs-inventory duplicate check retires with the dual sub-layers). Lift the unknown-archetype computation into an injectable unknownArchetypesOf helper — the subtractLists direction is unchanged (reversing it would silently stop rejecting unknown archetypes).
Export profilesSource (top-level) and lib.composedLayerCheck { pkgs, expectedProfiles } — the generic composed-layer canary the deploy template builds at M3 — plus a happy-path composed-layer-smoke check here.
Relocate hosts/dev/home-shared.nix (shared dev-archetype behavior, framework not example) to modules/dev-home-shared.nix; the moved hosts/dev/allod-dev/* and dropped hosts/service/.gitkeep empty the hosts/ tree.
Rewrite README.md (name, ownership, exports, --override-input History note).

Unchanged surfaces: vmFacts, nixosConfigurations naming, builder semantics beyond the re-homed reads, the archetype set, the installer, and every identity/credential read from secrets.

Risk

R3 High — the composition path for every machine changes; a wrong merge or default re-homing would silently change composed systems. Mitigated by full-fleet drvPath parity plus the existing check suite, and by removing the old reads entirely (no defaulted fallback to mask a regression). Rollback is a plain git revert (the PR touched only the profiles lock node additively — no lock surgery needed); the new profiles repo goes dormant but stays valid.

Validation

Fleet drvPath parity — byte-identical before/after (module content moving between store paths is invisible to the drv; the parity run proves no path leaked into config):

allod-dev  /nix/store/gqn6c8akwlxqii75qs2lff2y0v8r19yg-…-allod-dev-…drv
privacy-1  /nix/store/zzzaralwv032jdmbqc1q6ms9fm15w7yf-…-privacy-1-…drv
nexus      /nix/store/i80hx8m8cmlkdlh9ykn5izbk6mb0vh5w-…-nexus-…drv
installer  /nix/store/2yj5038jnsgzbv6ghhmyafs5kspn9jrg-…-nixos-…drv

nix flake check                        # 8 checks green (incl. rewritten profile-definition-contracts + new composed-layer-smoke)
git grep -nE 'secrets\.(lib\.profile|homeModules)' flake.nix   # empty
git grep -n 'inventory.lib.profileDefinitions'                 # empty
git grep -n 'publicProfileDefinitions'                         # empty
git grep -n 'mergeProfileDefinitionLayers'                     # empty
test ! -e hosts                                                # hosts/ gone
nix build .#checks.x86_64-linux.profile-definition-contracts   # green
jq -r '.nodes.profiles.locked.rev' flake.lock                  # 8e0b9a0… (only node added)

Contract check proven fail-loud: the sabotage sub-cases (overlay/base collision without override; missing selection; unknown archetype) are asserted to fail inside the check. Reversing the unknownArchetypesOf subtraction makes nix build .#checks.x86_64-linux.profile-definition-contracts exit 1 with unknownArchetypesOf did not flag the unsupported archetype (subtraction direction wrong?) — the guard's failure path is demonstrable.

Part of the archetypes/profiles repo split — `Refs allod/strategy#18`. This is **M2**: the seam flip that makes the framework source machine profile definitions, per-machine `profileData`, and the `preferences` module solely from the new `profiles` input (locked at the merged M1 rev `8e0b9a0`), instead of its own in-tree `hosts/` tree plus the `secrets`/`inventory` layers. Changes: - **Add the `profiles` input** (follows `nixpkgs`); source definitions/`profileData`/`preferences` only from it. Every other input rev in `flake.lock` is untouched, so the parity comparison below is meaningful. - **Delete outright, no `or {}` residue** (stale layouts now fail loud at eval): `publicProfileDefinitions`, the `secrets.lib.profileDefinitions` / `inventory.lib.profileDefinitions` layer reads, the `secrets.lib.profileData` read (→ `profiles.lib.profileData.<name> or {}`; the `or {}` on the *machine key* stays), and the `mkDevVm` default `preferencesModule ?` / `mkHypervisor` hardcoded `secrets.homeModules.preferences` (→ the `profiles` module). - **Replace** the three-layer `mergeProfileDefinitionLayers` with the exported two-argument `lib.composeProfileDefinitions { base, overlay }` (override-collision rule kept; the old secrets-vs-inventory duplicate check retires with the dual sub-layers). **Lift** the unknown-archetype computation into an injectable `unknownArchetypesOf` helper — the `subtractLists` direction is unchanged (reversing it would silently stop rejecting unknown archetypes). - **Export** `profilesSource` (top-level) and `lib.composedLayerCheck { pkgs, expectedProfiles }` — the generic composed-layer canary the deploy template builds at M3 — plus a happy-path `composed-layer-smoke` check here. - **Relocate** `hosts/dev/home-shared.nix` (shared dev-archetype behavior, framework not example) to `modules/dev-home-shared.nix`; the moved `hosts/dev/allod-dev/*` and dropped `hosts/service/.gitkeep` empty the `hosts/` tree. - **Rewrite** `README.md` (name, ownership, exports, `--override-input` History note). Unchanged surfaces: `vmFacts`, `nixosConfigurations` naming, builder semantics beyond the re-homed reads, the archetype set, the installer, and every identity/credential read from `secrets`. ## Risk R3 High — the composition path for every machine changes; a wrong merge or default re-homing would silently change composed systems. Mitigated by full-fleet drvPath parity plus the existing check suite, and by removing the old reads entirely (no defaulted fallback to mask a regression). Rollback is a plain `git revert` (the PR touched only the `profiles` lock node additively — no lock surgery needed); the new `profiles` repo goes dormant but stays valid. ## Validation **Fleet drvPath parity — byte-identical before/after** (module content moving between store paths is invisible to the drv; the parity run proves no path leaked into config): ``` allod-dev /nix/store/gqn6c8akwlxqii75qs2lff2y0v8r19yg-…-allod-dev-…drv privacy-1 /nix/store/zzzaralwv032jdmbqc1q6ms9fm15w7yf-…-privacy-1-…drv nexus /nix/store/i80hx8m8cmlkdlh9ykn5izbk6mb0vh5w-…-nexus-…drv installer /nix/store/2yj5038jnsgzbv6ghhmyafs5kspn9jrg-…-nixos-…drv ``` ``` nix flake check # 8 checks green (incl. rewritten profile-definition-contracts + new composed-layer-smoke) git grep -nE 'secrets\.(lib\.profile|homeModules)' flake.nix # empty git grep -n 'inventory.lib.profileDefinitions' # empty git grep -n 'publicProfileDefinitions' # empty git grep -n 'mergeProfileDefinitionLayers' # empty test ! -e hosts # hosts/ gone nix build .#checks.x86_64-linux.profile-definition-contracts # green jq -r '.nodes.profiles.locked.rev' flake.lock # 8e0b9a0… (only node added) ``` **Contract check proven fail-loud:** the sabotage sub-cases (overlay/base collision without override; missing selection; unknown archetype) are asserted to fail inside the check. Reversing the `unknownArchetypesOf` subtraction makes `nix build .#checks.x86_64-linux.profile-definition-contracts` exit 1 with `unknownArchetypesOf did not flag the unsupported archetype (subtraction direction wrong?)` — the guard's failure path is demonstrable.

allod-agent added 1 commit

2026-07-17 22:27:18 +01:00

Flip the profiles seam: source definitions from the profiles input 0ebda69f92

Add the profiles input and source profile definitions, per-machine profileData,
and the preferences module only from it. Delete the in-tree publicProfileDefinitions,
the relocated hosts/ example definitions, and the secrets/inventory definition
reads. Replace the three-layer merge with the exported two-argument
composeProfileDefinitions, lift the unknown-archetype guard into an injectable
helper (direction unchanged), and export profilesSource plus composedLayerCheck
(the generic composed-layer canary) with a happy-path smoke check. Relocate the
dev-archetype workspace home module to modules/dev-home-shared.nix. Rewrite the
README for the archetypes framework.