M1: populate profiles example definitions repo #1

Merged

vnprc merged 1 commit from agent/populate-profiles into master

2026-07-17 22:11:09 +01:00

allod-agent commented

2026-07-17 22:03:22 +01:00

Member

Part of the archetypes/profiles repo split — Refs allod/strategy#18. This is M1: populating the new allod/profiles example-definitions repo (fresh history; the empty repo was created by the operator after the G1 redirect-cliff gate).

This repo becomes the single owner of machine profile definitions. It exports the profiles input contract (Interface Contract 1) that the archetypes framework will consume at M2, and that an operator's own definitions repo reproduces:

lib.profileDefinitions = { <archetype> = { <name> = { override?; nixosModules?; homeModules?; }; }; };
lib.profileData = { };                       # optional per-machine builder overrides
homeModules.preferences = <home-manager module>;

Contents:

flake.nix — the contract exported as a literal attrset (same explicitness as the framework's former in-tree publicProfileDefinitions, no directory-derived magic): dev.allod-dev with its module lists, privacy.privacy-1 and hypervisor.nexus as empty definitions, profileData = {}, and homeModules.preferences. Plus a nixpkgs-only shape check.
hosts/dev/allod-dev/{configuration,home}.nix — moved verbatim from the framework hosts/ tree. (hosts/dev/home-shared.nix is framework behavior and stays in archetypes — it relocates to modules/ in M2, not here. hosts/service/.gitkeep is dropped, not moved.)
modules/preferences.nix — moved verbatim from the secrets template (M4 removes it there).
Repo hygiene: LICENSE (GPL-3.0-or-later, from allod/deploy, in the initial bootstrap commit), README.md (per-profile ownership statement + History note), .gitignore, hooks/commit-msg, setup.sh.

The flake takes no inputs beyond nixpkgs and must never grow inputs on secrets or inventory — definitions reference behavior, not identity or machine facts. Archetype-name validity stays asserted by archetypes (the fact's owner); this flake's check validates only its export structure and field types.

Nothing consumes this repo yet — archetypes locks it as its profiles input at M2.

Risk

R2 Medium — an additive fresh repo nobody composes with until M2. The sequencing risk (creating the repo kills the rename redirect) was the operator's G1 gate and is already discharged. Fresh history carries no framework commits.

Validation

nix flake check                                        # profile-contract-shape green (exit 0)
nix eval .#lib.profileDefinitions --json | jq 'keys'   # ["dev","hypervisor","privacy"]
nix eval .#lib.profileData --json                      # {}
nix eval .#homeModules.preferences --apply builtins.typeOf   # "lambda"
jq -r '.nodes|keys|join(", ")' flake.lock              # nixpkgs, root  (no secrets/inventory)
git log --oneline | wc -l                              # 2 — fresh history (LICENSE bootstrap + this)

The shape check was proven fail-loud: sabotaging a definition field to a non-list (homeModules = "…") makes nix flake check exit 1 with profile contract shape errors: profileDefinitions.dev.allod-dev.homeModules is not a list.

Part of the archetypes/profiles repo split — `Refs allod/strategy#18`. This is **M1**: populating the new `allod/profiles` example-definitions repo (fresh history; the empty repo was created by the operator after the G1 redirect-cliff gate). This repo becomes the single owner of machine profile *definitions*. It exports the `profiles` input contract (Interface Contract 1) that the `archetypes` framework will consume at M2, and that an operator's own definitions repo reproduces: ```nix lib.profileDefinitions = { <archetype> = { <name> = { override?; nixosModules?; homeModules?; }; }; }; lib.profileData = { }; # optional per-machine builder overrides homeModules.preferences = <home-manager module>; ``` Contents: - `flake.nix` — the contract exported as a **literal attrset** (same explicitness as the framework's former in-tree `publicProfileDefinitions`, no directory-derived magic): `dev.allod-dev` with its module lists, `privacy.privacy-1` and `hypervisor.nexus` as empty definitions, `profileData = {}`, and `homeModules.preferences`. Plus a `nixpkgs`-only shape check. - `hosts/dev/allod-dev/{configuration,home}.nix` — moved verbatim from the framework `hosts/` tree. (`hosts/dev/home-shared.nix` is framework behavior and stays in `archetypes` — it relocates to `modules/` in M2, not here. `hosts/service/.gitkeep` is dropped, not moved.) - `modules/preferences.nix` — moved verbatim from the `secrets` template (M4 removes it there). - Repo hygiene: `LICENSE` (GPL-3.0-or-later, from `allod/deploy`, in the initial bootstrap commit), `README.md` (per-profile ownership statement + History note), `.gitignore`, `hooks/commit-msg`, `setup.sh`. The flake takes **no inputs beyond `nixpkgs`** and must never grow inputs on `secrets` or `inventory` — definitions reference behavior, not identity or machine facts. Archetype-name validity stays asserted by `archetypes` (the fact's owner); this flake's check validates only its export structure and field types. Nothing consumes this repo yet — `archetypes` locks it as its `profiles` input at M2. ## Risk R2 Medium — an additive fresh repo nobody composes with until M2. The sequencing risk (creating the repo kills the rename redirect) was the operator's G1 gate and is already discharged. Fresh history carries no framework commits. ## Validation ``` nix flake check # profile-contract-shape green (exit 0) nix eval .#lib.profileDefinitions --json | jq 'keys' # ["dev","hypervisor","privacy"] nix eval .#lib.profileData --json # {} nix eval .#homeModules.preferences --apply builtins.typeOf # "lambda" jq -r '.nodes|keys|join(", ")' flake.lock # nixpkgs, root (no secrets/inventory) git log --oneline | wc -l # 2 — fresh history (LICENSE bootstrap + this) ``` The shape check was proven fail-loud: sabotaging a definition field to a non-list (`homeModules = "…"`) makes `nix flake check` exit 1 with `profile contract shape errors: profileDefinitions.dev.allod-dev.homeModules is not a list`.

allod-agent added 1 commit

2026-07-17 22:03:22 +01:00

Populate example machine profile definitions 8e0b9a0a2f

Add the profiles input contract flake exporting lib.profileDefinitions and
lib.profileData as a literal attrset plus homeModules.preferences, the allod-dev
dev-profile module files (moved from the framework hosts/ tree), the preferences
Home Manager module (moved from the secrets template), a nixpkgs-only shape
check, and repo hygiene (README, .gitignore, hooks/commit-msg, setup.sh).