Drop the forge SSH block; silence the neovim provider default warnings #10

Merged

vnprc merged 1 commit from agent/drop-forge-ssh-copy into master

2026-09-20 04:24:27 +01:00

allod-agent commented

2026-09-20 02:23:18 +01:00

Member

The allod-dev profile stops defining its own copy of the forge SSH host block, because the framework now renders that block for every dev VM from the VM's own identity record (allod/archetypes#81). Separately, neovim no longer bundles its Ruby and Python providers, which is the Home Manager 26.05 default and which nothing in this profile uses; the two warnings about that default stop. With the framework change in place the rendered ~/.ssh/config on allod-dev is byte-identical with and without this deletion. Landing order for a deploy lock: take the framework change first or together with this; a lock that takes this deletion while its archetypes pin still predates the framework change leaves allod-dev with the address book's forge block, keyed to the hypervisor's key it does not hold, until the archetypes pin catches up. The deploy repo's evaluation does not fail in that state, so the order is a human check. If it is wrong, revert this PR. This replaces the closed allod/profiles#9.

What changes

hosts/dev/allod-dev/home.nix: the programs.ssh.matchBlocks forge block is deleted and the now-unused identity and runtimeIdentity arguments dropped.
modules/preferences.nix: programs.neovim.withRuby = false and withPython3 = false, set explicitly because home.stateVersion predates the new default. home.stateVersion is unchanged.

Risk

R2: two files, render pinned byte-for-byte below; the integration uncertainty is the lock ordering above, which evaluates cleanly in both orders and only bites functionally in one. Rollback is a revert.

Validation

Run by the integrator at fa37849:

nix flake check in this repo passes (worker run).
Deploy template with --override-input archetypes <allod/archetypes#81 branch> --override-input profiles <this branch>: allod-dev's rendered ~/.ssh/config is byte-identical to the render with the framework branch alone (the single forge block, IdentityFile ~/.ssh/allod_vm), and the neovim default warnings and the matchBlocks warning attributed to this file are gone; allod-dev, nexus and privacy-1 evaluate to their toplevel derivations with no evaluation warnings.

Cold cross-family review: gpt-5.6-sol via codex exec, reasoning effort xhigh, read this diff together with the allod/archetypes#81 and allod/secrets#33 diffs for allod/strategy#56 (Claude-family workers authored all three). One finding touched this change, marked blocker: the framework's claim that the two changes may enter a deploy lock in either order is true of evaluation only, and the profiles-first order leaves a dev VM with the hypervisor's forge key. Confirmed by tracing; it is the landing-order constraint at the top of this body and a corrected comment in the framework module, not a code change here.

Refs allod/strategy#56

The `allod-dev` profile stops defining its own copy of the forge SSH host block, because the framework now renders that block for every dev VM from the VM's own identity record (allod/archetypes#81). Separately, neovim no longer bundles its Ruby and Python providers, which is the Home Manager 26.05 default and which nothing in this profile uses; the two warnings about that default stop. With the framework change in place the rendered `~/.ssh/config` on `allod-dev` is byte-identical with and without this deletion. Landing order for a deploy lock: take the framework change first or together with this; a lock that takes this deletion while its archetypes pin still predates the framework change leaves `allod-dev` with the address book's forge block, keyed to the hypervisor's key it does not hold, until the archetypes pin catches up. The deploy repo's evaluation does not fail in that state, so the order is a human check. If it is wrong, revert this PR. This replaces the closed allod/profiles#9. ## What changes - `hosts/dev/allod-dev/home.nix`: the `programs.ssh.matchBlocks` forge block is deleted and the now-unused `identity` and `runtimeIdentity` arguments dropped. - `modules/preferences.nix`: `programs.neovim.withRuby = false` and `withPython3 = false`, set explicitly because `home.stateVersion` predates the new default. `home.stateVersion` is unchanged. ## Risk R2: two files, render pinned byte-for-byte below; the integration uncertainty is the lock ordering above, which evaluates cleanly in both orders and only bites functionally in one. Rollback is a revert. ## Validation Run by the integrator at fa37849: - `nix flake check` in this repo passes (worker run). - Deploy template with `--override-input archetypes <allod/archetypes#81 branch> --override-input profiles <this branch>`: `allod-dev`'s rendered `~/.ssh/config` is byte-identical to the render with the framework branch alone (the single forge block, `IdentityFile ~/.ssh/allod_vm`), and the neovim default warnings and the `matchBlocks` warning attributed to this file are gone; `allod-dev`, `nexus` and `privacy-1` evaluate to their toplevel derivations with no evaluation warnings. Cold cross-family review: `gpt-5.6-sol` via `codex exec`, reasoning effort `xhigh`, read this diff together with the allod/archetypes#81 and allod/secrets#33 diffs for allod/strategy#56 (Claude-family workers authored all three). One finding touched this change, marked blocker: the framework's claim that the two changes may enter a deploy lock in either order is true of evaluation only, and the profiles-first order leaves a dev VM with the hypervisor's forge key. Confirmed by tracing; it is the landing-order constraint at the top of this body and a corrected comment in the framework module, not a code change here. Refs allod/strategy#56

allod-agent added 1 commit

2026-09-20 02:23:18 +01:00

Delete the forge SSH block and silence neovim provider warnings fa3784942f

The forge host entry now renders from the VM's own identity record in
allod/archetypes, so this profile's copy becomes a second author of the
same block. Drop it, along with the identity and runtimeIdentity module
args it was the only user of.

Home Manager 26.05 changed withRuby and withPython3 defaults from true
to false and warns on every build while home.stateVersion predates the
change. Set both explicitly; nothing here needs those providers.

Refs allod/strategy#56

allod-agent referenced this pull request from allod/archetypes

2026-09-20 02:29:54 +01:00

Render each machine's SSH client config from its own identity record #81

allod-agent referenced this pull request from allod/secrets

2026-09-20 02:30:17 +01:00

Template sshHosts entries carry localForwards and extraOptions #33

allod-agent referenced this pull request from allod/strategy

2026-09-20 02:30:18 +01:00

Each machine derives its SSH client config from its own identity record #56