M4: return the secrets template to identity-only exports #9

Merged

vnprc merged 1 commit from agent/secrets-drop-behavior-exports into master

2026-07-17 22:55:14 +01:00

allod-agent commented

2026-07-17 22:48:18 +01:00

Member

Part of the archetypes/profiles repo split — Refs allod/strategy#18. This is M4: returning the secrets template to identity-only exports. Depends on M2 being merged (the framework no longer reads these exports).

Changes:

Remove lib.profileDefinitions, lib.profileData, and homeModules.preferences from flake.nix, and delete modules/preferences.nix (which moved to the allod/profiles definitions repo at M1). With the last homeModules gone, the flake now exports only lib and checks.
README: drop the removed exports from the ownership list, exported-outputs table, and layout; and — since post-split the framework that pins and consumes secrets is archetypes, not profiles (a profiles definitions repo never imports secrets) — correct the stale framework references (ownership list, "How … consumes it", related repos). These bare-profiles references would not be caught by M5's allod/profiles grep, so they are fixed here in the same file.

Identity, credentials, host keys, git policy, and every other secrets export are untouched — only the misplaced behavior exports leave.

Risk

R1 Low — removes exports the framework stopped reading at M2; straight revert restores dead-but-harmless attrs. Only meaningful to revert if M2 were also reverted (revert M4 before M2 in that case so the restored framework reads find their attrs).

Validation

git grep -nE 'profileDefinitions|profileData|preferences'   # empty (zero readers/definers left in secrets)
nix flake check                                             # template checks green (external-ssh-trust-targets, credential-inventory)

Merged framework green against the cleaned template, no lock commit — run in an archetypes checkout (post-M2 master):

nix flake check --override-input secrets "git+https://forge.anarch.diy/allod/secrets.git?rev=f1d875f…"   # 8 checks green

This proves M2 truly removed every read of the behavior exports: archetypes composes the whole example fleet with a secrets that no longer provides profileDefinitions/profileData/preferences.

Part of the archetypes/profiles repo split — `Refs allod/strategy#18`. This is **M4**: returning the `secrets` template to identity-only exports. Depends on M2 being merged (the framework no longer reads these exports). Changes: - Remove `lib.profileDefinitions`, `lib.profileData`, and `homeModules.preferences` from `flake.nix`, and delete `modules/preferences.nix` (which moved to the `allod/profiles` definitions repo at M1). With the last `homeModules` gone, the flake now exports only `lib` and `checks`. - README: drop the removed exports from the ownership list, exported-outputs table, and layout; and — since post-split the framework that pins and consumes `secrets` is `archetypes`, not `profiles` (a profiles definitions repo never imports `secrets`) — correct the stale framework references (ownership list, "How … consumes it", related repos). These bare-`profiles` references would not be caught by M5's `allod/profiles` grep, so they are fixed here in the same file. Identity, credentials, host keys, git policy, and every other `secrets` export are untouched — only the misplaced behavior exports leave. ## Risk R1 Low — removes exports the framework stopped reading at M2; straight revert restores dead-but-harmless attrs. Only meaningful to revert if M2 were also reverted (revert M4 before M2 in that case so the restored framework reads find their attrs). ## Validation ``` git grep -nE 'profileDefinitions|profileData|preferences' # empty (zero readers/definers left in secrets) nix flake check # template checks green (external-ssh-trust-targets, credential-inventory) ``` Merged framework green against the cleaned template, no lock commit — run in an `archetypes` checkout (post-M2 master): ``` nix flake check --override-input secrets "git+https://forge.anarch.diy/allod/secrets.git?rev=f1d875f…" # 8 checks green ``` This proves M2 truly removed every read of the behavior exports: `archetypes` composes the whole example fleet with a `secrets` that no longer provides `profileDefinitions`/`profileData`/`preferences`.

allod-agent added 1 commit

2026-07-17 22:48:18 +01:00

Return the secrets template to identity-only exports f1d875fec0

Remove the behavior exports the framework no longer reads after the archetypes
seam flip (M2): lib.profileDefinitions, lib.profileData, homeModules.preferences,
and modules/preferences.nix (which moved to the profiles definitions repo).
Correct the README to name archetypes as the framework that pins and consumes
this flake, and profiles as the machine-definitions repo.