Archetypes/Profiles repo split #18
Labels
No labels
blocked
bug
decision
duplicate
enhancement
help wanted
invalid
landed?
question
ready-to-merge
stale
wontfix
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
allod/strategy#18
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
So that every piece of configuration lives in the one repo meant to own it — and nothing operator-private can end up in the public framework — I want the framework repo, the example machine configs, and the secrets template split so that reusable behavior, machine definitions, and identity data each have exactly one owning repo.
Tracking issue for the Archetypes/Profiles repo split. Full plan:
dev-plans/archetypes-profiles-split.mdin this repo.Summary
Rename the framework repo
allod/profiles→allod/archetypes(archetype merge, builders, shared modules,vmFacts, checks); move machine profile definitions into a dedicated public example repoallod/profileswith fresh history (redirectable by a deploy flake to an operator's own definitions repo); return thesecretstemplate to identity-only exports; and adapt the publicallod/deploytemplate to the split, with a generic composed-layer canary so a deploy flake fails loudly when itsprofilesredirect is lost.Sequencing
The load-bearing constraint is the Forgejo rename redirect cliff: the old
allod/profilesURL keeps serving the renamed repo until a new repo claims that name (at M1), which kills the redirect permanently. Order: M0 rename → G1 pre-cliff re-points + operator gate → M1 new repo → M2 seam flip → M3/M4 → M5 sweep. Transitional states are harmless by construction — nothing consumes the new repo until M2 locks it, and the secrets template exports dead attrs only between M2 and M4.PRs and human operations
Human forge operations (human-only): M0 rename, M1 repo creation + settings, all PR merges. One operator confirmation gate (G1) before M1. Every PR carries
Refs allod/strategy#<this issue>; the final sweep PR (M5c,allod/memory) carriesCloses allod/strategy#<this issue>.allod/profiles→allod/archetypeson the forge; confirm redirect serves; do not create the replacement repo in the same sessionallod/deploy— re-pointprofiles.urltoallod/archetypesat same rev (URL-only; input name staysprofilesuntil M3)allod/inventory— framework checkout / cold-clone repo lists →allod/archetypes; regenvm-specs.jsonallod/nexus—DEPLOY_FLAKEdefaults +/template/profilessentinel + rotation lock-bump steps →allod/deploycheckoutallod/profilesredirectallod/profilesrepo — permanently ends the redirect; requires G1 completeallod/profilesexample definitions repo (fresh history, agent PR)allod/archetypesseam flip — addprofilesinput, source definitions/profileData/preferences only from it, delete in-tree definitions andsecrets/inventoryreads, exportprofilesSource/composeProfileDefinitions/composedLayerCheckallod/deployadaptation — rename framework inputprofiles→archetypes, addprofilesdefinitions input + follows-redirects, add composed-layer canary + sabotage fixturesallod/secretscleanup — removelib.profileDefinitions,lib.profileData,homeModules.preferences,modules/preferences.nixallod/inventory— add new definitions checkout, final registry cleanup,vm-specs.jsonregenallod/nexus— remaining non-cliff prose/tests (only if needed)allod/memory— topic-file updates; carriesClosesRisk
Residual risk R3 High overall — cross-repo interfaces and sequencing, a rename with an irreversible redirect cliff, and provisioning-adjacent pointer changes. Per-milestone risk and human-scrutiny notes are in the dev plan's Risk Assessment table.
Closing as complete — every milestone landed:
allod/archetypescarries the framework;allod/profilesis the fresh-history example definitions repo (hosts/dev/allod-dev);allod/deploycomposes separatearchetypesandprofilesinputs;allod/secretsexports noprofileDefinitions,profileData, orpreferences— the identity-only charter is restored; the inventory registry listsallod/archetypesandallod/profilesas distinct checkouts; and theallod/memorytopic-file sweep landed. The final sweep's cross-repoClosesdid not fire, which is the only reason this stayed open. (Agent token cannot close an issue it did not author — operator: please close as completed.)