The repo documents its own build and test commands, but assumes Windows and
PowerShell. This captures only the deltas that make them run on this machine:
dotnet from nixpkgs, artifactory credentials sourced per command because shell
state does not persist between tool calls, and a curl check that distinguishes
an auth failure from a code failure, since a rejected token surfaces as a
NuGet error that reads like a network fault.
Also records the two Docker Desktop leftovers that break the component test
environment, and the unleash registration a component test canary needs.
gcx stores its OAuth access and refresh tokens in the system keychain
unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...`
handles -- and exposes no plaintext fallback. With nothing owning
org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates
against Grafana and then dies writing its config: "The name is not activatable".
Add services.headlessSecretService: gnome-keyring as a systemd --user service,
unlocking the login keyring at start. home-manager's own services.gnome-keyring
does not fit here on two counts -- it is WantedBy graphical-session-pre.target,
which never activates without a desktop session, and it passes no --unlock, so
writes would block on a GUI prompter that does not exist.
Only the secrets component is started. The ssh component is deliberately off: it
would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and
signed commits.
The unlock password defaults to a random one generated on first activation under
$XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an
agenix secret instead, once that lands.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
treefmt runs prettier over markdown in this repository and the CI
formatting check failed on the two preceding commits. Prettier prefers
underscores for emphasis and requires blank lines around fenced code
blocks.
No wording changes.
The previous commit required a ticket scope on every commit in every
repository. This repository has no Jira project, so the rule as written
would either block a commit or invite a fabricated WSP number.
Record the exception: in personal repositories the scope is the area of
the change (claude, deps, hosts) and conventional form still applies.
The ticket requirement is scoped to the Jira-backed work repositories
that enforce it in CI.
The git conventions memory said to match the repository's existing log
style. Several repositories (multicluster, core-services-cloud) have
histories dominated by bare "WSP-1234: summary" subjects, so matching
them produced commits that were not in conventional form. A related
failure was scope decay within a session: the first commit was correct
and later ones degraded to bare "test:" or "refactor:" subjects. Both
required commit history to be rebased by hand.
- Make "<type>(<TICKET-ID>): <summary>" mandatory on every commit and
explicitly override repository log style. Style matching now applies
to branch names only.
- Describe how to establish the real ticket ID (named in the request,
extracted from the branch, or taken from existing commits on the
branch) and require asking rather than guessing when none is
available. Replace the literal WSP-1234 examples with <TICKET-ID> so
the placeholder cannot be committed verbatim.
- Record scope decay across a session as a named failure mode.
- Cover merge commits, preferring rebase and requiring an explicit
message when a merge commit is unavoidable.
- Add a pre-push verification grep that must return no output.
- Note that a clean git log does not prove a subject was correct when
written, because rebasing replaces it; compare author and committer
dates instead.
Update the MEMORY.md index entry to match.
VS Code on macOS resolves the shell environment at startup by running an
interactive login shell with stdout piped and no controlling terminal.
The order-200 auto-tmux block treated that probe as a normal interactive
shell and ran `exec tmux new-session`, which fails without a tty ("open
terminal failed: not a terminal") and exits non-zero. VS Code then reports
"Unable to resolve your shell environment: Unexpected exit code from
spawned shell (code 1)".
Gate the exec on a real terminal (-t 1) and skip it when
VSCODE_RESOLVING_ENVIRONMENT is set. Real terminals still land in tmux;
the integrated terminal was already exempt via TERM_PROGRAM.
Add two memories and correct one existing, from a review of PR comments
across multicluster and unified-helm over the past two months:
- code_comment_style: no Jira/ticket IDs in code comments by default,
keep comments concise and about the non-obvious why, and use # (not
Helm template) comments where they must reach the rendered manifest.
- copilot_review_false_positives: verify Copilot blocking claims against
the spec and live config before acting; records two Terraform FPs.
- workflow_review_and_comments: drop the now-contradicted 'one-liner +
WSP ticket reference' guidance, which reviewers repeatedly strip.
The code.emmathe.dev key is now loaded in the ssh-agent, so git push works with sandbox off and PRs are raised via the tea CLI. Correct the git-network-ops memory that said Gitea always needs hand-off; keep hand-off as the fallback only if the key drops from the agent.
The gpg.ssh.allowedSignersFile error and %G?=N mean git cannot verify locally, not that the commit is unsigned. Add how to confirm via gpgsig header and how to enable local verification.
Record WSP project field map: issue-type IDs, the six required Bug fields with their allowed values/option IDs and JSON shapes, the Task shortcut that avoids them, and platform-relevant component IDs. Cross-links jira-tooling.
Persist the state of the Psion Workabout MX reverse-engineering / barcode-inventory project so it can be resumed in a future session after a reboot.
Adds `home/claude/memory/sibo_workabout_mx_scanner.md` (project memory) and indexes it in `MEMORY.md`. Records: the repo/branch and committed docs, the confirmed scanner behaviour, the key finding that the scanner is an OO library object driven via p_getlibh/p_newsend/p_send, the blocker (on-device ordinal capture), the RE toolchain, and where the continuation procedure lives.
Takes effect after a home-manager rebuild.
Reviewed-on: #60
Record that any nixpkgs tool can be run on the fly via nix run / nix
shell, so a missing command during development is not a dead end. Takes
effect after a home-manager rebuild.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
Follow-up cleanups from the post-refactor audit (issues #50–#53). All behaviour-preserving except the work-host changes (kube-tmux + Lens removal).
## Changes
- **#51** `refactor(ssh)` — move `services.openssh.enable` + `firewall.allowedTCPPorts = [ 22 ]` into `modules/ssh.nix`; drop the duplicated lines from T400, MacPro31, RPi5.
- **#50** `fix/feat(work)` — load kube-tmux from a pinned `flake = false` input (it is not in nixpkgs) and reference `${inputs.kube-tmux}/kube.tmux` directly, so the status line no longer depends on a manual `$HOME/code/kube-tmux` checkout. (Supersedes the interim file-existence guard.)
- **#52** `chore` — gitignore the untracked `tf-inspect/` scratch project.
- **#53** `chore` — remove the unused Lens package entirely (`pkgs.lens` + its unfree entry; `unfreePackages` is now just `claude-code`), fix the `nil`→`nil_ls` LSP doc, remove the redundant `.editorconfig` block, name the RPi5 Docker subnet in a `let` binding.
## Deferred (from #53, noted in the commit)
- `.gitignore` firmware entry — documented behaviour, low value, left as-is.
- Per-eval `nixpkgs-unstable` overlay import — inherently per-system; no clean single-import hoist.
## Verification
- `nix flake check` passes (treefmt, deadnix, statix, pre-commit, all hosts + Darwin + homeConfigurations).
- Derivation-path diff vs `main`: `lyrathorpe-mbp`, `lyrathorpe-t400`, `lyrathorpe-macpro31`, `lyrathorpe-rpi5` are byte-identical (confirms #51 and the subnet `let` binding change nothing). Only `emmathorpe-edaas` differs — the kube-tmux input (#50) and the Lens removal (#53).
Closes#50, #51, #52, #53.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #54
## Summary
Separates user identity (data) from the reusable Nix modules and lets a host declare any number of users, replacing the previous one-user-per-host structure. Also restructures the tree and exposes the home config for use off these hosts.
## Changes
- **User registry** (`users/registry.nix`): per-user identity (name, email, groups, authorized + signing keys) as the single source of truth; no user data hardcoded in modules.
- **Multi-user `mkHost`**: a host declares a `users` set keyed by username; per-user identity is injected into each home config via the `identity` module arg.
- **Restructured layout**: `users/`, `home/`, `modules/`, `hosts/`, `lib/` replace the former `lyrathorpe/` and `system/` trees.
- **Portable outputs**: standalone `homeConfigurations."<user>@<system>"` (the portable subset — shell, git, editor, claude) plus an exported `homeModules` for use on machines not managed by this flake, or as an input to other flakes.
- Docs (`README.md`, `home/README.md`) and `.gitignore` updated for the new paths.
## Fixes
- Closes#46 — shared user module authorized one user's SSH key for every account.
- Closes#47 — git committer identity hardcoded as defaults instead of per-user.
- Closes#48 — EDaaS systemd linger hardcoded to a literal username.
## Verification
- `nix flake check` passes: treefmt, deadnix, statix, pre-commit, and evaluation of all NixOS hosts + Darwin + homeConfigurations.
- Derivation-path comparison vs `main`: `lyrathorpe-mbp` and `emmathorpe-edaas` are byte-identical; `lyrathorpe-t400`, `lyrathorpe-macpro31` and `lyrathorpe-rpi5` differ only by de-duplicating a repeated `authorized_keys` entry (confirmed with nix-diff — no other change).
- Standalone `homeConfigurations."lyrathorpe@x86_64-linux".activationPackage` builds.
## Notes
- `emmathorpe` has no personal authorized key yet (it previously inherited Lyra's key via the bug in #46); the registry entry is intentionally empty — add a real key if SSH login as `emmathorpe` is wanted (moot on the WSL host).
- A two-repo (public dotfiles / private systems) split is deferred by design; this internal restructure is the prerequisite for it.
---------
Co-authored-by: Emma Thorpe <emma.thorpe@citrix.com>
Reviewed-on: #49
Emma Thorpe
lyrathorpe