Merge pull request 'docs(memory): record that Entra group member reads hide service principals' (#106 ) from docs/memory-entra-group-member-reads into main

Reviewed-on: #106
docs(memory): record that Entra group member reads hide service principals
2026-08-28 11:35:21 +01:00 · 2026-08-28 11:33:33 +01:00 · 2026-08-26 20:48:37 +01:00 · 2026-08-26 20:41:05 +01:00 · 2026-08-26 20:41:05 +01:00 · 2026-08-26 20:41:05 +01:00
11 changed files with 164 additions and 46 deletions
@@ -186,6 +186,14 @@ fleet's stock "wheel, with a password" policy. What it does **not** implement:
 host aliases, LDAP/SSSD sudoers, `sudoreplay`, and most `Defaults` settings.
 Needing any of those means reverting to `security.sudo`.

+One exception to the password: the EDaaS box sets
+`security.sudo-rs.wheelNeedsPassword = false`. NixOS-WSL ships that default for
+`security.sudo` — WSL has no console login, so the trust boundary is the Windows
+session and the Linux account password is never one the user chose — and the
+option does not carry across to the `security.sudo-rs` module, which defaults to
+requiring one. Without the explicit setting, `sudo` on that host prompts for a
+password nobody knows.
+
 If a host ever refuses to escalate, get a root shell that does not go through
 sudo (`wsl -u root -d NixOS` on the work box; the console or a serial/HDMI login
 elsewhere) and roll back with `nixos-rebuild switch --rollback`, or pick the
@@ -350,10 +358,10 @@ Claude to route new memories there.
 ## Per-host differences

 |                             | Personal Linux (sway) | macOS                 | Work WSL (EDaaS)             |
-| --------------------------- | --------------------- | --------------------- | --------------------------- |
+| --------------------------- | --------------------- | --------------------- | ---------------------------- |
 | Auto-tmux                   | yes (foot/TTY)        | yes (iTerm2)          | yes (WSL shell)              |
 | `kubectl` → kubecolor       | no (no kubectl)       | no                    | yes (work module)            |
-| `sudo` implementation       | sudo-rs               | Apple sudo + Touch ID | sudo-rs                     |
+| `sudo` implementation       | sudo-rs (password)    | Apple sudo + Touch ID | sudo-rs (passwordless wheel) |
 | git email                   | `iam@emmathe.dev`     | `iam@emmathe.dev`     | `…@citrix.com` (work)        |
 | ssh config managed          | yes                   | yes                   | no (keeps corporate config)  |
 | ssh-agent                   | yes                   | launchd               | yes (work module)            |
@@ -3,16 +3,16 @@
    "brew-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1786348930,
-        "narHash": "sha256-bCQJkbgsAMDp5HQystZLCq11UHiyEuoWbxKulAPYrh8=",
+        "lastModified": 1786945682,
+        "narHash": "sha256-VBESSoJccikdhxh3vp3SQeG7cZXTOulMvVkoSqNDEhs=",
        "owner": "Homebrew",
        "repo": "brew",
-        "rev": "3ecc9eff23feebf1bc73846d74e14a122c93b66f",
+        "rev": "5b90e281d4e0c8fbd6ca4d8358276fb305b8d0bd",
        "type": "github"
      },
      "original": {
        "owner": "Homebrew",
-        "ref": "6.0.16",
+        "ref": "6.0.18",
        "repo": "brew",
        "type": "github"
      }
@@ -25,11 +25,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1786853140,
-        "narHash": "sha256-O880FlUav75Q5aNlg9znyg/avf1X/W7o/cAtZFLtpWc=",
+        "lastModified": 1787457768,
+        "narHash": "sha256-cbgeu5NTb6DtB+tNs4E6z6K/1XKKM90gVmlkWMJe+gY=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "ba9568c9c0df6290dc2f34b032ab4cb575e73788",
+        "rev": "25cfc8fdc413d73b3a47e3e86dafcad51cf5c9f9",
        "type": "gitlab"
      },
      "original": {
@@ -135,11 +135,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784288435,
-        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "lastModified": 1787424939,
+        "narHash": "sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh+7CBnbCYsk=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "rev": "809414f0cdadf82cf11b06c2b29ba9b3168b3297",
        "type": "github"
      },
      "original": {
@@ -155,11 +155,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786924861,
-        "narHash": "sha256-hftabkb+73OcGzvwFAjCiQorAhprs9TnU1+FkGO5CIw=",
+        "lastModified": 1787377438,
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "09ae1b85a6db412d841d60f924b23f881f0d0a38",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
        "type": "github"
      },
      "original": {
@@ -211,11 +211,11 @@
        "brew-src": "brew-src"
      },
      "locked": {
-        "lastModified": 1786686423,
-        "narHash": "sha256-8q3WdB8o3VUI7rOz1OXfioXIaaWbFTAxRJAkWLlfc0s=",
+        "lastModified": 1787330919,
+        "narHash": "sha256-LslMncqN7uOOH5S88WZtO/EVt2HwD8ltUnfyANk+mC0=",
        "owner": "zhaofengli",
        "repo": "nix-homebrew",
-        "rev": "ccabf79a6b9845eb72b51ea1d9c7ce3446350df3",
+        "rev": "b00218e4aec0e5bf07d61a0bb13f842faa582d7b",
        "type": "github"
      },
      "original": {
@@ -231,11 +231,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786852476,
-        "narHash": "sha256-IM5CYtf86W4w8eUPpKcY/LpdHElmVBtJhaKnoTKxZEA=",
+        "lastModified": 1787457452,
+        "narHash": "sha256-FJh4esFS3zqNNuKwvN3t6wrJGewqp1AUF9DAEvoKPD8=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "c7962dc97b45129df8d751bedaf37beb5a17706e",
+        "rev": "c51d5c2ba69c907a34e90c9b6b80cd2b93811745",
        "type": "github"
      },
      "original": {
@@ -272,11 +272,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1786867632,
-        "narHash": "sha256-ez+ubZlA1RtdjCB18a6zJ9M4u8qoPDy08EcnsW5M3Xw=",
+        "lastModified": 1787144466,
+        "narHash": "sha256-HHfv2/HkNSKbbSyU9iD/g8lbP6r4tl33sSw1W4rXCk0=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "ff17823245ab9ff7bcae6acf950bd89cba82c38c",
+        "rev": "0471accf8d0a8210b31d947497d179ecc99e0021",
        "type": "github"
      },
      "original": {
@@ -308,11 +308,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1786711500,
-        "narHash": "sha256-QvnceIGTBeDvDd9oCn+GvdsnkquliuwbVgpiRH68qaQ=",
+        "lastModified": 1787414105,
+        "narHash": "sha256-WncT27+3BOkgTaJZLnCsf3LcYf9RXMuR9ONSN4rzQ7s=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "02e08985a27c65ffd33d434eeb2e660a2e4dc84d",
+        "rev": "a9e6d84f9c2f9012f5fe7d964a7851352300e61a",
        "type": "github"
      },
      "original": {
@@ -324,11 +324,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1786862985,
-        "narHash": "sha256-FBJRXmbGXiSUDvYEbfLYRkckayyZ6SK1UEqhCrIZ2Cs=",
+        "lastModified": 1787360063,
+        "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e5bdc4a41d4c072fe1e3787eaa0320a384741d44",
+        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
        "type": "github"
      },
      "original": {
@@ -347,11 +347,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1786873773,
-        "narHash": "sha256-Hj/nkhKDv0aJly1PAUstrhrgEYn1mVSkLIYMh90r/Pc=",
+        "lastModified": 1787536726,
+        "narHash": "sha256-aBh5Yk9tX8ZV4k10BJr2fvTq0/+iWGegaCMUOU7YKas=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "b397fb9f6950d57355d62bb92457d223464e0115",
+        "rev": "e2c3f9f36326d07340626847543c557e2b95fb50",
        "type": "github"
      },
      "original": {
@@ -15,3 +15,5 @@
 - [Dev clusters disposable](dev_clusters_disposable.md) — Lyra's dev clusters are recreatable; mutate/break freely, no confirmation needed
 - [Nix shell tooling](nix_shell_tooling.md) — any nixpkgs tool runs ad hoc via `nix run`/`nix shell nixpkgs#<pkg>`; a missing command is never a dead end
 - [WSP local build and test](wsp_local_build_and_test.md) — core-services-cloud on this box: dotnet via nix, artifactory creds from `~/.artifactoryenv` sourced per command, how to tell auth failure from a code failure
+- [WSP-32957 PIM migration](wsp_32957_pim_migration.md) — AKS RBAC to PIM + AutoPerm decommission; prod is in the Technical Preview subscription, three tenants; resume via `~/code/WSP-32957-CONTINUATION.md`
+- [Entra group member reads](entra_group_member_reads.md) — `az ad group member list` hides service principal members; use the servicePrincipal cast or transitiveMemberOf, and trust the Terraform plan over it
@@ -0,0 +1,28 @@
+---
+name: entra-group-member-reads
+description: az ad group member list and Graph /members silently omit service principal members — use the servicePrincipal cast or transitiveMemberOf when a group is expected to hold an SPN.
+metadata:
+  node_type: memory
+  type: reference
+---
+
+`az ad group member list --group <id>` and `GET /groups/{id}/members` both return an **empty collection**, with no error, for a group whose only members are service principals — at least when called with Lyra's user account. The read looks authoritative and is not.
+
+**Reliable reads instead:**
+
+```sh
+# members, cast to the type that is being hidden
+az rest --method get --url "https://graph.microsoft.com/v1.0/groups/<gid>/members/microsoft.graph.servicePrincipal?\$select=id,displayName"
+
+# count, which does not filter
+az rest --method get --url "https://graph.microsoft.com/v1.0/groups/<gid>/members/\$count" --headers ConsistencyLevel=eventual
+
+# from the principal's side
+az rest --method get --url "https://graph.microsoft.com/v1.0/servicePrincipals/<spid>/transitiveMemberOf?\$select=id,displayName"
+az rest --method post --url "https://graph.microsoft.com/v1.0/servicePrincipals/<spid>/checkMemberGroups" \
+  --body '{"groupIds":["<gid>"]}' --headers "Content-Type=application/json"
+```
+
+**How to apply:** any group that deployment or automation identities belong to — `*-cluster-admins`, `*-keyvault`, anything created by `rg-prereqs` — must be checked with one of the above before concluding it is empty. Cross-check against Terraform: a plan reporting "No changes" against a `members` attribute is strong evidence the membership is present, and outranks the `az` read. On 2026-08-28 the plain read produced a Bug (WSP-33432, cancelled) claiming five `*-cluster-admins` groups across three tenants had been emptied; all five held their deployment principals the whole time.
+
+Related: [[wsp-32957-pim-migration]].
@@ -9,7 +9,9 @@ Field map for the **WSP (Workspace Platform)** Jira project, to create tickets w

 **Issue-type IDs:** Epic `10000`, Story `10004`, Task `10008`, Bug `10123`, Sub-task `10009`.

-**Fast path — use Task, not Bug.** A `Task` requires only `summary` (project/issuetype auto, reporter defaults to caller). A `Bug` requires six extra fields (below), so only pick Bug when it must be a Bug. The sibling infra/remediation tickets in WSP are Tasks.
+**Fast path — use Task, not Bug.** A `Task` requires `summary` plus **Task Type** `customfield_15622` (added since this note was first written; the create validator enforces it even though `createmeta` omits it, same trap as Bug's `versions`). Options value=id: Dev Task=34065, CQE Task=34066, Investigation=34067, Security=34068, Maintenance=34069, Release=34070 — use `Maintenance` for refactors and tidy-ups, `Dev Task` for feature work. A `Bug` requires six extra fields (below), so only pick Bug when it must be a Bug. The sibling infra/remediation tickets in WSP are Tasks.
+
+Example Task `additional_fields`: `{"customfield_15622":{"id":"34069"},"components":[{"name":"Multicluster Platform"}]}`

 **Bug required fields** (enforced by the create validator; note `createmeta` omits `versions` but the API rejects without it):

@@ -0,0 +1,58 @@
+---
+name: wsp-32957-pim-migration
+description: State of the WSP AKS-RBAC-to-PIM migration and AutoPerm decommission, and how to resume it
+metadata:
+  node_type: memory
+  type: project
+---
+
+Long-running epic (August 2026) moving WSP's AKS cluster RBAC off **AutoPerm
+Manager**-maintained `wsp-*` groups onto the per-subscription **`CEO-*` Azure PIM**
+groups, then retiring AutoPerm. Epic **WSP-32957**; on the critical path for Zensar
+L1 on-call (WSP-32193). Work happens in **`~/code/multicluster`**
+(`terraform/cluster`, `terraform/cluster-k8s-resources`, `products/*/environments/*`).
+
+**Resume from `~/code/WSP-32957-CONTINUATION.md`** — full state, branch list,
+verified object IDs, findings and next steps. Jira is the durable record; that file
+is the index. Keep it updated as work lands ([[docs-keep-updated]]).
+
+**Landed:** WSP-33141 (multicluster PR #1808, merged `b047163c`) added object-ID
+inputs — `admin_group_oids` on `cluster`, and `cluster_user_group_oids` /
+`cluster_viewer_group_oids` / `cluster_superuser_group_oids` on
+`cluster-k8s-resources`. Supplying IDs _replaces_ the display-name lookup and leaves
+the `data "azuread_group"` unread, which is what will let the legacy groups be
+deleted. Nothing sets them yet, so behaviour is unchanged. Repoint branches for test
+(WSP-33067) and staging (WSP-33068) are pushed but have **no PR** — both gated on
+decisions, not code.
+
+**Facts that cost real effort to establish, do not re-derive:**
+
+- **Production runs in `fc7af6ae-…` (_Workspace Platform Technical Preview_), not
+  `d6d75d07-…` (_Workspace Platform Production_)**, which holds no clusters. The
+  epic was wrong about this for its whole life and every production `CEO-*` group
+  name and object ID had to change. Because `CEO-*` names embed the subscription
+  name, **always re-verify object IDs against live Entra rather than trusting the
+  epic table.**
+- **Three tenants**, not two: `6f4fe054` (prod, prod JP), `335836de` (staging,
+  staging JP, test), `3eae2746` (dev). Each `wsp-*` name is a distinct object in
+  each tenant.
+- `wsp-staging-cluster-admins` and `wsp-test-cluster-admins` are **empty**, so
+  `wsp-owner` is the _only_ path to `cluster-admin` in staging. Never drop it before
+  `SuperAdmin-*` is proven — hence the staging branch is split into an additive
+  commit and a cutover commit.
+- **No break-glass exists**: `disableLocalAccounts = True` on every cluster; only the
+  deployment SPNs authenticate non-interactively.
+- Graph **PIM-for-Groups is unreadable via `az`** (the CLI's first-party client lacks
+  `PrivilegedAccess.Read.AzureADGroup`, on both `v1.0` and `beta`). Use the portal or
+  `Connect-MgGraph -Scopes PrivilegedAccess.Read.AzureADGroup`.
+
+**Watch for:** the epic gets rewritten by James Weldrake between sessions — re-read
+the description before acting, and check which child tickets are still live
+(WSP-33062/33063/33064/33066 were cancelled 2026-08-24, and dev was put out of
+scope). Verified findings have repeatedly contradicted the epic text
+([[copilot-review-false-positives]] is the same instinct: check against reality
+first).
+
+Queued Slack messages and the leaver report live as `~/code/*.txt` alongside the
+continuation file; see the table in it for what has and has not been sent
+([[workflow-review-and-comments]] — show them before they go out).
@@ -287,7 +287,22 @@ in
    plugins = with pkgs.tmuxPlugins; [
      sensible
      vim-tmux-navigator # Ctrl-h/j/k/l across vim splits and tmux panes
-      yank
+      {
+        # On WSL, tmux-yank pipes the selection to clip.exe, which decodes its
+        # stdin as the OEM codepage instead of UTF-8 -- an em dash reaches the
+        # Windows clipboard as three characters. Route through tmux's own
+        # buffer instead: with set-clipboard on, tmux emits OSC 52 and the
+        # terminal takes the text as UTF-8. Windows Terminal honours OSC 52;
+        # iTerm2 does not by default, hence the runtime guard rather than
+        # overriding pbcopy/xsel on every host. yank.tmux bakes the command
+        # into its key bindings when it loads, so this must be set first, which
+        # is what plugin extraConfig gives us.
+        plugin = yank;
+        extraConfig = ''
+          if-shell 'grep -qi microsoft /proc/version 2>/dev/null' \
+            "set -g @override_copy_command 'tmux load-buffer -w -'"
+        '';
+      }
      extrakto # prefix+Tab: fzf-grab paths/URLs/text from the pane into the prompt
      {
        # Catppuccin Mocha statusline (v2 API: flavour + window options must be
@@ -60,6 +60,11 @@
  ## patch the script
  systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';

+  # NixOS-WSL's passwordless wheel default only covers `security.sudo`; the
+  # sudo-rs swap in common-nixos.nix needs it set again. No console login here,
+  # and no account password anyone knows.
+  security.sudo-rs.wheelNeedsPassword = false;
+
  features.swayDesktop.enable = false;

  # NOTE: this user's systemd --user lingering -- so the home-manager renovate
@@ -17,7 +17,7 @@

  # Headless server: the Sway desktop is intentionally not set up. modules/sway.nix is
  # not imported and features.swayDesktop.enable defaults to false (declared in
-  # system/modules/features.nix), so this host keeps plain TTY/SSH login.
+  # modules/features.nix), so this host keeps plain TTY/SSH login.

  # Raspberry Pi boots via U-Boot + extlinux, not GRUB/systemd-boot. The
  # raspberry-pi-5 nixos-hardware profile supplies the kernel, firmware and
@@ -12,7 +12,7 @@ let
 in
 {
  # The features.swayDesktop.enable option is declared in
-  # system/modules/features.nix (so headless hosts can read/set it without
+  # modules/features.nix (so headless hosts can read/set it without
  # importing this module). This module only provides its implementation.
  config = lib.mkIf cfg.enable {
    programs.sway = {
@@ -29,10 +29,10 @@
    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
  ) hostUsers;

-  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
+  programs.firefox = lib.mkIf config.features.swayDesktop.enable {
    enable = true;
  };
-  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
+  programs.thunderbird = lib.mkIf config.features.swayDesktop.enable {
    enable = true;
  };
 }
Author	SHA1	Message	Date
lyrathorpe	684d3f5a75	Merge pull request 'docs(memory): record that Entra group member reads hide service principals' (#106 ) from docs/memory-entra-group-member-reads into main CI / flake (push) Successful in 4m5s Details Reviewed-on: #106	2026-08-28 11:35:21 +01:00
Emma Thorpe	99fca0f746	docs(memory): record that Entra group member reads hide service principals CI / flake (push) Skipped CI / flake (pull_request) Successful in 1m3s Details az ad group member list and GET /groups/{id}/members return an empty collection, without error, for groups whose members are service principals. Records the reads that do work and the rule to trust a Terraform plan over that output.	2026-08-28 11:33:33 +01:00
lyrathorpe	9b1e2fb447	Merge pull request 'chore(nix): statix bool_comparison + stale-path comment fixes' (#58 ) from chore/nix-cleanup into main CI / flake (push) Successful in 5m13s Details Reviewed-on: #58	2026-08-26 20:48:37 +01:00
lyrathorpe	9d2379bb3e	docs(rpi5): fix stale features.nix path in comment CI / flake (push) Skipped CI / flake (pull_request) Successful in 7m19s Details	2026-08-26 20:41:05 +01:00
lyrathorpe	7a650dc7cc	docs(sway): fix stale features.nix path in comment	2026-08-26 20:41:05 +01:00
lyrathorpe	bb613ac803	refactor(users): drop redundant == true (statix bool_comparison)	2026-08-26 20:41:05 +01:00
lyrathorpe	47362090c3	Merge pull request 'docs(memory): record the Task Type field now required on WSP tickets' (#105 ) from docs/memory-jira-task-type into main CI / flake (push) Successful in 4m8s Details Reviewed-on: #105	2026-08-25 14:33:03 +01:00
Emma Thorpe	8c5773447e	docs(memory): record the Task Type field now required on WSP tickets CI / flake (push) Skipped CI / flake (pull_request) Successful in 57s Details Creating a WSP Task now fails with "Task Type is required to create a Task issue". The field is customfield_15622 and the create validator enforces it even though createmeta does not list it as required - the same trap the note already records for Bug's versions field.	2026-08-25 14:25:24 +01:00
lyrathorpe	ae44982c65	Merge pull request 'docs(memory): record the WSP-32957 PIM migration project state' (#104 ) from docs/memory-wsp-32957-pim-migration into main CI / flake (push) Successful in 4m44s Details Reviewed-on: #104	2026-08-24 17:54:09 +01:00
Emma Thorpe	c82c1bef9c	docs(memory): record the WSP-32957 PIM migration project state CI / flake (push) Skipped CI / flake (pull_request) Successful in 1m35s Details Long-running epic spanning multiple sessions, with several findings that were expensive to establish and that contradict the Jira epic text — most notably that production runs in the subscription named "Workspace Platform Technical Preview", not the one named "Production". Points at ~/code/WSP-32957-CONTINUATION.md for the detail rather than carrying it here, following the pattern used for the SIBO project.	2026-08-24 17:51:38 +01:00
lyrathorpe	39b2b1d24b	Merge pull request 'fix(tmux): stop clip.exe mangling non-ASCII in the WSL clipboard' (#103 ) from fix/tmux-clipboard-utf8 into main CI / flake (push) Successful in 5m47s Details Reviewed-on: #103	2026-08-24 13:36:15 +01:00
lyrathorpe	0022a152e3	Merge pull request 'fix(edaas): restore passwordless wheel under sudo-rs' (#102 ) from fix/edaas-passwordless-sudo-rs into main CI / flake (push) Successful in 7m44s Details Reviewed-on: #102	2026-08-24 13:29:39 +01:00
Emma Thorpe	d9db12c4a5	fix(tmux): stop clip.exe mangling non-ASCII in the WSL clipboard CI / flake (push) Skipped CI / flake (pull_request) Successful in 7m8s Details tmux-yank autodetects WSL and pipes the selection to clip.exe, which decodes its stdin as the console OEM codepage rather than UTF-8. Copying an em dash out of a pane put "ΓÇö" on the Windows clipboard; the same applies to every non-ASCII character. Override the copy command to route through tmux's own buffer. With set-clipboard on, that emits OSC 52 and the terminal receives UTF-8 directly, with no Windows-side helper in the path. Windows Terminal honours OSC 52; verified against the running client. Guarded on /proc/version so only WSL is affected. iTerm2 does not accept OSC 52 by default, so the Darwin hosts keep pbcopy. Set in the plugin's extraConfig rather than the shared block because yank.tmux bakes the copy command into its key bindings at load time, and home-manager emits plugin extraConfig before the run-shell.	2026-08-24 13:26:21 +01:00
Emma Thorpe	4ac9d1108b	docs(shell): record the EDaaS passwordless-wheel exception CI / flake (push) Skipped CI / flake (pull_request) Successful in 4m10s Details The sudo-rs section claimed the whole fleet runs the stock "wheel, with a password" policy, which is no longer true for the WSL host. Explain why the NixOS-WSL default does not survive the sudo-rs swap, and mark the difference in the per-host table.	2026-08-24 11:16:15 +01:00
Emma Thorpe	0c151943de	fix(edaas): restore passwordless wheel under sudo-rs NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option belongs to the `security.sudo` module and does not carry over to the sudo-rs swap in modules/common-nixos.nix, whose equivalent option defaults to true. Since that swap landed, sudo on this host prompts for the account password -- which WSL set during install and nobody knows -- so escalation only worked through `wsl -u root`. Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt.	2026-08-24 11:16:12 +01:00
renovate-bot	dcb8a5e66a	Merge pull request 'chore(deps): lock file maintenance flake inputs' (#101 ) from renovate/lock-file-maintenance-flake-inputs into main CI / flake (push) Successful in 6m6s Details	2026-08-24 03:10:24 +01:00
Renovate Bot	bdb21a6d50	chore(deps): lock file maintenance flake inputs CI / flake (push) Skipped renovate/stability-days Updates have not met minimum release age requirement Details CI / flake (pull_request) Successful in 7m14s Details	2026-08-24 02:02:49 +00:00
renovate-bot	1da34d6232	Merge pull request 'chore(deps): lock file maintenance flake inputs' (#100 ) from renovate/lock-file-maintenance-flake-inputs into main CI / flake (push) Successful in 4m53s Details	2026-08-24 00:07:42 +01:00
Renovate Bot	19e0b7f13f	chore(deps): lock file maintenance flake inputs CI / flake (push) Skipped renovate/stability-days Updates have not met minimum release age requirement Details CI / flake (pull_request) Successful in 4m53s Details	2026-08-23 23:02:35 +00:00