9 Commits

Include renames

Author	SHA1	Message	Date
autonomic-bot	be4f451d3a	fix(flake): make Hetzner the canonical cc-ci host target	2026-06-01 13:57:45 +00:00
autonomic-botandClaude Sonnet 4.6	4237cc03f5	nix: add cc-ci-hetzner host (cpx32, nixos-infect hardware, all root SSH keys) ... Port from terraform-hetzner branch. Adds the Hetzner cc-ci flake host with all 3 root authorized keys so nixos-rebuild doesn't lock out SSH access. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-31 03:00:36 +00:00
autonomic-botandClaude Opus 4.7	433ec9de30	refactor(1b): RL5 — consolidate Nix code under nix/ (modules->nix/modules, hosts->nix/hosts) ... flake.nix/flake.lock STAY at root so the build ref #cc-ci is unchanged; only flake's internal configuration.nix path updated. Root-relative refs inside moved modules re-based ../X -> ../../X (secrets/bridge/dashboard); configuration.nix's ../../modules imports unchanged (both dirs under nix/). Living docs (README, architecture/install/secrets/enroll) + .drone.yml comment updated to nix/...; append-only history logs left as-is. DECISIONS.md records RL5 + the deferred-coordinated RL6. Verified on cc-ci: nixos-rebuild build 'path:#cc-ci' -> toplevel 8i3jcad9 (BYTE-IDENTICAL to the pre-move build — store derivations are content-addressed on file contents, module .nix not in the runtime closure); scripts/lint.sh -> lint: PASS. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 21:19:09 +01:00
autonomic-botandClaude Opus 4.7	2cede01ed7	style(1b): auto-format + lint-clean the whole codebase (RL1) ... Mechanical, semantics-preserving cleanup so the codebase passes the new lint stage: - ruff format: all 32 Python files (wraps long signatures, normalizes quotes/blank lines). - nixpkgs-fmt: modules/drone-runner.nix. - shfmt (-i 2 -ci): scripts/*.sh. Lint fixes (reviewed, behavior-preserving — no test weakened): - ruff SIM105: try/except-pass -> contextlib.suppress (abra.py app_config rm; lifecycle.py janitor). - ruff SIM115: open().read() -> with open() (run_recipe_ci.py redaction-values + gitea-token). - statix: merge repeated sops `secrets.*` keys into one `secrets = { ... }` (comments kept); empty fn pattern `{ ... }:` -> `_:` (packages.nix). - deadnix: drop unused lambda args (flake `self`; configuration.nix `lib`; overlay `final` -> `_`). Verified on cc-ci: `scripts/lint.sh` -> lint: PASS; nixosConfigurations.cc-ci evaluates; all Python byte-compiles. The deployed bridge/dashboard/runner source changes hash (reformat), so cc-ci will be rebuilt to the new closure in W2 before the cold D1-D10 re-verification. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 20:52:05 +01:00
autonomic-bot	a0ea2f0aa9	fix(1b): merge devShells.${system} into one attr (dynamic-attr collision)	2026-05-27 20:43:48 +01:00
autonomic-bot	07952c0383	fix(1b): remove duplicate nixosConfigurations.cc-ci in flake (broke eval)	2026-05-27 20:43:17 +01:00
autonomic-bot	1de0885e2d	feat(1b): add lint/format toolchain — lint devshell + scripts/lint.sh + ruff/yamllint config	2026-05-27 20:40:50 +01:00
autonomic-botandClaude Opus 4.7	deb4a0fbed	M0 complete: sops-nix wiring + decrypt-a-test-secret; M0 gate CLAIMED ... Host decrypts /run/secrets/test_secret via its ssh host key (age identity); off-box master recovery recipient. sops-nix pinned to a buildGoModule-era rev for nixpkgs 24.11 compat. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 21:41:45 +01:00
autonomic-botandClaude Opus 4.7	9bffb55b28	M0: flake + base NixOS config, rebuilt from repo on cc-ci ... Pins nixpkgs to the rev cc-ci already ran (no-op-then-base); deploy via switch --flake on-host. System healthy (gen 3) post-switch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 21:25:48 +01:00