From 0c121a6cdf69f57001d8ace5e0bb88178d9bff3e Mon Sep 17 00:00:00 2001 From: Jelle Spreeuwenberg Date: Sat, 5 Sep 2026 19:30:58 +0200 Subject: [PATCH] declare Garden tooling and workbench --- docs/plans/workflow-system.md | 28 ++++++++++++++++++++++++---- modules/capabilities/dev-tools.nix | 30 ++++++++++++++++++++++++++++++ modules/capabilities/shell.nix | 11 +---------- 3 files changed, 55 insertions(+), 14 deletions(-) diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index caead7f..802d993 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -13,9 +13,9 @@ and add no abstraction without a demonstrated repeated need. - Branch: `chore/workflow-system` - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only the existing dirty-tree and unknown `modules` output warnings were emitted. -- Next: prove the common contract in `rules-service`, `yookr-api`, and - `traceability-data-model`; the service pilots are checkpointed, so preserve - and reconcile the schema repository's existing WIP next. +- Next: activate the Nix-owned Garden tools on Zenith and run the credentialed + `just k8s test` workbench gate over the VPN. Then prove named database + connections and one Marimo-to-HTML report before expanding the workbench. ## Progress @@ -23,7 +23,7 @@ and add no abstraction without a demonstrated repeated need. | --- | --- | --- | | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains | | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider | -| Repository contracts and workbench | Active | Service contracts checkpointed; API empirical gates and schema pilot remain | +| Repository contracts and workbench | Active | Three contracts and the local workbench are checkpointed; credentialed empirical gates remain | | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes | | Conditional retirement and completion | Pending | Requires per-pilot evidence | @@ -36,6 +36,8 @@ and add no abstraction without a demonstrated repeated need. | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter | | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract | | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract | +| `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract | +| `yookr-workbench` | `main` | `6aae6d5` | Create the local-only cross-system workbench | ## Human actions @@ -53,6 +55,11 @@ and add no abstraction without a demonstrated repeated need. `just openapi-refresh test`; the current test deployment returns 404. - Populate the ignored API HTTP credentials and perform the planned login plus harmless administrator read; no credential-bearing request has been made. +- Activate the Nix-owned Garden tools, verify `gardenctl` and `gardenlogin`, + then remove their duplicate binaries from `~/.garden` and `~/.local/bin`. +- With the VPN active, run `just k8s test` in `yookr-workbench` and confirm the + test shoot opens read-only; this credentialed interactive gate has not been + run automatically. - Destructive cleanup, credentials, activation, and empirical pilot decisions will be surfaced here before use. @@ -103,4 +110,17 @@ and add no abstraction without a demonstrated repeated need. through both anonymous HTTPS and the working SSH identity. The test service is reachable, but its currently deployed GET image returns 404 for the full OpenAPI route already present in local source and ingress configuration. +- `traceability-data-model` preserves the existing domain/schema redesign while + replacing automatic schema recreation with explicit `just reset`. Ordinary + `just dev` retains its Compose volumes, and the flake check loads fixtures in + text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the + pinned `podman-compose` configuration validation pass. +- Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release + assets; the hashes match the existing binaries byte-for-byte. All three host + builds pass, the OIDC kubectl plugin is declarative, and Zsh now consumes the + native `gardenctl rc zsh` output. +- The local-only `yookr-workbench` has no remote and initially owns only + `just k8s test`. Each invocation creates an isolated Garden session, rejects + every environment except test, and opens K9s read-only. Its flake check and + command catalog pass, and the live rejection path exits before Garden access. - Run independent pilots in parallel, but gate every retirement separately. diff --git a/modules/capabilities/dev-tools.nix b/modules/capabilities/dev-tools.nix index 1b04c4e..3653011 100644 --- a/modules/capabilities/dev-tools.nix +++ b/modules/capabilities/dev-tools.nix @@ -2,6 +2,33 @@ { flake.modules.homeManager.dev-tools = { config, pkgs, ... }: + let + gardenctl = pkgs.stdenvNoCC.mkDerivation { + pname = "gardenctl"; + version = "2.14.0"; + src = pkgs.fetchurl { + url = "https://github.com/gardener/gardenctl-v2/releases/download/v2.14.0/gardenctl_v2_linux_amd64"; + hash = "sha256-JCZ0eJLgYbd2ZMCCWFlhX4vOhHKZL40oR2a3EZ3i4Q8="; + }; + dontUnpack = true; + installPhase = '' + install -Dm755 "$src" "$out/bin/gardenctl" + ''; + }; + gardenlogin = pkgs.stdenvNoCC.mkDerivation { + pname = "gardenlogin"; + version = "0.10.0"; + src = pkgs.fetchurl { + url = "https://github.com/gardener/gardenlogin/releases/download/v0.10.0/gardenlogin_linux_amd64"; + hash = "sha256-X4nHiZ29Mbnhxv/wlyD6PxX1KxzaX2R27N7Muu/gnH8="; + }; + dontUnpack = true; + installPhase = '' + install -Dm755 "$src" "$out/bin/gardenlogin" + ln -s gardenlogin "$out/bin/kubectl-gardenlogin" + ''; + }; + in { home.sessionVariables.CARGO_HOME = "${config.xdg.dataHome}/cargo"; home.packages = with pkgs; [ @@ -11,11 +38,14 @@ posting resterm kubectl + kubelogin-oidc mongodb-compass scc nodejs mariadb just + gardenctl + gardenlogin ]; programs.lazygit = { diff --git a/modules/capabilities/shell.nix b/modules/capabilities/shell.nix index 71c37f5..050fc63 100644 --- a/modules/capabilities/shell.nix +++ b/modules/capabilities/shell.nix @@ -7,10 +7,6 @@ pkgs, ... }: - let - gardenctl = "${config.home.homeDirectory}/.garden/gardenctl"; - uuidgen = lib.getExe' pkgs.util-linux "uuidgen"; - in { home.sessionVariables = { STARSHIP_CACHE = "${config.xdg.cacheHome}/starship"; @@ -66,12 +62,7 @@ ''; initContent = '' - source <(${gardenctl} completion zsh) - if [ -z "$GCTL_SESSION_ID" ] && [ -z "$TERM_SESSION_ID" ]; then - export GCTL_SESSION_ID=$(${uuidgen}) - fi - - eval $(${gardenctl} kubectl-env zsh) + source <(gardenctl rc zsh) bindkey -v