docs: update HANDOFF.md — age-native redesign progress (tasks 1–7 complete)
This commit is contained in:
Joseph O'Brien
68
HANDOFF.md
68
HANDOFF.md
@@ -1,9 +1,11 @@
|
||||
# HANDOFF.md
|
||||
|
||||
State of the `notfiles` repo as of 2026-03-31.
|
||||
State of the `notfiles` repo as of 2026-04-01.
|
||||
|
||||
## What Was Done
|
||||
|
||||
### Previous session (2026-03-31)
|
||||
|
||||
Restructured from a flat `src/` layout into a Cargo workspace of 5 crates:
|
||||
- `notcore` — shared library (types, config, paths, errors)
|
||||
- `notfiles` — dotfiles linker, migrated from `src/`
|
||||
@@ -11,27 +13,61 @@ Restructured from a flat `src/` layout into a Cargo workspace of 5 crates:
|
||||
- `nothooks` — Nushell hook runner with phase/state tracking
|
||||
- `notstrap` — new-machine bootstrap orchestrator
|
||||
|
||||
39 tests passing, 0 clippy warnings. Committed to `main`, not yet pushed to `gitea/main`.
|
||||
### This session (2026-04-01)
|
||||
|
||||
## Pending Issues
|
||||
Began age-native redesign of `notsecrets` — replacing sops shell-out and Bitwarden CLI dependency with a self-contained age encryption/decryption library implemented in pure Rust (modeled after rage, no dependency on it).
|
||||
|
||||
**Spec and plan written:**
|
||||
- `docs/superpowers/specs/2026-04-01-notsecrets-age-redesign.md`
|
||||
- `docs/superpowers/plans/2026-04-01-notsecrets-age-redesign.md`
|
||||
|
||||
**Implementation progress (Tasks 1–7 of 12 complete):**
|
||||
|
||||
| Task | Status | Commit |
|
||||
|------|--------|--------|
|
||||
| 1: Scaffold (Cargo.toml, error.rs, domain types, legacy shim) | ✅ | `34d9e3d` |
|
||||
| 2: format.rs (age wire format parser/serializer) | ✅ | `2476daa` |
|
||||
| 3: X25519 identity + recipient | ✅ | `6202c5d` |
|
||||
| 4: Scrypt identity + recipient | ✅ | `b899198` |
|
||||
| 5: SSH Ed25519 identity + recipient | ✅ | `566501c` |
|
||||
| 6: SSH RSA identity + recipient | ✅ | `a0fe6f7` |
|
||||
| 7: EncryptedIdentity (stub, real impl needs Decryptor) | ✅ | `545a45b` |
|
||||
| 8: Encryptor | ⏳ not started | |
|
||||
| 9: Decryptor + wire EncryptedIdentity | ⏳ not started | |
|
||||
| 10: sources/ migration (IdentitySource trait) | ⏳ not started | |
|
||||
| 11: resolve_identities() public API | ⏳ not started | |
|
||||
| 12: notstrap migration + cargo check --workspace | ⏳ not started | |
|
||||
|
||||
**Current state:**
|
||||
- `notsecrets` compiles and passes all existing tests
|
||||
- Legacy API (`AgeKeySource`, `resolve_age_key`, `install_age_key`, `decrypt_sops`) preserved in `_legacy.rs` — `notstrap` still works
|
||||
- `EncryptedIdentity::unwrap_file_key` is a stub returning an error until `Decryptor` is wired in Task 9
|
||||
|
||||
## Resuming
|
||||
|
||||
To continue the age-native redesign, pick up at Task 8 (Encryptor). The plan is at:
|
||||
`docs/superpowers/plans/2026-04-01-notsecrets-age-redesign.md`
|
||||
|
||||
Tasks 8–12 need to be executed in order (each depends on the previous). Use the subagent-driven-development skill to dispatch implementer subagents per task.
|
||||
|
||||
Key context for resuming:
|
||||
- `EncryptedIdentity` stub in `src/identities/encrypted.rs` must have its `unwrap_file_key` body replaced after `Decryptor` exists (end of Task 9)
|
||||
- The `EnvInjector` type in `notstrap` changes from `Box<dyn Fn>` to `Box<dyn FnOnce>` in Task 12
|
||||
- `_legacy.rs` is deleted in Task 10
|
||||
|
||||
## Pending Issues (carried from previous session)
|
||||
|
||||
### 1. Push to remote
|
||||
```bash
|
||||
git push
|
||||
```
|
||||
8 commits ahead of `gitea/main`. Nothing blocking this.
|
||||
Several commits ahead of `gitea/main`. Push when ready.
|
||||
|
||||
### 2. notstrap has an empty lib.rs
|
||||
`crates/notstrap/src/lib.rs` is empty — created as a stub. `notstrap` is binary-only so this is harmless, but it's dead weight. Either delete `[lib]` from `notstrap/Cargo.toml` (if there is one) or remove the file.
|
||||
`crates/notstrap/src/lib.rs` is empty — created as a stub. Either delete `[lib]` from `notstrap/Cargo.toml` or remove the file.
|
||||
|
||||
### 3. notstrap config not documented
|
||||
`notstrap.toml` format is defined inline in `notstrap/src/main.rs` via serde structs but never written down. A sample `notstrap.toml` should be created and documented.
|
||||
`notstrap.toml` format is defined inline via serde structs but never written down. A sample config would help.
|
||||
|
||||
### 4. notsecrets has no binary
|
||||
`notsecrets` is library-only. A small `notsecrets get-key` CLI binary could be useful for manual debugging/testing of the key retrieval chain, but not blocking.
|
||||
### 4. Integration test coverage for nothooks assumes nu in PATH
|
||||
`nothooks` integration tests call `nu` directly. CI needs `nu` installed or tests need `#[ignore]` + feature flag.
|
||||
|
||||
### 5. Integration test coverage for nothooks assumes nu in PATH
|
||||
`nothooks` integration tests call `nu` directly. If `nu` is not on PATH (e.g. on CI), the success/failure tests will fail for the wrong reason. CI should either install `nu` or the tests should be marked `#[ignore]` with a feature flag.
|
||||
|
||||
### 6. notstrap sops_file path is always joined to dotfiles_dir
|
||||
If `sops_file` in `notstrap.toml` is an absolute path, the join will silently override the base. This is a minor footgun in `repo.clone_if_missing` usage — low priority.
|
||||
### 5. notstrap sops_file path footgun
|
||||
If `sops_file` in `notstrap.toml` is an absolute path, the `join` will silently override the base. Low priority.
|
||||
|
||||
Reference in New Issue
Block a user