From 06ec6b3ab783211a096686376e8bc6660f5b7302 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 27 Oct 2026 14:59:15 -0700 Subject: [PATCH 1/5] Declare host-secrets for Blog in the registry Blog's deploy/make-release.sh reads a host env file under ~/.secrets/, which GOVERNANCE.md "Operational Repositories" routes through the carried readers. Declaring the type is what lets carry.py apply carry lib/sh to lib/fleet/sh there, per ptr727/Blog#553. Co-Authored-By: Claude Opus 5.5 --- registry/repos.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/repos.json b/registry/repos.json index b519d58e..f7ff063f 100644 --- a/registry/repos.json +++ b/registry/repos.json @@ -315,7 +315,7 @@ "name": "Blog", "url": "https://github.com/ptr727/Blog", "status": "cataloged", - "types": ["hugo", "source-only", "python"], + "types": ["hugo", "source-only", "python", "host-secrets"], "groundTruthBranch": "main", "workflowModel": "release", "lineEndings": "lf", From 5343531d67eaa308614481e0543ef5233d3deb84 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 27 Oct 2026 15:02:14 -0700 Subject: [PATCH 2/5] Name Blog as the first host-secrets adopter in the matrix Co-Authored-By: Claude Opus 5.5 --- reports/conformance-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index 7af653fe..d523685d 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. HomeAutomation-Config is the first adopter, by its own adoption issue. | +| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, carrying the readers per ptr727/Blog#553, and HomeAutomation-Config adopts it by its own adoption issue. | | `operational` config | - | not-tested | - | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. HomeAutomation-Config was the reference until its 2026-09-24 reclassification to `release`, and no remaining operational repository (ESPHome-Config, HomeAssistant-Config, Vantage-Config) has taken its place yet. | ## Composable Targets From 7984c9f3b0d2bd9cbbcef97b6c34ef4c01bf95c5 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 27 Oct 2026 15:03:05 -0700 Subject: [PATCH 3/5] State Blog's host-secrets carry as tracked rather than done Co-Authored-By: Claude Opus 5.5 --- reports/conformance-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index d523685d..a083eef2 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, carrying the readers per ptr727/Blog#553, and HomeAutomation-Config adopts it by its own adoption issue. | +| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, with its carry of the readers tracked in ptr727/Blog#553, and HomeAutomation-Config adopts it by its own adoption issue. | | `operational` config | - | not-tested | - | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. HomeAutomation-Config was the reference until its 2026-09-24 reclassification to `release`, and no remaining operational repository (ESPHome-Config, HomeAssistant-Config, Vantage-Config) has taken its place yet. | ## Composable Targets From 957ee39b6087ea835600a1d544022111ad57f1fa Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 27 Oct 2026 15:11:42 -0700 Subject: [PATCH 4/5] Describe HomeAutomation-Config as a pending host-secrets adopter Co-Authored-By: Claude Opus 5.5 --- reports/conformance-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index a083eef2..39eb1a29 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, with its carry of the readers tracked in ptr727/Blog#553, and HomeAutomation-Config adopts it by its own adoption issue. | +| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, with its carry of the readers tracked in ptr727/Blog#553, and HomeAutomation-Config is to adopt it by its own adoption issue, having neither declared nor carried it yet. | | `operational` config | - | not-tested | - | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. HomeAutomation-Config was the reference until its 2026-09-24 reclassification to `release`, and no remaining operational repository (ESPHome-Config, HomeAssistant-Config, Vantage-Config) has taken its place yet. | ## Composable Targets From 081dde7fd733653950f24074d2afe91cbcd219ca Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Wed, 28 Oct 2026 11:11:30 -0700 Subject: [PATCH 5/5] Split the host-secrets matrix note into sentences of 25 words or fewer Co-Authored-By: Claude Opus 5.5 --- reports/conformance-matrix.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index 39eb1a29..aa12cf53 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, with its carry of the readers tracked in ptr727/Blog#553, and HomeAutomation-Config is to adopt it by its own adoption issue, having neither declared nor carried it yet. | +| `host-secrets` overlay | - | not-tested | - | Layered onto a base shape, and carries the hub's `lib/sh` secret and env readers at `lib/fleet/sh` byte-for-byte. Blog is the first repository to declare it, and ptr727/Blog#553 tracks its carry of the readers. HomeAutomation-Config has neither declared nor carried it yet, and is to adopt it by its own adoption issue. | | `operational` config | - | not-tested | - | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. HomeAutomation-Config was the reference until its 2026-09-24 reclassification to `release`, and no remaining operational repository (ESPHome-Config, HomeAssistant-Config, Vantage-Config) has taken its place yet. | ## Composable Targets