From cf9770b71dec72368e8a67e70d2d05e164dc01da Mon Sep 17 00:00:00 2001 From: JB Date: Thu, 27 Aug 2026 00:29:23 -0400 Subject: [PATCH] docs(nono): record active profile relinks --- docs/nono-profile-baseline.md | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/docs/nono-profile-baseline.md b/docs/nono-profile-baseline.md index d3c75ff..e74bbe0 100644 --- a/docs/nono-profile-baseline.md +++ b/docs/nono-profile-baseline.md @@ -17,8 +17,8 @@ Captured for Slice 0 on 27AUG2026 with nono 0.74.0. This record contains no cred | --- | --- | --- | | `pi-local` | Symlink to `profiles/nono/pi-local.json` | Already repository-managed. | | `pi-work` | Symlink to `profiles/nono/pi-work.json` | Already repository-managed. | -| `pi-orca-local` | Regular file | Approved active drift imported into Git; host relink remains pending. | -| `pi-harness-tools` | Regular file | Approved active drift imported into Git; host relink remains pending. | +| `pi-orca-local` | Symlink to `profiles/nono/pi-orca-local.json` | Approved drift imported, narrowed to read-only trusted-file access, and relinked on 27AUG2026. | +| `pi-harness-tools` | Symlink to `profiles/nono/pi-harness-tools.json` | Approved drift imported, narrowed to read-only trusted-file access, and relinked on 27AUG2026. | The imported `pi-orca-local` drift is limited to exact read-only access for `$HOME/.pi/agent/AGENTS.md`. Its saved grant for `$HOME/.pi/agent/extensions/pi-workflow/index.ts` was not imported because the user removed that extension and deferred its replacement to a future skill. The imported `pi-harness-tools` drift is limited to exact read-only access for `$HOME/.pi/agent/extensions/pi-todo-herdr/index.ts` and `$HOME/.config/herdr/herdr.sock`. Its inherited `pi-local` policy already contains the Herdr Unix-socket grant. The active files used read/write `allow_file` saved grants; the repository deliberately narrows them to `read_file` because normal sessions do not need to modify trusted instructions or extension code. No other active saved grant was imported. @@ -61,17 +61,7 @@ No following command was run as part of repository implementation or automated v 1. Review `config/pi-package-lock.json`, replace floating package selectors with immutable selectors, pin and re-verify `nolabs-ai/pi`, and install immutable extension snapshots. 2. Validate the repository profiles and review their resolved policies. -3. Relink the two regular active profiles to reviewed repository sources: - - ```bash - ln -sfn /srv/data/code/harness-tools/profiles/nono/pi-orca-local.json \ - "$HOME/.config/nono/profiles/pi-orca-local.json" - ln -sfn /srv/data/code/harness-tools/profiles/nono/pi-harness-tools.json \ - "$HOME/.config/nono/profiles/pi-harness-tools.json" - nono profile validate pi-orca-local --strict - nono profile validate pi-harness-tools --strict - ``` - +3. The active `pi-orca-local` and `pi-harness-tools` files were backed up under `$HOME/.local/state/nono-profile-backups/slice-0-27AUG2026`, replaced with repository symlinks, and strictly validated on 27AUG2026. 4. From the integrated primary `/srv/data/code/harness-tools` checkout, review the dry-run and reconcile links from tracked sources. This will remove stale repository-owned `update` exposure while preserving unrelated external links. The current tool treats primary-checkout links as conflicts when invoked from a linked worktree; that limitation is tracked in `docs/todos.md`. ```bash @@ -99,4 +89,4 @@ Managed links are restored only through `config/pi-links.json` and `scripts/pi-l ## Actions not performed -This slice did not activate or relink profiles, change Pi settings, credentials, or provider configuration, install or update packages, pin the nono package, reconcile or prune generated links, broaden production access, or edit generated skill links. The only external cleanup was the approved, hash-guarded deletion of the two recorded drafts after the baseline evidence was committed. +This slice did not change Pi settings, credentials, or provider configuration, install or update packages, pin the nono package, reconcile or prune generated links, broaden production access, or edit generated skill links. Approved host changes were limited to the hash-guarded draft deletion and relinking `pi-orca-local` and `pi-harness-tools` to their strictly validated repository definitions after creating host-only backups.