EigenState

Reproducible CLI tooling harness for operating a Talos / Kubernetes cluster, built around an explicit boundary between what is safe to publish and what is private runtime material. See AGENTS.md for the rules AI agents follow in this repository and docs/boundary.md for the full boundary contract.

Trust Boundary

This repository holds only the reproducible tooling harness, public-safe Talos patches, and docs — never generated Talos MachineConfigs, client configs (talosconfig / kubeconfig), or secrets. All such private runtime material is generated on demand into scratch/keeper workspaces that live outside this repository and are never committed here. scripts/path- allowlist.sh and gitleaks (a working-tree scan via make scan in the pre-commit hook below, plus a git-history-aware scan via make audit) enforce this boundary by catching forbidden filenames and PKI material before, and after, a commit lands.

Quickstart

nix develop
git config core.hooksPath .githooks

nix develop drops you into the pinned dev shell (flake.nix) with talosctl, gitleaks, sops, age, kubectl, yq, and make at the versions this repo is validated against. git config core.hooksPath .githooks wires this repo's own pre-commit hook so the trust-boundary scan in make scan actually runs before a commit lands, instead of relying on someone remembering to run make check by hand.

You can also run make check (or make scan / make validate individually) at any time to run the same checks manually.

Why commits must happen from inside the dev shell

The pre-commit hook (.githooks/pre-commit) shells out to make, gitleaks, and — for the full make check — talosctl. Those tools, at the versions this repo assumes, only exist reliably inside the nix develop shell defined by flake.nix. Committing from outside it means the hook either can't find the tools at all, or picks up whatever ad-hoc version happens to be on your PATH, which defeats the reproducibility this repo is built around and can let boundary-violating files (secrets, generated MachineConfigs, kubeconfig) slip through undetected.

If make or gitleaks is missing, the hook reports the missing tool by name and refuses to commit — that failure means the guard did not run, not that the commit is clean. If only talosctl is missing, the hook falls back to make scan (the boundary check still runs) and prints a warning that validate was skipped.