From d3683946566b9b50f763a12f39af8bbfa76e42cd Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 21 Oct 2026 02:25:56 -0700 Subject: [PATCH] docs(research): break the two worst wall paragraphs The chezmoi overview was one 488-character sentence-block; the git-crypt mechanism and verdict lines were the same shape. Reflowed to ~100 columns with no wording lost, so the pages read the same in an editor as they do rendered. Refs #64 --- omp-docs/research/chezmoi-evaluation.md | 9 ++++++++- omp-docs/research/secrets-for-agents.md | 9 +++++++-- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/omp-docs/research/chezmoi-evaluation.md b/omp-docs/research/chezmoi-evaluation.md index d9233df..d381900 100644 --- a/omp-docs/research/chezmoi-evaluation.md +++ b/omp-docs/research/chezmoi-evaluation.md @@ -17,7 +17,14 @@ tags: ## Overview -**chezmoi** is a Go-binary (MIT license, 21k+ GitHub stars) that manages dotfiles across diverse machines by declaring desired state in a source directory and applying the delta to the target directory. It is the only dotfiles tool in the [dotfiles comparison table][comparison] that provides private files, whole-file encryption, password-manager integration, template-based machine-to-machine differences, partial-file management, and symlink differences — all in a single distribution. +**chezmoi** is a Go binary (MIT license, 21k+ GitHub stars) that manages dotfiles across +diverse machines: you declare the desired state in a source directory and it applies the delta +to the target directory. + +It is the only dotfiles tool in the [dotfiles comparison table][comparison] that provides all +five of these in a single distribution: private files, whole-file encryption, +password-manager integration, template-based machine-to-machine differences, and partial-file +management plus symlink differences. The current release is **v2.72.0** (2026-08-02). It is not yet installed on this machine. diff --git a/omp-docs/research/secrets-for-agents.md b/omp-docs/research/secrets-for-agents.md index fada73e..98e32f0 100644 --- a/omp-docs/research/secrets-for-agents.md +++ b/omp-docs/research/secrets-for-agents.md @@ -42,7 +42,9 @@ The question: for each tool, does a secret ever appear in plaintext where an age ### How it works -git-crypt uses git clean/merge filters to encrypt specific files at commit time and decrypt them at checkout. The `.gitattributes` file declares which paths to encrypt. Encryption uses AES-256-CTR with a synthetic IV derived from SHA-1 HMAC. +git-crypt uses git clean/merge filters to encrypt specific files at commit time and decrypt +them at checkout. The `.gitattributes` file declares which paths to encrypt. Encryption is +AES-256-CTR with a synthetic IV derived from SHA-1 HMAC. ### Agent behavior @@ -64,7 +66,10 @@ git-crypt uses git clean/merge filters to encrypt specific files at commit time ### Agent safety verdict -**Moderate.** Plaintext appears on disk post-checkout but the agent doesn't explicitly decrypt — git does it silently. However, any agent that opens the file sees plaintext. In a shared repo scenario, any collaborator who gets the GPG private key gets full access to all history. +**Moderate.** Plaintext appears on disk post-checkout, but the agent never decrypts — git does +it silently inside the filter pipeline. Any agent that opens the file still sees plaintext. +And in a shared repo, any collaborator who gets the GPG private key gets full access to all +history. ---