···3232# Enter development shell
3333nix develop
34343535-# Deploy to a specific machine
3636-clan machines update <MACHINE_NAME>
3535+# Deploy a NixOS machine (tools/deploy): one Secure Enclave unlock for all
3636+# secrets, builds on the target, shows source/closure diff, asks before
3737+# switching. `s` runs apps from ~/src/superconfig, so pass --flake to deploy
3838+# a different checkout/worktree. NEVER use `clan machines update`: it
3939+# decrypts each secret separately and fails on the Secure Enclave prompt.
4040+s deploy --flake . <MACHINE_NAME>
37413842# Format code
3943nix fmt
···80842. Add `config.nix`, `physical.nix`, and optionally `disk.nix`
81853. Generate facts using clan-cli
82864. Add to inventory in `flake.nix`
8383-5. Deploy using `clan machines update <name>`
8787+5. Deploy using `s deploy --flake . <name>`
84888589## Pre-Commit
8690