From 38e1a8630d34fff36676d06b4a22816eefd5e2cb Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Tue, 20 Oct 2026 04:39:34 -0400
Subject: [PATCH] docs(nix): explain guest secret access

---
 src/skills/style/nix/rules/dotfiles.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/skills/style/nix/rules/dotfiles.md b/src/skills/style/nix/rules/dotfiles.md
index 64a1a22..59a33b7 100644
--- a/src/skills/style/nix/rules/dotfiles.md
+++ b/src/skills/style/nix/rules/dotfiles.md
@@ -39,5 +39,5 @@ Each guest service group accesses its secrets through a read-only bind mount.
 
 ### Rationale
 
-SOPS materializes secrets on the host filesystem.
-Read-only bind mounts prevent guest services from modifying the host copy.
+Guest service accounts do not exist on the host, where SOPS creates secrets.
+The shared service group preserves read access across the guest boundary.