Add helm to the shared developer CLI toolset

Tom wants the Helm CLI available alongside kubectl for managing charts
against whatever cluster kubectl is already pointed at.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

3 files changed, 38 insertions, 0 deletions

diff --git a/openspec/changes/archive/2026-09-24-add-helm/.openspec.yaml b/openspec/changes/archive/2026-09-24-add-helm/.openspec.yaml
new file mode 100644
index 0000000..bb4e360
--- /dev/null
+++ b/openspec/changes/archive/2026-09-24-add-helm/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-09-24
+skip_specs: true
diff --git a/openspec/changes/archive/2026-09-24-add-helm/proposal.md b/openspec/changes/archive/2026-09-24-add-helm/proposal.md
new file mode 100644
index 0000000..440ca81
--- /dev/null
+++ b/openspec/changes/archive/2026-09-24-add-helm/proposal.md
@@ -0,0 +1,25 @@
+## Why
+
+Tom wants `helm` (the Kubernetes package manager CLI) available alongside the already-provisioned `kubectl`, so Helm charts can be installed/managed against whatever cluster `kubectl` is already pointed at.
+
+## What Changes
+
+- Add `pkgs.kubernetes-helm` to `modules/home/dev-tools.nix`'s CLI package list. Verified against the flake's pinned `nixos-unstable` nixpkgs input: Apache-2.0 licensed (free, no `lib/unfree-allowlist.nix` entry needed), broad platform support (`aarch64-darwin`, `x86_64-linux`, `aarch64-linux`, and more).
+- No spec change needed — `developer-environment`'s existing "Developer CLI tools are provisioned via the shared home profile" requirement already covers adding another evidenced CLI tool to the list (the same reasoning previously used for `uv`, `bitwarden-cli`, `claude-code`), and its "Container and cloud tools are client-only" requirement already generally covers any Kubernetes/cloud CLI tool other than Docker — Helm needs no daemon or account of its own; it just talks to whatever cluster `kubectl` is already configured against.
+- **BREAKING**: none — additive only.
+
+## Capabilities
+
+### New Capabilities
+(none)
+
+### Modified Capabilities
+(none — covered by `developer-environment`'s existing requirements; no requirement text changes)
+
+## Impact
+
+- **Affected code**: `modules/home/dev-tools.nix` (add `pkgs.kubernetes-helm`).
+- **Not affected**: `lib/unfree-allowlist.nix` (Helm is free-licensed), `modules/home/desktop-apps.nix`, `modules/nixos/common.nix`.
+- **Dependencies**: nixpkgs' `kubernetes-helm` package, already present in the pinned `nixos-unstable` input; no new flake inputs.
+- **Platforms**: provisioned cross-platform like the rest of `dev-tools.nix` — `homeConfigurations` (`tom@linux`, `tom@darwin`) and any NixOS host built via `lib/mkNixos.nix`.
+- **Known limitation, out of scope**: no Kubernetes cluster or `kubeconfig` is installed or managed by this change, exactly like the existing `kubectl` provisioning — Helm is a client only.
diff --git a/openspec/changes/archive/2026-09-24-add-helm/tasks.md b/openspec/changes/archive/2026-09-24-add-helm/tasks.md
new file mode 100644
index 0000000..e85e05d
--- /dev/null
+++ b/openspec/changes/archive/2026-09-24-add-helm/tasks.md
@@ -0,0 +1,10 @@
+## 1. Package addition
+
+- [x] 1.1 Add `kubernetes-helm` to the `with pkgs; [ ... ]` list in `modules/home/dev-tools.nix`, alongside `kubectl`
+- [x] 1.2 Verify `nix eval '.#homeConfigurations."tom@linux".config.home.packages'` and `nix eval '.#homeConfigurations."tom@darwin".config.home.packages'` each include the `kubernetes-helm` derivation
+
+## 2. Verification
+
+- [x] 2.1 Run `nix flake check` and confirm it passes
+- [x] 2.2 Run `nix build '.#homeConfigurations."tom@linux".activationPackage'` and `nix build '.#homeConfigurations."tom@darwin".activationPackage'` and confirm both succeed (verified via `--dry-run`: this session's machine is aarch64-linux with no remote builders configured, so it cannot natively build either cross-platform target; `--dry-run` confirmed the full derivation graph, including `kubernetes-helm`, resolves without evaluation errors for both)
+- [x] 2.3 Run `nix fmt` and confirm `modules/home/dev-tools.nix` is formatted with no diff