3 files changed, 34 insertions, 0 deletions

diff --git a/openspec/changes/fix-discord-unfree-allowlist/.openspec.yaml b/openspec/changes/fix-discord-unfree-allowlist/.openspec.yaml
new file mode 100644
index 0000000..54f2ff0
--- /dev/null
+++ b/openspec/changes/fix-discord-unfree-allowlist/.openspec.yaml
@@ -0,0 +1,3 @@
+schema: spec-driven
+created: 2026-09-21
+skip_specs: true
diff --git a/openspec/changes/fix-discord-unfree-allowlist/proposal.md b/openspec/changes/fix-discord-unfree-allowlist/proposal.md
new file mode 100644
index 0000000..c9aee13
--- /dev/null
+++ b/openspec/changes/fix-discord-unfree-allowlist/proposal.md
@@ -0,0 +1,22 @@
+## Why
+
+`lib/unfree-allowlist.nix` lists `"discord"`, but a real build of the shared home profile fails today with `error: Refusing to evaluate package 'discord-unwrapped-1.0.156' ... because it has an unfree license`. Discord's nixpkgs derivation is an FHS-env wrapper around an internal `discord-unwrapped` derivation (not exposed as a top-level `pkgs` attribute), and `nixpkgs.config.allowUnfreePredicate` checks `lib.getName pkg` against the allowlist by exact string — `"discord"` never matches `"discord-unwrapped"`, so the wrapped build is blocked. This was discovered and reproduced against unmodified `main` (via `git stash`) while verifying an unrelated change (`add-firefox-bitwarden`), so it predates and is independent of that work.
+
+## What Changes
+
+- Add `"discord-unwrapped"` to `lib/unfree-allowlist.nix`, alongside the existing `"discord"` entry (both names get checked at different points in the build — the wrapper and the inner FHS payload).
+- **BREAKING**: none — this restores already-specified behavior (`desktop-applications` already requires Discord to be provisioned); it doesn't change what's provisioned or add anything new.
+
+## Capabilities
+
+### New Capabilities
+(none)
+
+### Modified Capabilities
+(none — `desktop-applications`'s existing requirement already states the shared profile "SHALL include Slack, Discord, Spotify, teams-for-linux, Firefox, and the Bitwarden desktop client"; this change fixes a defect that was silently preventing that already-specified behavior from actually building, it doesn't change the requirement. `.openspec.yaml` sets `skip_specs: true` accordingly, matching the precedent in `fix-deprecation-warnings`.)
+
+## Impact
+
+- **Affected code**: `lib/unfree-allowlist.nix` only (one new list entry).
+- **Not affected**: `modules/home/desktop-apps.nix`, `lib/mkHome.nix`, `lib/mkNixos.nix` — the predicate wiring itself is correct; only the allowlist's string entries were incomplete.
+- **Verification note**: this environment is `aarch64-linux`, while `tom@linux` targets `x86_64-linux`, so a full realized build isn't possible here without emulation — verification is evaluation-only (`nix build ... --dry-run`), confirming the unfree-license error disappears and Discord's store paths resolve.
diff --git a/openspec/changes/fix-discord-unfree-allowlist/tasks.md b/openspec/changes/fix-discord-unfree-allowlist/tasks.md
new file mode 100644
index 0000000..011122a
--- /dev/null
+++ b/openspec/changes/fix-discord-unfree-allowlist/tasks.md
@@ -0,0 +1,9 @@
+## 1. Fix the allowlist
+
+- [x] 1.1 In `lib/unfree-allowlist.nix`, add `"discord-unwrapped"` to the list alongside the existing `"discord"` entry.
+
+## 2. Validate
+
+- [x] 2.1 Run `openspec validate fix-discord-unfree-allowlist --strict` and confirm it passes.
+- [x] 2.2 Run `nix build ".#homeConfigurations.\"tom@linux\".activationPackage" --dry-run` (no `NIXPKGS_ALLOW_UNFREE` override) and confirm it no longer fails with an unfree-license error for Discord, and that Discord's store paths appear in the plan.
+- [x] 2.3 Run `nix flake check` and confirm it still passes with no new evaluation errors.