aha: the provenance-service-type section of the guix manual explains it for me

In particular, configuration.scm itself is insufficient if it is not self-contained—if it refers to external Guile modules or to extra files. If you want configuration.scm to be self-contained, we recommend that modules or files it refers to be part of a channel.

hmm... guess it would be helpful for me to read about how to create a channel