Remove the hypervisorIdentities fallback now that secrets exports the set #122

New issue

Closed

opened 2026-09-30 04:30:08 +01:00 by vnprc-agent · 1 comment

vnprc-agent commented

2026-09-30 04:30:08 +01:00

Remove the fallback that builds hypervisorIdentities from nexusIdentity when a secrets revision does not export the set, so a secrets input without the export fails evaluation instead of composing silently.

Primary goals:

Move the secrets pin — this repository's flake.lock moves to a secrets revision that exports lib.hypervisorIdentities.
Delete the fallback — flake.nix reads secrets.lib.hypervisorIdentities directly, and a secrets input without it fails with a message naming the export.
Teach the fork fixture — checks/fork-fixture/secrets exports hypervisorIdentities beside nexusIdentity, so fork-safety.sh exercises the contract rather than the fallback.

Current state and specifics

The fallback landed with allod/archetypes#89 so the change could evaluate against the secrets revision pinned at the time. That revision has since moved: the export exists on the secrets master. The fallback is now a silent default (architecture principle 11), and it was recorded as finding 2 of allod/archetypes#121, whose other findings are fixed.

Scope

In scope: the lock move, the fallback removal, the fork-fixture export, and the fork-safety.sh run that the lock-bump path requires. Out of scope: any change to how identities merge.

Refs allod/archetypes#121

Remove the fallback that builds `hypervisorIdentities` from `nexusIdentity` when a secrets revision does not export the set, so a secrets input without the export fails evaluation instead of composing silently. Primary goals: - **Move the secrets pin** — this repository's `flake.lock` moves to a secrets revision that exports `lib.hypervisorIdentities`. - **Delete the fallback** — `flake.nix` reads `secrets.lib.hypervisorIdentities` directly, and a secrets input without it fails with a message naming the export. - **Teach the fork fixture** — `checks/fork-fixture/secrets` exports `hypervisorIdentities` beside `nexusIdentity`, so `fork-safety.sh` exercises the contract rather than the fallback. ### Current state and specifics The fallback landed with allod/archetypes#89 so the change could evaluate against the secrets revision pinned at the time. That revision has since moved: the export exists on the secrets master. The fallback is now a silent default (architecture principle 11), and it was recorded as finding 2 of allod/archetypes#121, whose other findings are fixed. ### Scope In scope: the lock move, the fallback removal, the fork-fixture export, and the `fork-safety.sh` run that the lock-bump path requires. Out of scope: any change to how identities merge. Refs allod/archetypes#121

vnprc-agent referenced this issue

2026-09-30 04:30:22 +01:00

Profile data can replace a hypervisor identity; the hypervisorIdentities fallback is silent; a fixture names the template hypervisor #121

vnprc-agent referenced this issue

2026-09-30 04:30:25 +01:00

Make the hypervisor identity plural so a deployment can run more than one #89

vnprc referenced this issue from a commit

2026-09-30 04:50:01 +01:00

Read hypervisor identities from secrets without a fallback

vnprc-agent commented

2026-09-30 04:55:03 +01:00

Author

Landed on master: hypervisor identities are read from the secrets export with no fallback, the fork fixture exports the set, and fork-safety passed with all 22 checks fork-safe.

vnprc-agent closed this issue

2026-09-30 04:55:03 +01:00