Put fleet-diff on both PATHs and advance the pins that resolve it #68

Merged

vnprc merged 4 commits from agent/ship-fleet-diff into master

2026-09-04 01:00:20 +01:00

allod-agent commented

2026-09-03 23:29:09 +01:00

Member

Puts fleet-diff on the dev-box PATH, and advances the two pins that make it and the host-side install resolve. This is the integration change for both.

Two boxes change and two do not. allod-dev and nexus get a new system derivation; installer and privacy-1 are byte-identical to master, measured rather than assumed. What changes on a dev box is one new command on the PATH — nothing existing is reconfigured, no service moves, no secret is touched. What proves it: the composed script builds, which is where shellcheck runs, and the built command runs and reports the reviewed usage. If it is wrong, the symptom is a dev box that fails to evaluate or a fleet-diff that is not on the PATH after a rebuild; the fix is reverting this one commit range, since nothing else depends on it yet.

What is in here

Three things, in the order they have to happen:

modules/dev-home-shared.nix gains a fleet-diff entry alongside flake-status and flake-update-cascade, and workspaceTool gains a useWorkspaceLib argument (see below).
A merge of current master, so what was tested is what merges.
flake.lock advances allod-tools 9d029a7 → 3e13fd8 and nexus cd157da → 4edff07. Exactly those two revisions move; nothing else in the lock changes.

The lock advance is what unblocks allod/nexus#38 as well. allod/nexus does not pin allod-tools — it receives it through home-manager.extraSpecialArgs from this repo — so this single advance is what makes the host-side install resolve too.

The issue's sketch does not build

Issue #67 says to wire this through workspaceTool as-is. That fails. workspaceTool unconditionally prepends lib/workspace.sh, and fleet-diff is the first tool that calls none of its helpers, so shellcheck reports SC2329 on each never-invoked function and writeShellApplication fails the build. Every existing tool calls at least one helper, which is why this has not surfaced before.

useWorkspaceLib ? true gates the prepend, and fleet-diff sets it false. That is deliberately narrower than adding SC2329 to the shared excludeShellChecks, which would have weakened the check for all five tools. The coupling to watch: if fleet-diff ever starts calling a workspace_* helper the flag has to flip back, and that fails loudly at build time rather than silently.

allod/nexus#38 makes the byte-identical change to its near-identical nix/home.nix, so the two compositions stay diffable.

Risk

R2 for the wiring, R3 for the lock advance, which is the part that moves real machines.

The wiring adds one package and changes no existing one. The four pre-existing workspaceTool packages were built before and after the helper change and their derivation paths are byte-identical, so the default path through the helper is provably unchanged — and those four hashes match the ones allod/nexus#38 reports independently.

The lock advance moves allod-dev and nexus. Some of that is the new command; the rest is the noise this repo already has, where any commit to allod-tools moves every dev machine's derivation because modules/agent-hooks.nix:11 interpolates the input root. That is not introduced here and is tracked separately.

privacy-1 being byte-identical is the useful negative result: it holds no dev tooling, so a tools advance genuinely does not reach it.

Validation

Everything below was run on this branch at 06a26d9, with --no-write-lock-file throughout.

All four machines evaluate. toplevel.drvPath for each, against the same four from master: allod-dev wwcq3mjn… → c2l00pvr…, nexus 27x0wfmg… → pjc1hgx9…, installer 2yj5038j… unchanged, privacy-1 zzzaralw… unchanged.
fleet-diff is in home.packages for allod-dev and, through the advanced nexus pin, for the nexus host.
The composed derivation builds — /nix/store/dc6mh2s8…-fleet-diff — which is where shellcheck actually runs. bin/fleet-diff --help exits 0 and prints the reviewed short-form usage (--override <input>=<rev>), with jq-1.8.1 and git-2.51.2 on its wrapper PATH. Confirmed it is the reviewed content and not a stale pin: the old point measurement appears nowhere in the built script.
Exactly two revisions differ in flake.lock.
nix-instantiate --parse modules/dev-home-shared.nix passes.

Sabotage, so the new flag is shown to be load-bearing rather than decorative: with useWorkspaceLib = false removed so the default applies, the build fails with exactly four SC2329 findings.

Not run: no VM was built or booted, and no full nix flake check — evaluating every check attribute in one process is OOM-killed on this machine, so checks were evaluated one at a time and only the ones this change can reach were covered. A rebuild is the human step after this merges.

Closes allod/archetypes#67
Closes allod/nexus#37

Puts `fleet-diff` on the dev-box PATH, and advances the two pins that make it and the host-side install resolve. This is the integration change for both. Two boxes change and two do not. `allod-dev` and `nexus` get a new system derivation; `installer` and `privacy-1` are byte-identical to master, measured rather than assumed. What changes on a dev box is one new command on the PATH — nothing existing is reconfigured, no service moves, no secret is touched. What proves it: the composed script builds, which is where shellcheck runs, and the built command runs and reports the reviewed usage. If it is wrong, the symptom is a dev box that fails to evaluate or a `fleet-diff` that is not on the PATH after a rebuild; the fix is reverting this one commit range, since nothing else depends on it yet. ## What is in here Three things, in the order they have to happen: - `modules/dev-home-shared.nix` gains a `fleet-diff` entry alongside `flake-status` and `flake-update-cascade`, and `workspaceTool` gains a `useWorkspaceLib` argument (see below). - A merge of current `master`, so what was tested is what merges. - `flake.lock` advances `allod-tools` `9d029a7 → 3e13fd8` and `nexus` `cd157da → 4edff07`. Exactly those two revisions move; nothing else in the lock changes. The lock advance is what unblocks allod/nexus#38 as well. `allod/nexus` does not pin `allod-tools` — it receives it through `home-manager.extraSpecialArgs` from this repo — so this single advance is what makes the host-side install resolve too. ## The issue's sketch does not build Issue #67 says to wire this through `workspaceTool` as-is. That fails. `workspaceTool` unconditionally prepends `lib/workspace.sh`, and `fleet-diff` is the first tool that calls none of its helpers, so shellcheck reports `SC2329` on each never-invoked function and `writeShellApplication` fails the build. Every existing tool calls at least one helper, which is why this has not surfaced before. `useWorkspaceLib ? true` gates the prepend, and `fleet-diff` sets it `false`. That is deliberately narrower than adding `SC2329` to the shared `excludeShellChecks`, which would have weakened the check for all five tools. The coupling to watch: if `fleet-diff` ever starts calling a `workspace_*` helper the flag has to flip back, and that fails loudly at build time rather than silently. allod/nexus#38 makes the byte-identical change to its near-identical `nix/home.nix`, so the two compositions stay diffable. ## Risk R2 for the wiring, R3 for the lock advance, which is the part that moves real machines. The wiring adds one package and changes no existing one. The four pre-existing `workspaceTool` packages were built before and after the helper change and their derivation paths are byte-identical, so the default path through the helper is provably unchanged — and those four hashes match the ones allod/nexus#38 reports independently. The lock advance moves `allod-dev` and `nexus`. Some of that is the new command; the rest is the noise this repo already has, where any commit to `allod-tools` moves every dev machine's derivation because `modules/agent-hooks.nix:11` interpolates the input root. That is not introduced here and is tracked separately. `privacy-1` being byte-identical is the useful negative result: it holds no dev tooling, so a tools advance genuinely does not reach it. ## Validation Everything below was run on this branch at `06a26d9`, with `--no-write-lock-file` throughout. - All four machines evaluate. `toplevel.drvPath` for each, against the same four from `master`: `allod-dev` `wwcq3mjn… → c2l00pvr…`, `nexus` `27x0wfmg… → pjc1hgx9…`, `installer` `2yj5038j…` unchanged, `privacy-1` `zzzaralw…` unchanged. - `fleet-diff` is in `home.packages` for `allod-dev` and, through the advanced `nexus` pin, for the `nexus` host. - The composed derivation builds — `/nix/store/dc6mh2s8…-fleet-diff` — which is where shellcheck actually runs. `bin/fleet-diff --help` exits 0 and prints the reviewed short-form usage (`--override <input>=<rev>`), with `jq-1.8.1` and `git-2.51.2` on its wrapper PATH. Confirmed it is the reviewed content and not a stale pin: the old point measurement appears nowhere in the built script. - Exactly two revisions differ in `flake.lock`. - `nix-instantiate --parse modules/dev-home-shared.nix` passes. Sabotage, so the new flag is shown to be load-bearing rather than decorative: with `useWorkspaceLib = false` removed so the default applies, the build fails with exactly four `SC2329` findings. Not run: no VM was built or booted, and no full `nix flake check` — evaluating every check attribute in one process is OOM-killed on this machine, so checks were evaluated one at a time and only the ones this change can reach were covered. A rebuild is the human step after this merges. Closes allod/archetypes#67 Closes allod/nexus#37

allod-agent added 1 commit

2026-09-03 23:29:10 +01:00

Put fleet-diff on the dev-box PATH 8a23b969e7

Wires flake/fleet-diff from the allod-tools input into the dev home
composition beside flake-status and flake-update-cascade, so the fleet-diff
skill and the land-inert merge gate can call an installed command.

Built as a plain writeShellApplication rather than through the workspaceTool
helper: fleet-diff calls nothing from lib/workspace.sh, and prepending that
library anyway makes shellcheck fail the build with SC2329 on every
never-invoked function. jq and git come from runtimeInputs; nix comes from
the NixOS system.

This does not build until allod/tools#136 lands on master and the allod-tools
lock advances past it. The lock is deliberately untouched here.

Refs allod/archetypes#67

allod-agent added 1 commit

2026-09-03 23:32:04 +01:00

Compose fleet-diff through workspaceTool, not a bare writeShellApplication 71ca2ae3f7

Same narrow route the host-side twin took in allod/nexus PR 38, so the two
near-identical compositions stay diffable: workspaceTool gains a
useWorkspaceLib argument, default true, and fleet-diff sets it false because
it calls none of lib/workspace.sh's helpers. The previous commit sidestepped
the helper entirely, which worked but left the tool list non-uniform.

Every pre-existing package's derivation path is unchanged against
origin/master: flake-status, flake-update-cascade, work-diff, pull-all,
forge, allod, and setup-tracked-hooks all evaluate to the same .drv.

Refs allod/archetypes#67

allod-agent referenced this pull request from allod/tools

2026-09-03 23:40:46 +01:00

Add fleet-diff: check which machines a change rebuilds against a declared expectation #136

allod-agent added 2 commits

2026-09-04 00:52:39 +01:00

Merge remote-tracking branch 'origin/master' into agent/ship-fleet-diff 6d41bc5a53

Advance allod-tools and nexus for the fleet-diff wiring 06a26d9097

flake/fleet-diff now exists on allod/tools master, and allod/nexus master
carries the host-side wiring, so both pins move together and this branch
becomes the integration change for both PATH installs.

Only those two revisions move in the lock. Measured against master:
allod-dev and nexus change, installer and privacy-1 are byte-identical.

allod-agent changed title from ~~Put fleet-diff on the dev-box PATH~~ to Put fleet-diff on both PATHs and advance the pins that resolve it

2026-09-04 00:53:26 +01:00