Move pi-provider-lifecycle's embedded programs out of Nix strings #100

Merged

vnprc merged 1 commit from agent/pi-lifecycle-scripts into master

2026-09-22 03:36:54 +01:00

allod-agent commented

2026-09-22 02:20:15 +01:00

Member

The pi-provider-lifecycle check's three Python programs and its thousand-line bash body move out of Nix strings into real files under checks/pi-provider-lifecycle/, so they get syntax highlighting, shellcheck and a Python syntax check, and lose the ''${ escaping. What the check asserts is unchanged; the derivation changes by design because its script is now a file, so the witness is the check building green and a sabotaged assertion making it fail, both run, plus ./check.sh green on this branch. If it is wrong, revert the one commit; nothing outside this check is touched.

What changed

checks/pi-provider-lifecycle/server.py, proc-leak-sampler.py, rpc-driver.py: the three programs, verbatim; none held Nix interpolation.
checks/pi-provider-lifecycle/run.sh: the bash body. The 41 Nix values it used to interpolate (each fixture scenario's reconciler, selector, extension installer and catalogue files, the runtime root, the three programs, the generated activation text and closure) arrive as environment variables set on the invoking line in the .nix file, the way site-content.nix hands SITE_ROOT to site-content.sh; a require loop at the top names any the caller forgot. Three ''${ sites became ${; one single-quoted line that used to hold Nix-expanded text is double-quoted so bash expands it.
shellcheck's SC2086 auto-fix was applied at 74 sites ($VAR to "$VAR"), all of them Nix store paths. The remaining shellcheck notices are the intentional per-scenario HOME subshells, functions called through export -f by the reconciler, and $out, which are listed in the worker's report and left alone.
checks/pi-provider-lifecycle.nix keeps the fixture construction and the let that names each value; nativeBuildInputs is unchanged because the old bash already reached every tool through PATH.

Risk

R2. One check's test script moves; no module, builder or production script changes. The failure modes are a value that was substituted by Nix and is now expanded by bash differently, or a quoting change at a site that relied on word splitting; the review below was asked to enumerate both, and the build plus sabotage is the executable witness. Rollback is a straight revert.

Validation

nix build .#checks.x86_64-linux.pi-provider-lifecycle: green; the log ends with the check's own "lifecycle, selection, retirement, crash, concurrency, adapter, and leak witnesses passed" line. Rebuilt by the integrator from the committed tree: cache hit at the same output path.
Sabotage: with one stat mode assertion in run.sh changed from 600 to 601, the build fails with exit 1; restored, it rebuilds to the same output path.
nix-instantiate --parse on the .nix file, bash -n on run.sh, py_compile on the three programs: clean.
./check.sh on this branch, run by the integrator: All 32 steps passed (checks: 19 built).
One cold cross-family review of the diff (gpt-5.6-terra on codex, high effort): no findings, after comparing every environment variable on the invoking line against its uses in run.sh, the 74 quoting sites, the require guard and the three programs (transcript of 321 KB; an empty review was ruled out before it was read as approval).

Closes allod/archetypes#97

The pi-provider-lifecycle check's three Python programs and its thousand-line bash body move out of Nix strings into real files under `checks/pi-provider-lifecycle/`, so they get syntax highlighting, shellcheck and a Python syntax check, and lose the `''${` escaping. What the check asserts is unchanged; the derivation changes by design because its script is now a file, so the witness is the check building green and a sabotaged assertion making it fail, both run, plus `./check.sh` green on this branch. If it is wrong, revert the one commit; nothing outside this check is touched. ## What changed - `checks/pi-provider-lifecycle/server.py`, `proc-leak-sampler.py`, `rpc-driver.py`: the three programs, verbatim; none held Nix interpolation. - `checks/pi-provider-lifecycle/run.sh`: the bash body. The 41 Nix values it used to interpolate (each fixture scenario's reconciler, selector, extension installer and catalogue files, the runtime root, the three programs, the generated activation text and closure) arrive as environment variables set on the invoking line in the `.nix` file, the way `site-content.nix` hands `SITE_ROOT` to `site-content.sh`; a `require` loop at the top names any the caller forgot. Three `''${` sites became `${`; one single-quoted line that used to hold Nix-expanded text is double-quoted so bash expands it. - shellcheck's SC2086 auto-fix was applied at 74 sites (`$VAR` to `"$VAR"`), all of them Nix store paths. The remaining shellcheck notices are the intentional per-scenario `HOME` subshells, functions called through `export -f` by the reconciler, and `$out`, which are listed in the worker's report and left alone. - `checks/pi-provider-lifecycle.nix` keeps the fixture construction and the `let` that names each value; `nativeBuildInputs` is unchanged because the old bash already reached every tool through PATH. ## Risk R2. One check's test script moves; no module, builder or production script changes. The failure modes are a value that was substituted by Nix and is now expanded by bash differently, or a quoting change at a site that relied on word splitting; the review below was asked to enumerate both, and the build plus sabotage is the executable witness. Rollback is a straight revert. ## Validation - `nix build .#checks.x86_64-linux.pi-provider-lifecycle`: green; the log ends with the check's own "lifecycle, selection, retirement, crash, concurrency, adapter, and leak witnesses passed" line. Rebuilt by the integrator from the committed tree: cache hit at the same output path. - Sabotage: with one `stat` mode assertion in `run.sh` changed from 600 to 601, the build fails with exit 1; restored, it rebuilds to the same output path. - `nix-instantiate --parse` on the `.nix` file, `bash -n` on `run.sh`, `py_compile` on the three programs: clean. - `./check.sh` on this branch, run by the integrator: `All 32 steps passed (checks: 19 built).` - One cold cross-family review of the diff (`gpt-5.6-terra` on codex, high effort): no findings, after comparing every environment variable on the invoking line against its uses in `run.sh`, the 74 quoting sites, the `require` guard and the three programs (transcript of 321 KB; an empty review was ruled out before it was read as approval). Closes allod/archetypes#97

allod-agent added 1 commit

2026-09-22 02:20:15 +01:00

Move pi-provider-lifecycle's embedded programs out of Nix strings 390ceb48ac

The fixture HTTP server, the process-leak sampler and the RPC driver
were pkgs.writeText blobs with their program text embedded in a Nix
indented string; the bash body of the runCommand check was too. They
are real files now under checks/pi-provider-lifecycle/, referenced by
path, so they get syntax highlighting, shellcheck and a Python syntax
check. Nix values the bash used to interpolate directly (the per-
fixture reconciler/selector/extension-installer binaries and
catalogue/manifest files, the fixture runtime root, the three Python
programs, and the generated Home Manager activation text) arrive
instead as environment variables set on run.sh's invoking line, the
way checks/site-content.nix hands SITE_ROOT to checks/site-content.sh.

shellcheck's own suggested quoting fixes (SC2086, double-quote to
prevent globbing/word splitting) are applied; they are pure quoting
changes with no behavioural effect since every quoted value is a Nix
store path. No assertion, sabotage fixture or nativeBuildInputs tool
changed.

Refs allod/archetypes#97