Drop credential-store-url-parity: allod/tools carries its own copy now #111

Merged

vnprc merged 1 commit from agent/drop-credential-store-url-parity into master

2026-09-23 03:00:24 +01:00

allod-agent commented

2026-09-22 20:40:26 +01:00

Member

Summary

Nothing changes for any running machine: this removes one check derivation and touches no module, builder, or composed configuration.

The credential-store-url-parity check compared allod/tools' vector-table copy against the secrets input by literal filename. On the template that means what it says; on a fork whose secrets is its own data repo it silently asserts something else, or fails on a missing file. allod/tools now carries that assertion against a pinned allod/secrets (allod/tools#224), so this repo deletes its copy, its index entry, and the now-unused allod-tools argument to checks/. The allod-tools flake input stays: the dev and hypervisor builders still use it.

One deliberate departure from the issue: the fork fixture keeps checks/fork-fixture/secrets/credential-store-url.json. The issue said only this check read it; in fact the fixture's own grammar predicate reads it and the credential-profiles check floors its vector count, so dropping it would break the fork-safety witness. Only the comment above it changes.

What proves it: the repo gate passes with 18 checks built and the name gone, and credential-profiles builds against the fork fixture.

If it is wrong: revert this PR; the check file returns unchanged.

Closes allod/archetypes#110
Refs allod/archetypes#88, allod/archetypes#108

Risk

R1. Deletion of a check plus comment rewording; no runtime behaviour. Worst credible failure after validation: the parity goes unwitnessed if the allod/tools PR were reverted later, which is visible in that repo's check set. Rollback is a straight revert.

Validation

Worker ran, overseer read the log; overseer re-ran the fork-fixture build:

./check.sh        -> All 31 steps passed (checks: 18 built)
nix eval .#checks.x86_64-linux --apply builtins.attrNames   -> 18 names, credential-store-url-parity absent
nix build .#checks.x86_64-linux.credential-profiles --no-link -L \
  --override-input secrets path:.../checks/fork-fixture/secrets \
  --override-input profiles path:.../checks/fork-fixture/profiles \
  --override-input inventory path:.../checks/fork-fixture/inventory   -> exit 0

grep -rn credential-store-url-parity over *.nix *.md *.sh finds nothing. Not run: ./fork-safety.sh in full, which is the lock-bump pin witness; the one check that reads the retained fixture file was built against the fixture directly instead.

Cross-family review: one cold pass by codex (gpt-5.6-sol, high effort) on the diff. No findings; it verified that nothing still references the removed check or argument, that the two fixture readers named above exist at the cited lines, that check.sh and fork-safety.sh enumerate names from the flake, and that the deleted check asserted nothing about this repo beyond the two-file cmp.

Depends on: allod/tools#224 merges first; it adds the check this PR deletes

## Summary Nothing changes for any running machine: this removes one check derivation and touches no module, builder, or composed configuration. The `credential-store-url-parity` check compared allod/tools' vector-table copy against the `secrets` input by literal filename. On the template that means what it says; on a fork whose `secrets` is its own data repo it silently asserts something else, or fails on a missing file. allod/tools now carries that assertion against a pinned allod/secrets (allod/tools#224), so this repo deletes its copy, its index entry, and the now-unused `allod-tools` argument to `checks/`. The `allod-tools` flake input stays: the dev and hypervisor builders still use it. One deliberate departure from the issue: the fork fixture keeps `checks/fork-fixture/secrets/credential-store-url.json`. The issue said only this check read it; in fact the fixture's own grammar predicate reads it and the `credential-profiles` check floors its vector count, so dropping it would break the fork-safety witness. Only the comment above it changes. What proves it: the repo gate passes with 18 checks built and the name gone, and `credential-profiles` builds against the fork fixture. If it is wrong: revert this PR; the check file returns unchanged. Closes allod/archetypes#110 Refs allod/archetypes#88, allod/archetypes#108 ## Risk R1. Deletion of a check plus comment rewording; no runtime behaviour. Worst credible failure after validation: the parity goes unwitnessed if the allod/tools PR were reverted later, which is visible in that repo's check set. Rollback is a straight revert. ## Validation Worker ran, overseer read the log; overseer re-ran the fork-fixture build: ./check.sh -> All 31 steps passed (checks: 18 built) nix eval .#checks.x86_64-linux --apply builtins.attrNames -> 18 names, credential-store-url-parity absent nix build .#checks.x86_64-linux.credential-profiles --no-link -L \ --override-input secrets path:.../checks/fork-fixture/secrets \ --override-input profiles path:.../checks/fork-fixture/profiles \ --override-input inventory path:.../checks/fork-fixture/inventory -> exit 0 `grep -rn credential-store-url-parity` over `*.nix *.md *.sh` finds nothing. Not run: `./fork-safety.sh` in full, which is the lock-bump pin witness; the one check that reads the retained fixture file was built against the fixture directly instead. Cross-family review: one cold pass by codex (gpt-5.6-sol, high effort) on the diff. No findings; it verified that nothing still references the removed check or argument, that the two fixture readers named above exist at the cited lines, that check.sh and fork-safety.sh enumerate names from the flake, and that the deleted check asserted nothing about this repo beyond the two-file cmp. Depends on: allod/tools#224 merges first; it adds the check this PR deletes

allod-agent added 1 commit

2026-09-22 20:40:26 +01:00

Drop credential-store-url-parity: allod/tools carries its own copy now 150f7208c0

The check compared allod/tools' vector-table copy against the secrets
input by literal filename, which only means what it says when secrets
is the template; against a fork's own data repo it silently asserts
allod/tools matches the fork's table instead, failing or passing for
reasons unrelated to the fork. Deleting checks/credential-store-url-parity.nix
and its checks/default.nix entry removes the last framework check that
reads a data input's contents by name (allod/archetypes#88), and drops
the allod-tools argument from checks/default.nix and the checks import
in flake.nix now that nothing else there consumes it; flake.nix still
uses allod-tools for the dev and hypervisor builders.

The fork fixture keeps checks/fork-fixture/secrets/credential-store-url.json:
its own isCredentialStoreUrlTemplate predicate and the credential-profiles
check's accept/reject floor still read it. Reworded the comment above
that binding and the truncation-floor comment in credential-profiles.nix
so neither names a check this repo no longer carries; the byte-for-byte
parity is now asserted in allod/tools, against allod/secrets.

Refs allod/archetypes#110