Name the thing, not its position, in the checks' messages #113

Merged

vnprc merged 2 commits from agent/name-the-thing-in-check-messages into master

2026-09-23 15:38:09 +01:00

allod-agent commented

2026-09-23 05:37:59 +01:00

Member

Summary

Nothing changes for any running machine: the four composed machines' toplevel derivations are identical to master. What changes is the text a failing check prints. A message that pointed at "the fixture above" or "the sweep below" now names the binding to look at, and a message that described a change ("no longer installs", "lost its decrypt step") now states what the check expects. Which checks this touches, and which of their derivations move, is listed under Validation: a message inside a check's build script is part of its derivation, so those checks rebuild by design, while a message in an evaluation-time assertion leaves the derivation alone. If a rewritten message reads worse than the old one, the fix is a wording edit to the same string; nothing else depends on it.

What changed

Seven files under checks/, message strings only:

dev-forge-opt-out.nix: the with-access projection, the empty-inventory guard and the composed sweep name withAccess, expectedWithAccess, composedDevMismatches and expectedComposedDevSecrets; the three build-script errors name withAccessInstall and say what it lacks.
host-user-credentials.nix: the same six shapes with expectedComposedHypervisorSecrets.
ssh-settings.nix: the second-author message states what the module system must do instead of what it "no longer" does.
credential-profiles.nix: the missing-registry-entry guard names the vector bindings and the assertion that would prove nothing; the floor message states the floor and the count found instead of "has shrunk".
pi-integration.nix: the missing-package guard names piFixtureScript; three build-script errors say what the generated text lacks.
pi-provider-lifecycle.nix: two "lost" messages now say what the generated activation lacks.
consumed-file-carve-out.nix: the build-script error names expectedComposedFile.

Not touched: comments (allod/archetypes#101 owned those), the warnEcho "... see ERROR above ..." strings in modules/, whose "above" is a terminal position, and the token-form assertions in checks/dev-forge-opt-out.nix and checks/host-user-credentials.nix, which allod/archetypes#112 (#70) rewrites in the same style. Left alone after the sweep: checks/pi-provider-lifecycle/run.sh "accepted a lost managed provider", where "lost" is the domain word for a provider gone missing, and every remaining grep hit for the position and history words, all of which are comments.

Risk

R1: message strings only; no logic, binding or comment changed. Worst credible failure is a message that misnames its sibling, caught by reading the diff. Rollback is a revert.

Validation

./check.sh on the branch: all 31 steps passed (18 checks built), run on the committed head.
Machine derivations: all four toplevel drvPaths identical to a master run of the same gate.
Check derivations that moved, and why: consumed-file-carve-out, dev-forge-opt-out, host-user-credentials, pi-integration. Each has a rewritten echo "ERROR: ..." line inside its runCommand script, which is a derivation input.
Check derivations that did not move despite edited messages: those whose edits are all in lib.assertMsg messages, which run at evaluation time and are not inputs of the runCommand: credential-profiles, pi-provider-lifecycle, ssh-settings, out paths identical to master; the eleven untouched checks are identical as well.

Note on ordering with allod/archetypes#112: both PRs edit checks/dev-forge-opt-out.nix and checks/host-user-credentials.nix in adjacent assertion lines, in different hunks. Merge #112 first; if the forge then reports a conflict here, the resolution keeps both sides' lines, and I will merge master into this branch on request.

Closes allod/archetypes#106

## Summary Nothing changes for any running machine: the four composed machines' toplevel derivations are identical to master. What changes is the text a failing check prints. A message that pointed at "the fixture above" or "the sweep below" now names the binding to look at, and a message that described a change ("no longer installs", "lost its decrypt step") now states what the check expects. Which checks this touches, and which of their derivations move, is listed under Validation: a message inside a check's build script is part of its derivation, so those checks rebuild by design, while a message in an evaluation-time assertion leaves the derivation alone. If a rewritten message reads worse than the old one, the fix is a wording edit to the same string; nothing else depends on it. ## What changed Seven files under `checks/`, message strings only: - `dev-forge-opt-out.nix`: the with-access projection, the empty-inventory guard and the composed sweep name `withAccess`, `expectedWithAccess`, `composedDevMismatches` and `expectedComposedDevSecrets`; the three build-script errors name `withAccessInstall` and say what it lacks. - `host-user-credentials.nix`: the same six shapes with `expectedComposedHypervisorSecrets`. - `ssh-settings.nix`: the second-author message states what the module system must do instead of what it "no longer" does. - `credential-profiles.nix`: the missing-registry-entry guard names the vector bindings and the assertion that would prove nothing; the floor message states the floor and the count found instead of "has shrunk". - `pi-integration.nix`: the missing-package guard names `piFixtureScript`; three build-script errors say what the generated text lacks. - `pi-provider-lifecycle.nix`: two "lost" messages now say what the generated activation lacks. - `consumed-file-carve-out.nix`: the build-script error names `expectedComposedFile`. Not touched: comments (allod/archetypes#101 owned those), the `warnEcho "... see ERROR above ..."` strings in `modules/`, whose "above" is a terminal position, and the token-form assertions in `checks/dev-forge-opt-out.nix` and `checks/host-user-credentials.nix`, which allod/archetypes#112 (#70) rewrites in the same style. Left alone after the sweep: `checks/pi-provider-lifecycle/run.sh` "accepted a lost managed provider", where "lost" is the domain word for a provider gone missing, and every remaining grep hit for the position and history words, all of which are comments. ## Risk R1: message strings only; no logic, binding or comment changed. Worst credible failure is a message that misnames its sibling, caught by reading the diff. Rollback is a revert. ## Validation - `./check.sh` on the branch: all 31 steps passed (18 checks built), run on the committed head. - Machine derivations: all four toplevel drvPaths identical to a master run of the same gate. - Check derivations that moved, and why: `consumed-file-carve-out`, `dev-forge-opt-out`, `host-user-credentials`, `pi-integration`. Each has a rewritten `echo "ERROR: ..."` line inside its `runCommand` script, which is a derivation input. - Check derivations that did not move despite edited messages: those whose edits are all in `lib.assertMsg` messages, which run at evaluation time and are not inputs of the `runCommand`: `credential-profiles`, `pi-provider-lifecycle`, `ssh-settings`, out paths identical to master; the eleven untouched checks are identical as well. Note on ordering with allod/archetypes#112: both PRs edit `checks/dev-forge-opt-out.nix` and `checks/host-user-credentials.nix` in adjacent assertion lines, in different hunks. Merge #112 first; if the forge then reports a conflict here, the resolution keeps both sides' lines, and I will merge master into this branch on request. Closes allod/archetypes#106

allod-agent added 2 commits

2026-09-23 05:37:59 +01:00