credential-profiles: accept a value-template local-auth-refresh source #76

Merged

vnprc merged 1 commit from agent/local-auth-refresh-template into master

2026-09-12 02:23:22 +01:00

allod-agent commented

2026-09-12 01:07:46 +01:00

Member

Nothing changes on a running machine: this PR only widens one build-time check. The credential-profiles check that guards local_auth_refresh now accepts the group's source credential in either its current registry shape (format = "credential-store-url") or the new shape from allod/secrets#23: a value.template that is exactly one https://<user>:{secret}@<host> line, with the same character classes and the same blank-line rule the netrc activation script applies at runtime. Every existing witness in the check is unchanged and the current registry still validates. The proof is nix flake check: the exact contract template is accepted, and every rejected template class has a sabotage fixture that fails on the predicate itself, not on some other rule. This is the first of three PRs to merge, so the check never rejects the secrets template's new example. If it is wrong, revert it; no generated artifact, unit, or machine state depends on this check.

What changes

flake.nix, inside the credential-profiles check: a new isCredentialStoreUrlTemplate predicate and an isCredentialStoreUrlSource union replace the literal format == "credential-store-url" test for a local_auth_refresh source credential. A credential carrying both format and value is refused (mixed shapes fail closed).
The predicate mirrors modules/netrc.nix: blank lines are dropped the way awk 'NF' drops them (space and tab only), exactly one non-empty line must remain, and that line must match the netrc sed grammar with {secret} as the whole password and nowhere else. No value.encode is allowed.
Positive fixtures accept the exact contract template, its single-trailing-newline form, and a blank-line-padded form. Sabotage fixtures cover: placeholder in the user position, missing or duplicated placeholder, colon or whitespace in the user, empty user, missing host, path suffix, whitespace in the host, second non-empty line, non-https scheme, zero non-empty lines, trailing text after the placeholder, leading whitespace, a carriage-return-only line, a non-string template, an encoding on the template, a mixed legacy-plus-template credential, and a plain new-shape credential with no value. Each is counted as caught only when the predicate's own error fires.
Nothing outside that check changes; no module, unit, or activation script is touched.

Risk

R3 in the plan (cross-repo validation of generated credential deployment). Residual after the checks: the predicate accepts a template whose rendered file the netrc script rejects. That failure is loud at the next rebuild (netrc activation: expected exactly one non-empty credential line or malformed credential line, exit 1), not silent, and the two-review pass found and fixed the one such gap (carriage-return-only lines). Rollback is a revert of this PR.

Validation

nix flake check . in the worktree (plain path per nix.md): ``all checks passed!, exit 0
git diff --check: no output, exit 0
Witness falsification: with the predicate forced to accept everything, the check fails naming the template mutations (``nix eval .#checks.x86_64-linux.credential-profiles.drvPathexits 1 witherror: credential-profiles: local_auth_refresh mutation checks did not fail as expected: template placeholder in user: accepted, template missing placeholder: accepted, ... naming all eighteen template mutations); restored afterwards.
Cross-family cold reviews of the pre-fix diff, both through the pi runner on provider nullsink-claude: claude-opus-5 at thinking high (1 blocker, 4 gaps, 1 simplify) and claude-fable-5-1 (thinking not exposed on that route; 2 gaps, 1 question, 1 simplify). Both flagged the blank-line rule mismatch, the mixed-shape short-circuit, missing sabotage classes, and the inverted positive-witness diagnostic; all accepted and fixed in this diff. The author of the original diff was a Codex model, so both reviewers are cross-family.
Not run: nothing here evaluates on a real machine; the check is the witness.

Refs allod/secrets#23

Nothing changes on a running machine: this PR only widens one build-time check. The `credential-profiles` check that guards `local_auth_refresh` now accepts the group's source credential in either its current registry shape (`format = "credential-store-url"`) or the new shape from allod/secrets#23: a `value.template` that is exactly one `https://<user>:{secret}@<host>` line, with the same character classes and the same blank-line rule the netrc activation script applies at runtime. Every existing witness in the check is unchanged and the current registry still validates. The proof is `nix flake check`: the exact contract template is accepted, and every rejected template class has a sabotage fixture that fails on the predicate itself, not on some other rule. This is the first of three PRs to merge, so the check never rejects the secrets template's new example. If it is wrong, revert it; no generated artifact, unit, or machine state depends on this check. ## What changes - `flake.nix`, inside the `credential-profiles` check: a new `isCredentialStoreUrlTemplate` predicate and an `isCredentialStoreUrlSource` union replace the literal `format == "credential-store-url"` test for a `local_auth_refresh` source credential. A credential carrying both `format` and `value` is refused (mixed shapes fail closed). - The predicate mirrors `modules/netrc.nix`: blank lines are dropped the way `awk 'NF'` drops them (space and tab only), exactly one non-empty line must remain, and that line must match the netrc `sed` grammar with `{secret}` as the whole password and nowhere else. No `value.encode` is allowed. - Positive fixtures accept the exact contract template, its single-trailing-newline form, and a blank-line-padded form. Sabotage fixtures cover: placeholder in the user position, missing or duplicated placeholder, colon or whitespace in the user, empty user, missing host, path suffix, whitespace in the host, second non-empty line, non-`https` scheme, zero non-empty lines, trailing text after the placeholder, leading whitespace, a carriage-return-only line, a non-string template, an encoding on the template, a mixed legacy-plus-template credential, and a plain new-shape credential with no `value`. Each is counted as caught only when the predicate's own error fires. - Nothing outside that check changes; no module, unit, or activation script is touched. ## Risk R3 in the plan (cross-repo validation of generated credential deployment). Residual after the checks: the predicate accepts a template whose rendered file the netrc script rejects. That failure is loud at the next rebuild (`netrc activation: expected exactly one non-empty credential line` or `malformed credential line`, exit 1), not silent, and the two-review pass found and fixed the one such gap (carriage-return-only lines). Rollback is a revert of this PR. ## Validation - `nix flake check .` in the worktree (plain path per `nix.md`): ``all checks passed!`, exit 0` - `git diff --check`: `no output, exit 0` - Witness falsification: with the predicate forced to accept everything, the check fails naming the template mutations (``nix eval .#checks.x86_64-linux.credential-profiles.drvPath` exits 1 with `error: credential-profiles: local_auth_refresh mutation checks did not fail as expected: template placeholder in user: accepted, template missing placeholder: accepted, ...` naming all eighteen template mutations`); restored afterwards. - Cross-family cold reviews of the pre-fix diff, both through the `pi` runner on provider `nullsink-claude`: `claude-opus-5` at thinking `high` (1 blocker, 4 gaps, 1 simplify) and `claude-fable-5-1` (thinking not exposed on that route; 2 gaps, 1 question, 1 simplify). Both flagged the blank-line rule mismatch, the mixed-shape short-circuit, missing sabotage classes, and the inverted positive-witness diagnostic; all accepted and fixed in this diff. The author of the original diff was a Codex model, so both reviewers are cross-family. - Not run: nothing here evaluates on a real machine; the check is the witness. Refs allod/secrets#23

allod-agent added 1 commit

2026-09-12 01:07:46 +01:00

credential-profiles: accept a value-template local_auth_refresh source 6e2d0626d8

The local_auth_refresh source predicate accepts either the legacy
credential-store-url format or a value.template that is exactly one
netrc credential-store line with {secret} in the password position,
matching modules/netrc.nix byte for byte, including its awk blank-line
rule. A credential carrying both format and value is refused. Positive
witnesses cover the canonical template and one sabotage fixture per
rejected template class, each pinned to the predicate's own error.

Refs allod/secrets#23

vnprc force-pushed agent/local-auth-refresh-template from 6e2d0626d8 to eff0ec35b4

2026-09-12 02:16:57 +01:00

Compare