credential-profiles: accept only a template as the local auth refresh source #77

Merged

vnprc merged 1 commit from agent/local-auth-template-only into master

2026-09-13 02:46:15 +01:00

allod-agent commented

2026-09-13 00:45:35 +01:00

Member

Summary

The credential-profiles check now accepts a local_auth_refresh source credential only when it is a value template that renders one credential-store line; the old branch that also accepted a legacy entry carrying format = "credential-store-url" is gone, and any entry carrying format at all fails closed. Every deployed machine is unchanged: the predicate lives in a flake check, not in a module, and the registry the check reads has no format entry left, so the check's positive path evaluates exactly as before. The full ./check.sh run (28 steps) passed with the change, and the three mutation fixtures that hand the check an entry with format or without a template still fail on the named source-credential clause. If it is wrong, revert this one commit; the check goes back to accepting both shapes.

Refs allod/secrets#27

Change

isCredentialStoreUrlSource in flake.nix is now !(credential ? format) && isCredentialStoreUrlTemplate credential; its comment explains that format is an unknown field on the registry's current shape.
The two mutation fixtures that pin fail-closed behaviour on format are relabelled without the word legacy; their logic and the clause they assert on are unchanged.
The fixture builders read the pinned registry, which is already template-shaped, so no positive fixture had to move.

Risk

R2. A validator narrowing inside a check, with the fail-closed cases pinned by mutation fixtures; no module, unit, or deployed file changes; rollback is a straight revert.

Validation

./check.sh in the worktree: All 28 steps passed. (1m04s). Cold cross-family review by gpt-5.5 (codex, read-only sandbox) on the diff: no findings, having read flake.nix, the local refresh fixtures, and the netrc and github-credentials consumers.

## Summary The `credential-profiles` check now accepts a `local_auth_refresh` source credential only when it is a value template that renders one credential-store line; the old branch that also accepted a legacy entry carrying `format = "credential-store-url"` is gone, and any entry carrying `format` at all fails closed. Every deployed machine is unchanged: the predicate lives in a flake check, not in a module, and the registry the check reads has no `format` entry left, so the check's positive path evaluates exactly as before. The full `./check.sh` run (28 steps) passed with the change, and the three mutation fixtures that hand the check an entry with `format` or without a template still fail on the named source-credential clause. If it is wrong, revert this one commit; the check goes back to accepting both shapes. Refs allod/secrets#27 ## Change - `isCredentialStoreUrlSource` in `flake.nix` is now `!(credential ? format) && isCredentialStoreUrlTemplate credential`; its comment explains that `format` is an unknown field on the registry's current shape. - The two mutation fixtures that pin fail-closed behaviour on `format` are relabelled without the word legacy; their logic and the clause they assert on are unchanged. - The fixture builders read the pinned registry, which is already template-shaped, so no positive fixture had to move. ## Risk R2. A validator narrowing inside a check, with the fail-closed cases pinned by mutation fixtures; no module, unit, or deployed file changes; rollback is a straight revert. ## Validation `./check.sh` in the worktree: `All 28 steps passed.` (1m04s). Cold cross-family review by gpt-5.5 (codex, read-only sandbox) on the diff: no findings, having read `flake.nix`, the local refresh fixtures, and the netrc and github-credentials consumers.

allod-agent added 1 commit

2026-09-13 00:45:35 +01:00