credential-profiles: read secrets.lib.rotationRegistry #78

Merged

vnprc merged 4 commits from agent/rotation-registry-rename into master

2026-09-19 22:48:43 +01:00

allod-agent commented

2026-09-19 18:56:06 +01:00

Member

The credential-profiles check reads the credential rotation registry through its new flake export, secrets.lib.rotationRegistry, and names it that way in its one registry-wide assertion message. What changes for a running machine: nothing; this check is evaluation-only and its inputs and clauses are unchanged. What stays identical: every clause of the check, every other name in the flake, and the generated systems. What proves it: the check passes with the secrets input overridden to the branch of allod/secrets PR 31 (allod/secrets#31), and fails by attribute name without that override, which shows the read is strict. If it is wrong the symptom is attribute 'rotationRegistry' missing at evaluation, and the fix is a straight revert.

Not mergeable yet: flake.lock still pins secrets at a commit that exports only the old name, so credential-profiles fails until the secrets PR merges and a lock-bump commit is added here (the branch is not stacked on the secrets branch because master lands by rebase-merge and would carry a different hash). The bump is the last commit before merge; nothing else changes.

Refs allod/secrets#22

Risk

R3. A cross-repo interface is read by a new name from an evaluation-time check. Residual: only the ordering above; a wrong pin fails evaluation by name and changes no state.

Validation

Run by the integrator on the reviewed commits, from the worktree:

nix build .#checks.x86_64-linux.credential-profiles --no-link -L --override-input secrets path:<worktree of allod/secrets PR 31>: exit 0.
The same command without the override: exit 1 with error: attribute 'rotationRegistry' missing at flake.nix:625.
grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' . outside .git: no hits.

Cold review: gpt-5.6-sol via codex exec, default effort, read-only sandbox, on commit ab797361. Findings and disposition:

Blocker, the lock still pins the old secrets commit. Known and stated above; resolved by the lock bump after the secrets PR merges.
Minor, the target assertion message said "Forgejo token registry targets" although it reports targets from every registry group. Fixed in 2e48bc10, message text only; re-validated with the override build.
No missed consumers, no unsupported claims.

The `credential-profiles` check reads the credential rotation registry through its new flake export, `secrets.lib.rotationRegistry`, and names it that way in its one registry-wide assertion message. What changes for a running machine: nothing; this check is evaluation-only and its inputs and clauses are unchanged. What stays identical: every clause of the check, every other name in the flake, and the generated systems. What proves it: the check passes with the secrets input overridden to the branch of allod/secrets PR 31 (https://forge.anarch.diy/allod/secrets/pulls/31), and fails by attribute name without that override, which shows the read is strict. If it is wrong the symptom is `attribute 'rotationRegistry' missing` at evaluation, and the fix is a straight revert. Not mergeable yet: `flake.lock` still pins secrets at a commit that exports only the old name, so `credential-profiles` fails until the secrets PR merges and a lock-bump commit is added here (the branch is not stacked on the secrets branch because master lands by rebase-merge and would carry a different hash). The bump is the last commit before merge; nothing else changes. Refs allod/secrets#22 ## Risk R3. A cross-repo interface is read by a new name from an evaluation-time check. Residual: only the ordering above; a wrong pin fails evaluation by name and changes no state. ## Validation Run by the integrator on the reviewed commits, from the worktree: - `nix build .#checks.x86_64-linux.credential-profiles --no-link -L --override-input secrets path:<worktree of allod/secrets PR 31>`: exit 0. - The same command without the override: exit 1 with `error: attribute 'rotationRegistry' missing` at `flake.nix:625`. - `grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' .` outside `.git`: no hits. Cold review: `gpt-5.6-sol` via `codex exec`, default effort, read-only sandbox, on commit ab797361. Findings and disposition: - Blocker, the lock still pins the old secrets commit. Known and stated above; resolved by the lock bump after the secrets PR merges. - Minor, the target assertion message said "Forgejo token registry targets" although it reports targets from every registry group. Fixed in 2e48bc10, message text only; re-validated with the override build. - No missed consumers, no unsupported claims.

allod-agent added 2 commits

2026-09-19 18:56:07 +01:00

flake.nix: read secrets.lib.rotationRegistry, not forgejoTokenGroups ab79736197

The credential-profiles check's local binding named the secrets export
after Forgejo tokens even though the registry now covers other
credential kinds too. Rename the binding and its seven uses to
rotationRegistry, matching the renamed export on the secrets side.
profileOwnedForgejoTokenTargets and the other Forgejo-token-specific
names are untouched; only the registry binding moves.

Refs allod/secrets#22

credential-profiles: name the rotation registry in the target assertion 2e48bc10cf

Refs allod/secrets#22

allod-agent referenced this pull request from allod/secrets

2026-09-19 18:56:22 +01:00

Rename the rotation registry: forgejo-token-groups.json and lib.forgejoTokenGroups no longer say what they hold #22

allod-agent commented

2026-09-19 22:46:20 +01:00

Author

Member

allod/secrets PR 31 has merged, so this branch now carries a merge of master and the lock bump the body promised: the secrets input moves from 74eab12a to cc705d4e, the commit that exports lib.rotationRegistry. Nothing else changed.

Validation on the bumped commit, run by the integrator with no override: nix build .#checks.x86_64-linux.credential-profiles --no-link -L exits 0. The PR is mergeable now.

allod/secrets PR 31 has merged, so this branch now carries a merge of master and the lock bump the body promised: the `secrets` input moves from 74eab12a to cc705d4e, the commit that exports `lib.rotationRegistry`. Nothing else changed. Validation on the bumped commit, run by the integrator with no override: `nix build .#checks.x86_64-linux.credential-profiles --no-link -L` exits 0. The PR is mergeable now.

allod-agent added 2 commits

2026-09-19 22:46:20 +01:00

Merge remote-tracking branch 'origin/master' into agent/rotation-registry-rename c17ce94d3a

flake.lock: pin secrets at the rotation registry rename 92bf8a7133