Move the check suite out of flake.nix into checks/ #96

Merged

vnprc merged 1 commit from agent/checks-out-of-flake into master

2026-09-22 01:07:01 +01:00

allod-agent commented

2026-09-22 01:01:04 +01:00

Member

The check suite moves out of flake.nix into one file per check under checks/, and nothing a machine builds changes: every machine's toplevel derivation path and every check's derivation path, on the template data and on the fork fixtures, is byte-identical before and after. flake.nix goes from 3751 lines to 777 and is the composition again; each check declares what it reads in its own argument list, and checks/default.nix is the index that hands it those arguments. What proves it is the derivation-path comparison above plus ./check.sh and ./fork-safety.sh green on this branch. If it is wrong, revert the two commits; no other repo reads these files.

What changed

Thirteen checks that were inline in flake.nix are now checks/<name>.nix, each a function of exactly what it reads. Header comments moved with them. Root-relative path literals shifted for the new location (./checks/fixtures/… to ./fixtures/…, ./modules/… to ../modules/…), which resolves to the same source path and so the same store path.
The six checks that already delegated to a helper file (public-host, static-site, pi-integration, pi-provider-lifecycle, memory-traces, ssh-settings) take their fixture construction and input wiring into that file, so the file is the whole check. For public-host and static-site the wiring was only argument plumbing, which now lives in the index.
sameCarvedValue and githubTargetMatchesAgeSecret, which had no production caller, move to checks/carved-values.nix; the static-site fixture and index-name list move to checks/static-site-fixture.nix and the index. flake.nix keeps only what production or the exported lib uses.
checks/agent-vm-status.nix keeps its six-space indentation on purpose: its bash holds a line at column zero inside an indented string, so a dedent would change the script text and the derivation. Its header says so.
Derivation names inside every check are unchanged, so a fork that excludes or re-exports a check by name is unaffected. check.sh still evaluates one check per nix process; each index attribute is a thunk, so peak memory is unchanged.
README gains a short "Checks" section on the layout.

Not in scope, as the issue says: what any check asserts. The builder signatures (allod/archetypes#92) and a second composition for the fork witness (allod/archetypes#94) stay separate.

Risk

R2. A refactor of test apparatus only; no module, builder, machine, secret or provisioning path is touched, and the derivation-path witness covers every machine and every check on both data sets. What that witness cannot see: a check that is passed an argument it does not declare, or vice versa, would be an evaluation error when that check is forced, and every check was forced by the comparison, so that is covered too. Residual risk is prose that still describes the old layout and a future author copying a pattern from the index wrongly. Rollback is a straight revert.

Validation

Derivation paths, captured one nix process per item before and after the move on the same commit's inputs: 4 machines, 19 checks on template data, 19 checks against the fork fixtures, plus vmFacts, lib and nixosModules attribute sets. All identical.
./check.sh on this branch: All 32 steps passed (checks: 19 built).
./fork-safety.sh on this branch: All 19 checks are fork-safe (19 built).
Every file under checks/ and flake.nix parse cleanly; each check file's argument list was derived from parse-time undefined-variable errors, so no check closes over anything it does not declare.
One cold cross-family review of the diff (gpt-5.6-terra on codex, high effort): no findings, after reading the diffs of the four fused helper files, the index, the flake block and the README (the transcript shows the reads; an empty review was ruled out before it was read as approval).

Closes allod/archetypes#93

The check suite moves out of `flake.nix` into one file per check under `checks/`, and nothing a machine builds changes: every machine's toplevel derivation path and every check's derivation path, on the template data and on the fork fixtures, is byte-identical before and after. `flake.nix` goes from 3751 lines to 777 and is the composition again; each check declares what it reads in its own argument list, and `checks/default.nix` is the index that hands it those arguments. What proves it is the derivation-path comparison above plus `./check.sh` and `./fork-safety.sh` green on this branch. If it is wrong, revert the two commits; no other repo reads these files. ## What changed - Thirteen checks that were inline in `flake.nix` are now `checks/<name>.nix`, each a function of exactly what it reads. Header comments moved with them. Root-relative path literals shifted for the new location (`./checks/fixtures/…` to `./fixtures/…`, `./modules/…` to `../modules/…`), which resolves to the same source path and so the same store path. - The six checks that already delegated to a helper file (`public-host`, `static-site`, `pi-integration`, `pi-provider-lifecycle`, `memory-traces`, `ssh-settings`) take their fixture construction and input wiring into that file, so the file is the whole check. For `public-host` and `static-site` the wiring was only argument plumbing, which now lives in the index. - `sameCarvedValue` and `githubTargetMatchesAgeSecret`, which had no production caller, move to `checks/carved-values.nix`; the static-site fixture and index-name list move to `checks/static-site-fixture.nix` and the index. `flake.nix` keeps only what production or the exported `lib` uses. - `checks/agent-vm-status.nix` keeps its six-space indentation on purpose: its bash holds a line at column zero inside an indented string, so a dedent would change the script text and the derivation. Its header says so. - Derivation names inside every check are unchanged, so a fork that excludes or re-exports a check by name is unaffected. `check.sh` still evaluates one check per `nix` process; each index attribute is a thunk, so peak memory is unchanged. - README gains a short "Checks" section on the layout. Not in scope, as the issue says: what any check asserts. The builder signatures (allod/archetypes#92) and a second composition for the fork witness (allod/archetypes#94) stay separate. ## Risk R2. A refactor of test apparatus only; no module, builder, machine, secret or provisioning path is touched, and the derivation-path witness covers every machine and every check on both data sets. What that witness cannot see: a check that is passed an argument it does not declare, or vice versa, would be an evaluation error when that check is forced, and every check was forced by the comparison, so that is covered too. Residual risk is prose that still describes the old layout and a future author copying a pattern from the index wrongly. Rollback is a straight revert. ## Validation - Derivation paths, captured one `nix` process per item before and after the move on the same commit's inputs: 4 machines, 19 checks on template data, 19 checks against the fork fixtures, plus `vmFacts`, `lib` and `nixosModules` attribute sets. All identical. - `./check.sh` on this branch: `All 32 steps passed (checks: 19 built).` - `./fork-safety.sh` on this branch: `All 19 checks are fork-safe (19 built).` - Every file under `checks/` and `flake.nix` parse cleanly; each check file's argument list was derived from parse-time undefined-variable errors, so no check closes over anything it does not declare. - One cold cross-family review of the diff (`gpt-5.6-terra` on codex, high effort): no findings, after reading the diffs of the four fused helper files, the index, the flake block and the README (the transcript shows the reads; an empty review was ruled out before it was read as approval). Closes allod/archetypes#93

allod-agent added 1 commit

2026-09-22 01:01:04 +01:00

Move the check suite out of flake.nix into checks/ 0cae907e0c

Every check is now a file under checks/ that declares what it reads: the composed machines, the builders, the data inputs and the helpers production also uses. checks/default.nix is the index that hands each one its arguments, and flake.nix passes that index the composition and nothing else. The six checks that already delegated to a helper file take their fixture construction into that file; the two carve predicates and the static-site fixture, which had no production caller, move with them.

This is a move, not a change: every machine's toplevel derivation path and every check's derivation path, on the template data and on the fork fixtures, is byte-identical before and after. agent-vm-status keeps its flake.nix indentation because its bash holds a column-zero line inside an indented string.

Refs allod/archetypes#93