Move the builders out of flake.nix into nix/builders/ #99

Merged

vnprc merged 2 commits from agent/builders-out-of-flake into master

2026-09-22 03:35:16 +01:00

allod-agent commented

2026-09-22 02:20:12 +01:00

Member

The three builders move out of flake.nix into nix/builders/, and nothing a machine builds changes: every machine's toplevel derivation path, every check's derivation path on template data and on the fork fixtures, and the exported lib, vmFacts and nixosModules are byte-identical before and after. flake.nix goes from 777 lines to 413 and is now inputs, the profile-definition merge, the composition and the exports. Builder signatures and defaults are untouched; that is allod/archetypes#92. What proves it is the derivation-path comparison plus ./check.sh and ./fork-safety.sh green on this branch. If it is wrong, revert the one commit.

What changed

nix/builders/shared.nix: guestModuleFor and sharedModules.
nix/builders/dev.nix: mkDevVm with its helpers mkGithubCredentialModule (private) and memoryTraceModules (exported, because checks/default.nix takes it by name).
nix/builders/privacy.nix: mkPrivacyVm. nix/builders/hypervisor.nix: mkHypervisor, which composes no guest module, as before.
flake.nix imports the four and binds the same names, so builders, machineConfigurations and the checks call are unchanged. secretsInput = secrets; and the "no service builder" note above builders stay where they were.
Path literals shifted ./modules/x to ../../modules/x, which resolves to the same file. README gains a "Builders" section naming the layout.

Risk

R2. A pure move of the builders with the same witness allod/archetypes#93 used; the witness covers every production machine and every check fixture. A builder default no machine and no check exercises could in principle resolve differently after the move, which the review below was asked to enumerate. Rollback is a straight revert. Sequenced against allod/archetypes#92 as the issue says: this lands first because #92 has no PR yet.

Validation

Derivation paths captured one nix process per item on master (after allod/archetypes#96) and on the branch, template data and fork fixtures: 4 machines, 19 checks, 19 fork checks, plus vmFacts, lib and nixosModules. All identical, re-diffed by the integrator.
./check.sh on this branch, run by the integrator on the move commit (cdf8cfe): All 32 steps passed (checks: 19 built). The one later commit changes comments only, verified by diffing non-comment lines (zero).
./fork-safety.sh on the same commit: All 19 checks are fork-safe (19 built).
Every file parses (nix-instantiate --parse); each builder file's argument list was derived from parse-time undefined-variable errors.
One cold cross-family review of the diff (gpt-5.6-terra on codex, high effort): two findings, both comments the move made false (the secrets-shadowing sentence in dev.nix, and "the VM builders above" in hypervisor.nix), fixed in the second commit after a grep of all four files for other location words found none.

Closes allod/archetypes#98

The three builders move out of `flake.nix` into `nix/builders/`, and nothing a machine builds changes: every machine's toplevel derivation path, every check's derivation path on template data and on the fork fixtures, and the exported `lib`, `vmFacts` and `nixosModules` are byte-identical before and after. `flake.nix` goes from 777 lines to 413 and is now inputs, the profile-definition merge, the composition and the exports. Builder signatures and defaults are untouched; that is allod/archetypes#92. What proves it is the derivation-path comparison plus `./check.sh` and `./fork-safety.sh` green on this branch. If it is wrong, revert the one commit. ## What changed - `nix/builders/shared.nix`: `guestModuleFor` and `sharedModules`. - `nix/builders/dev.nix`: `mkDevVm` with its helpers `mkGithubCredentialModule` (private) and `memoryTraceModules` (exported, because `checks/default.nix` takes it by name). - `nix/builders/privacy.nix`: `mkPrivacyVm`. `nix/builders/hypervisor.nix`: `mkHypervisor`, which composes no guest module, as before. - `flake.nix` imports the four and binds the same names, so `builders`, `machineConfigurations` and the checks call are unchanged. `secretsInput = secrets;` and the "no service builder" note above `builders` stay where they were. - Path literals shifted `./modules/x` to `../../modules/x`, which resolves to the same file. README gains a "Builders" section naming the layout. ## Risk R2. A pure move of the builders with the same witness allod/archetypes#93 used; the witness covers every production machine and every check fixture. A builder default no machine and no check exercises could in principle resolve differently after the move, which the review below was asked to enumerate. Rollback is a straight revert. Sequenced against allod/archetypes#92 as the issue says: this lands first because #92 has no PR yet. ## Validation - Derivation paths captured one `nix` process per item on master (after allod/archetypes#96) and on the branch, template data and fork fixtures: 4 machines, 19 checks, 19 fork checks, plus `vmFacts`, `lib` and `nixosModules`. All identical, re-diffed by the integrator. - `./check.sh` on this branch, run by the integrator on the move commit (`cdf8cfe`): `All 32 steps passed (checks: 19 built).` The one later commit changes comments only, verified by diffing non-comment lines (zero). - `./fork-safety.sh` on the same commit: `All 19 checks are fork-safe (19 built).` - Every file parses (`nix-instantiate --parse`); each builder file's argument list was derived from parse-time undefined-variable errors. - One cold cross-family review of the diff (`gpt-5.6-terra` on codex, high effort): two findings, both comments the move made false (the `secrets`-shadowing sentence in `dev.nix`, and "the VM builders above" in `hypervisor.nix`), fixed in the second commit after a grep of all four files for other location words found none. Closes allod/archetypes#98

allod-agent added 2 commits

2026-09-22 02:20:12 +01:00

Move the three builders out of flake.nix into nix/builders/ cdf8cfef45

mkDevVm, mkPrivacyVm, and mkHypervisor move to nix/builders/dev.nix,
privacy.nix, and hypervisor.nix, each a function of exactly the flake
inputs and helpers it uses. sharedModules and guestModuleFor move to
nix/builders/shared.nix beside them; mkDevVm's two dev-builder helpers,
mkGithubCredentialModule and memoryTraceModules, move into dev.nix, and
memoryTraceModules is exported alongside mkDevVm since checks/default.nix
reads it by name. flake.nix imports the four files and binds
mkDevVm/mkPrivacyVm/mkHypervisor to the same names, so builders,
machineConfigurations, and checks are unchanged. The secretsInput
shadowing arrangement is unchanged, as is every builder's signature and
defaults (allod/archetypes#92 is separate). flake.nix goes from 777 lines
to 414. README gains a short Builders section on the new layout.

Refs allod/archetypes#98

Fix two comments the move made false 558fc14dae

nix/builders/dev.nix: the mkDevVm argument comment said secrets shadows a
secrets flake input in this body; there is no such input in scope here,
only the secretsInput parameter. Say the argument defaults to
secretsInput, the flake input handed in under that name.

nix/builders/hypervisor.nix: "the VM builders above" pointed at dev.nix
and privacy.nix, which are no longer above this comment now that the
builders live in separate files. Name them.

Refs allod/archetypes#98