Add check.sh: a stopgap gate that runs the checks one step at a time #6

Merged

vnprc merged 1 commit from agent/check-gate into master

2026-09-28 03:20:51 +01:00

allod-agent commented

2026-09-27 21:55:22 +01:00

Member

Owner summary

What changes on a running machine: nothing. This adds a script and a README section to the repository; no machine builds or runs either.
What it gives you: ./check.sh in this repository runs the checks one step at a time, so a fork with a real fleet can be checked on an 8 GiB dev VM, where nix flake check is killed for running out of memory.
What stays identical: flake.nix, flake.lock, and every machine built from them.
What proves it: run on this branch on a dev VM, all 6 steps passed and 1 check was built, in 1 min 9 s, the largest single process peaking at 1.2 GiB.
This is a stopgap. allod/tools#239 replaces it with one command shared by every repository, and deletes this script when that command has landed.
If it is wrong: revert this PR. Nothing depends on the script.

Refs allod/tools#239

What it does

check.sh finds the archetypes source that flake.lock pins and runs that revision's own check.sh against this flake. The gate and the checks it runs therefore come from one revision, and no separate checkout of the framework is needed. It takes no arguments and exits 2 when given one.

Risk

R1. No runtime, generated, or operational behavior. The script only reads the flake and builds its checks.

One limit, stated in the README section it adds: the script cannot pass an input override, so an unmerged branch of a data repository is proven by building the checks that read it one at a time. Overrides are part of allod/tools#239.

Validation

Run by the integrator on 58ddbf7, on an 8 GiB dev VM with Nix 2.34.8:

Command	Result
`./check.sh`	exit 0. Steps: passive output `vmFacts`; machines `allod-dev`, `installer`, `nexus`, `privacy-1`; check `x86_64-linux.composed-layer` (built). "All 6 steps passed (checks: 1 built)."
`./check.sh extra`	exit 2, prints usage

That the gate itself can fail is proven where the gate lives, by check-selftest.sh in allod/archetypes; it was not rerun for this PR.

Not run: the script against a deployment fork. The measurements for that are in allod/tools#239.

## Owner summary - **What changes on a running machine:** nothing. This adds a script and a README section to the repository; no machine builds or runs either. - **What it gives you:** `./check.sh` in this repository runs the checks one step at a time, so a fork with a real fleet can be checked on an 8 GiB dev VM, where `nix flake check` is killed for running out of memory. - **What stays identical:** `flake.nix`, `flake.lock`, and every machine built from them. - **What proves it:** run on this branch on a dev VM, all 6 steps passed and 1 check was built, in 1 min 9 s, the largest single process peaking at 1.2 GiB. - **This is a stopgap.** allod/tools#239 replaces it with one command shared by every repository, and deletes this script when that command has landed. - **If it is wrong:** revert this PR. Nothing depends on the script. Refs allod/tools#239 ## What it does `check.sh` finds the `archetypes` source that `flake.lock` pins and runs that revision's own `check.sh` against this flake. The gate and the checks it runs therefore come from one revision, and no separate checkout of the framework is needed. It takes no arguments and exits 2 when given one. ## Risk R1. No runtime, generated, or operational behavior. The script only reads the flake and builds its checks. One limit, stated in the README section it adds: the script cannot pass an input override, so an unmerged branch of a data repository is proven by building the checks that read it one at a time. Overrides are part of allod/tools#239. ## Validation Run by the integrator on `58ddbf7`, on an 8 GiB dev VM with Nix 2.34.8: | Command | Result | | --- | --- | | `./check.sh` | exit 0. Steps: passive output `vmFacts`; machines `allod-dev`, `installer`, `nexus`, `privacy-1`; check `x86_64-linux.composed-layer` (built). "All 6 steps passed (checks: 1 built)." | | `./check.sh extra` | exit 2, prints usage | That the gate itself can fail is proven where the gate lives, by `check-selftest.sh` in `allod/archetypes`; it was not rerun for this PR. Not run: the script against a deployment fork. The measurements for that are in allod/tools#239.

allod-agent added 1 commit

2026-09-27 21:55:22 +01:00

Add check.sh: run the framework's per-step gate against this flake 58ddbf70ec

nix flake check evaluates every machine and check in one process, and a
fork with a real fleet is OOM-killed on an 8 GiB dev VM. check.sh runs the
gate carried by the pinned archetypes revision instead, one nix process
per step.

allod-agent referenced this pull request from allod/tools

2026-09-27 21:59:30 +01:00

Ship the check gate as a tools command: one way to run checks in every repo and fork #239