Compose managed Pi provider lifecycle

allod-agent commented

2026-08-21 04:19:21 +01:00

Member

The public deployment now pins the reviewed managed Pi provider lifecycle across framework, profiles, secrets, inventory, and Nexus.
All four data consumers use one source graph, including the inventory consumed by secrets.
A rebuilt Nexus contains the reviewed pi-provider command and all five lifecycle subcommands.
The public registries remain empty, so a never-configured machine gains no provider, credential, or Pi runtime artifact.
The composed-layer canary rejects an independently sabotaged profiles, secrets, inventory, or secrets-inventory edge.
The synthetic allod-dev and nexus systems build from the joined graph.
If this is wrong, leave the PR unmerged and keep the prior lock file; no private rollout or credential has been changed.

Dependencies

Risk

R3 High. This changes the deployment composition and pins a new credential lifecycle. Review should focus on exact input follows, lock provenance, the four sabotage witnesses, the realized Nexus command, and whether the empty public registry remains inert.

Validation

nix-instantiate --parse flake.nix
nix build .#checks.x86_64-linux.composed-layer --no-link -L
nix build .#nixosConfigurations.allod-dev.config.system.build.toplevel --no-link -L
nix build .#nixosConfigurations.nexus.config.system.build.toplevel --no-link --print-out-paths -L
The realized nexus-provisioning-scripts/bin/pi-provider is executable and --help lists add, retarget, rotate, retire, and recover.
git diff --check
Lock inspection confirms all reviewed exact heads, including Archetypes ddfccf0 and Nexus 18c64d0, plus secrets.inputs.inventory = ["inventory"] with no duplicate inventory node.

Refs allod/strategy#34

The public deployment now pins the reviewed managed Pi provider lifecycle across framework, profiles, secrets, inventory, and Nexus. All four data consumers use one source graph, including the inventory consumed by secrets. A rebuilt Nexus contains the reviewed `pi-provider` command and all five lifecycle subcommands. The public registries remain empty, so a never-configured machine gains no provider, credential, or Pi runtime artifact. The composed-layer canary rejects an independently sabotaged profiles, secrets, inventory, or secrets-inventory edge. The synthetic `allod-dev` and `nexus` systems build from the joined graph. If this is wrong, leave the PR unmerged and keep the prior lock file; no private rollout or credential has been changed. ## Dependencies - allod/profiles#6 - allod/secrets#13 - allod/inventory#12 - allod/archetypes#44 - allod/nexus#26 ## Risk R3 High. This changes the deployment composition and pins a new credential lifecycle. Review should focus on exact input follows, lock provenance, the four sabotage witnesses, the realized Nexus command, and whether the empty public registry remains inert. ## Validation - `nix-instantiate --parse flake.nix` - `nix build .#checks.x86_64-linux.composed-layer --no-link -L` - `nix build .#nixosConfigurations.allod-dev.config.system.build.toplevel --no-link -L` - `nix build .#nixosConfigurations.nexus.config.system.build.toplevel --no-link --print-out-paths -L` - The realized `nexus-provisioning-scripts/bin/pi-provider` is executable and `--help` lists add, retarget, rotate, retire, and recover. - `git diff --check` - Lock inspection confirms all reviewed exact heads, including Archetypes `ddfccf0` and Nexus `18c64d0`, plus `secrets.inputs.inventory = ["inventory"]` with no duplicate inventory node. Refs allod/strategy#34

allod-agent added 1 commit

2026-08-21 04:19:21 +01:00

Compose managed Pi provider lifecycle 132a9018e2

allod-agent commented

2026-08-21 04:23:31 +01:00

Author

Member

Independent read-only review found one blocker in 132a901:

flake.lock still pins the archetypes -> nexus node to a66ea960cd018bc1e31de8a30cb649f1dc1e8194, while the reviewed Nexus lifecycle command is PR #26 head dc503fa27374711bb8d0321140e328f48e503a49. The root graph maps archetypes.inputs.nexus to that stale nexus node. I realized the composed Nexus nexus-provisioning-scripts derivation and confirmed bin/pi-provider is absent while the pre-existing bin/rotate-token is present. Therefore rebuilding the Nexus configuration from this deployment does not install the command this final composition depends on, despite listing allod/nexus#26 as a dependency.

Direct fix: advance the transitive archetypes/nexus lock node to the reviewed PR #26 head (or its reachable merged revision), then rebuild the Nexus configuration or at minimum realize its nexus-provisioning-scripts package and assert bin/pi-provider exists. Keep the other reviewed pins and four follows edges unchanged.

Independent read-only review found one **blocker** in `132a901`: - `flake.lock` still pins the `archetypes -> nexus` node to `a66ea960cd018bc1e31de8a30cb649f1dc1e8194`, while the reviewed Nexus lifecycle command is PR #26 head `dc503fa27374711bb8d0321140e328f48e503a49`. The root graph maps `archetypes.inputs.nexus` to that stale `nexus` node. I realized the composed Nexus `nexus-provisioning-scripts` derivation and confirmed `bin/pi-provider` is absent while the pre-existing `bin/rotate-token` is present. Therefore rebuilding the Nexus configuration from this deployment does not install the command this final composition depends on, despite listing allod/nexus#26 as a dependency. Direct fix: advance the transitive `archetypes/nexus` lock node to the reviewed PR #26 head (or its reachable merged revision), then rebuild the Nexus configuration or at minimum realize its `nexus-provisioning-scripts` package and assert `bin/pi-provider` exists. Keep the other reviewed pins and four follows edges unchanged.

allod-agent referenced this pull request from allod/archetypes

2026-08-21 04:24:30 +01:00

Add managed Pi provider reconciliation #44

allod-agent added 1 commit

2026-08-21 04:33:10 +01:00

Pin reviewed Nexus lifecycle command e5dd5bcece

allod-agent commented

2026-08-21 04:35:51 +01:00

Author

Member

Resolved at e5dd5bc.

The deploy lock now composes archetypes 3811b3e with Nexus dc503fa; profiles 9d48e43, secrets 2692bef, and inventory 1a1ca7a remain on their reviewed heads. The four follows edges resolve to one profiles/secrets/inventory graph, with one inventory node.
I rebuilt the PR-composed Nexus toplevel and inspected its realized Home Manager package at /nix/store/lhrx16j85z6qv75nyiamvlx0dny686a9-nexus-provisioning-scripts. bin/pi-provider is executable, and --help lists add, retarget, rotate, retire, and recover.
The matching pure source validator succeeds; each profiles, secrets, inventory, and secrets-inventory sabotage fails independently.
Public provider/credential catalogs, per-VM Pi projections, and generated Pi Age-secret set remain empty.
Both machine builds, the composed-layer check, parse, and diff/status checks pass. The worktree remained clean.

No remaining findings in this scoped re-review.

Resolved at `e5dd5bc`. - The deploy lock now composes archetypes `3811b3e` with Nexus `dc503fa`; profiles `9d48e43`, secrets `2692bef`, and inventory `1a1ca7a` remain on their reviewed heads. The four follows edges resolve to one profiles/secrets/inventory graph, with one inventory node. - I rebuilt the PR-composed Nexus toplevel and inspected its realized Home Manager package at `/nix/store/lhrx16j85z6qv75nyiamvlx0dny686a9-nexus-provisioning-scripts`. `bin/pi-provider` is executable, and `--help` lists add, retarget, rotate, retire, and recover. - The matching pure source validator succeeds; each profiles, secrets, inventory, and secrets-inventory sabotage fails independently. - Public provider/credential catalogs, per-VM Pi projections, and generated Pi Age-secret set remain empty. - Both machine builds, the composed-layer check, parse, and diff/status checks pass. The worktree remained clean. No remaining findings in this scoped re-review.

allod-agent commented

2026-08-22 03:55:59 +01:00

Author

Member

The owner requested that this PR be rebased after a batch of changes landed on master. This branch is three base commits behind. I will rebase it last, refresh the exact archetypes/Nexus pins to their rebased heads, and rerun the source-graph, allod-dev, Nexus, and realized-command checks.

The owner requested that this PR be rebased after a batch of changes landed on `master`. This branch is three base commits behind. I will rebase it last, refresh the exact archetypes/Nexus pins to their rebased heads, and rerun the source-graph, `allod-dev`, Nexus, and realized-command checks.

allod-agent added 1 commit

2026-08-22 04:04:17 +01:00

Merge remote-tracking branch 'origin/master' into agent/pi-provider-composition 96029fdf8b

# Conflicts:
#	flake.lock

allod-agent commented

2026-08-22 04:04:37 +01:00

Author

Member

The branch is refreshed against current master without rewriting its public history. Merge head: 96029fdf8b40d5c3197baed5b7012f3104c43841; exact downstream pins: Archetypes ddfccf0a0b0bffa7294a44dcada76de2911d5cfb and Nexus 18c64d059688928694e8ff71c25cd17656efd230.

The expected lock-file conflict was resolved by retaining the new upstream graph and refreshing the feature pins. The composed-layer canary, allod-dev toplevel, and Nexus toplevel all build. The realized Nexus provisioning package contains executable bin/pi-provider, its help lists add/retarget/rotate/retire/recover, exact source/lock assertions pass, and diff/status checks are clean.

The branch is refreshed against current `master` without rewriting its public history. Merge head: `96029fdf8b40d5c3197baed5b7012f3104c43841`; exact downstream pins: Archetypes `ddfccf0a0b0bffa7294a44dcada76de2911d5cfb` and Nexus `18c64d059688928694e8ff71c25cd17656efd230`. The expected lock-file conflict was resolved by retaining the new upstream graph and refreshing the feature pins. The composed-layer canary, `allod-dev` toplevel, and Nexus toplevel all build. The realized Nexus provisioning package contains executable `bin/pi-provider`, its help lists add/retarget/rotate/retire/recover, exact source/lock assertions pass, and diff/status checks are clean.

vnprc merged commit 96029fdf8b into master

2026-08-22 04:16:51 +01:00

vnprc deleted branch agent/pi-provider-composition

2026-08-22 04:16:51 +01:00

Rows
Columns

Compose managed Pi provider lifecycle #4

Dependencies

Risk

Validation