Compose the named-token credential graph

allod-agent commented

2026-08-22 19:11:58 +01:00

Member

This PR completes the named-token feature by binding the deploy graph to the three reviewed implementation branches and teaching the composition canary the new credential projections. On a running machine nothing changes until pins are updated and rebuilt: the public registries are empty, so no credential or token exists yet. What changes is which framework revisions deploy composes and what the canary proves: empty public data stays inert, the synthetic per-token projection shape is exactly what secrets emits, an invalid default is rejected, and each follows edge still fails closed when sabotaged. What proves it is the composed-layer check built green over the pinned graph. If it is wrong, revert this PR or re-pin to the previous master revisions and the prior graph returns. Before merge, the three pinned branches must merge first and the pins here must move to their master merge commits.

Risk

R2 per the plan's slice table: this changes only the pinned input graph and eval-time canary assertions; no runtime behavior exists with empty public data, and rollback is a straight revert. The pins currently name the three agent branches (archetypes 9ba5883, nexus 0a9b30e via archetypes/nexus, secrets 9d637b1) per the established lock-only precedent for unmerged upstream work; they must be re-pinned to master merge commits before this PR merges.

Validation

nix build path:.#checks.x86_64-linux.composed-layer — green from this worktree over the pinned graph, exercising the empty public assertions, the synthetic multi-token fixture with null-default case, the provider join, the default sabotage rejection, and the four follows sabotage witnesses.

Closes allod/strategy#36

This PR completes the named-token feature by binding the deploy graph to the three reviewed implementation branches and teaching the composition canary the new credential projections. On a running machine nothing changes until pins are updated and rebuilt: the public registries are empty, so no credential or token exists yet. What changes is which framework revisions deploy composes and what the canary proves: empty public data stays inert, the synthetic per-token projection shape is exactly what secrets emits, an invalid default is rejected, and each follows edge still fails closed when sabotaged. What proves it is the composed-layer check built green over the pinned graph. If it is wrong, revert this PR or re-pin to the previous master revisions and the prior graph returns. Before merge, the three pinned branches must merge first and the pins here must move to their master merge commits. ## Risk R2 per the plan's slice table: this changes only the pinned input graph and eval-time canary assertions; no runtime behavior exists with empty public data, and rollback is a straight revert. The pins currently name the three agent branches (archetypes 9ba5883, nexus 0a9b30e via archetypes/nexus, secrets 9d637b1) per the established lock-only precedent for unmerged upstream work; they must be re-pinned to master merge commits before this PR merges. ## Validation nix build path:.#checks.x86_64-linux.composed-layer — green from this worktree over the pinned graph, exercising the empty public assertions, the synthetic multi-token fixture with null-default case, the provider join, the default sabotage rejection, and the four follows sabotage witnesses. Closes allod/strategy#36

allod-agent added 1 commit

2026-08-22 19:11:59 +01:00

Compose the named-token credential graph and extend the canary 2f441e5fef

Pins move archetypes, archetypes/nexus, and secrets to the reviewed named-token branches, keeping flake.nix at the template shape per the lock-only precedent for unmerged upstream work. The canary now asserts empty public Pi projections across dev VMs, an exact synthetic multi-token projection through secrets lib.mkPiCredentialContract including the null-default case and per-token ciphertext paths, the provider join, and rejection of an unlisted default, alongside the unchanged four follows-edge sabotage witnesses.

Refs allod/strategy#36

Model: gpt-5.6-terra

allod-agent commented

2026-08-22 19:19:52 +01:00

Author

Member

Review pass (required post-open review): read-only review by gpt-5.6-sol at reasoning high (author was gpt-5.6-terra). Both findings are fixed in the follow-up commit: the lock had silently reverted the transitive allod-tools pin while re-locking archetypes to its agent branch (restored — the lock now moves exactly the three reviewed revisions against origin/master), and the activation-projection half of the deploy contract is now discharged by building the archetypes pi-provider-lifecycle witness through this flake's follows-redirected inputs inside the composed-layer check. nix build path:.#checks.x86_64-linux.composed-layer re-run green by the managing agent from this worktree, building the composed lifecycle witness.

allod-agent added 1 commit

2026-08-22 19:19:54 +01:00

Restore the tools pin and route the lifecycle witness through the composition 44baf16aa8

Re-locking archetypes to its agent branch had silently reverted the transitive allod-tools pin that deploy master carried; it is restored, so the lock now moves exactly the three reviewed branch revisions. The composed-layer check additionally builds the archetypes pi-provider-lifecycle witness evaluated through this flake's follows-redirected inputs, so generated activation and secret projections are exercised on the composed graph rather than only in the upstream checkout.

Refs allod/strategy#36

Model: gpt-5.6-sol

allod-agent added 1 commit

2026-08-24 02:00:37 +01:00

Track the merged-forward archetypes branch b6004e0d15

The archetypes PR branch merged its master's fleet lock update, so the archetypes pin moves to the new tip f92fa59. Re-locking the parent again reverted the transitive nexus pin to master; it is re-pinned to the reviewed branch. The lock still moves exactly the three named-token revisions against master.

Refs allod/strategy#36

vnprc merged commit b6004e0d15 into master

2026-08-24 02:42:53 +01:00

vnprc deleted branch agent/named-tokens-composition

2026-08-24 02:42:53 +01:00

Rows
Columns

Compose the named-token credential graph #5

Risk

Validation