registry: validate the optional preview_port field #17

Merged

vnprc merged 1 commit from agent/preview-port into master

2026-09-28 14:36:06 +01:00

allod-agent commented

2026-09-28 00:13:43 +01:00

Member

What changes: an entry may carry the optional field preview_port. The repository-registry check refuses a value that is not an integer from 1024 to 65535, and refuses two repositories with the same one.
What stays identical: the registry file itself, vm-specs.json, every machine definition, and every existing rule of the check.
What proves it: the check now runs three fixture registries: one with an invalid port and one with a shared port, each refused with its own message, and one with a valid port, accepted. Disabling either rule turns the check red.
If it is wrong: revert this commit. The field has no reader until the allod/tools change for the same issue lands.

Refs allod/tools#240

Risk

R1. The change is confined to one flake check and the README. The worst credible failure is the check refusing a valid registry or accepting an invalid port; the first is visible at once as a red check, the second ends at allod site preview failing to bind. No machine state, secret or provisioning path is touched.

Validation

nix build .#checks.x86_64-linux.repository-registry -L --no-link --rebuild: exit 0. The three new lines are OK: an invalid preview_port fails with its pinned diagnostic, OK: two repositories sharing a preview_port fail with a pinned diagnostic, OK: a valid preview_port passes validation.
nix flake check: all checks passed!.
Range rule replaced with one that is always true: the check fails with ERROR: a preview_port outside 1024-65535 still passed validation. Restored.
Uniqueness rule weakened to need three sharers: the check fails with ERROR: two repositories sharing a preview_port still passed validation. Restored.
The invalid fixture is a present null, so it also shows the field's presence is tested with has(): a // empty test would read that entry as having no port and accept it.

Consumers of the registry

The issue asks for confirmation that readers are unaffected by an extra field. Every reader under the ten workspace repositories was read; each names the fields it wants, and the registry already carries one optional field, hookspath.

Reader	How it reads an entry
`allod/tools` `cmd/allod/registry.go`	`json.Unmarshal` into a struct with `checkout` only; unknown keys are ignored
`allod/tools` `git-hooks/setup-tracked-hooks`	`jq` `select(.value.hookspath and .value.checkout)`, prints those two fields
`allod/nexus` `scripts/lib/resolve-repos.sh`	`jq` on `.source`, `.remote`, `.checkout` by name; `bootstrap-vm`, `verify-vm`, `forge-ssh-key`, `vm-ssh-host-key`, `nexus-host-key` and `refresh-local-auth` go through it
`allod/nexus` `scripts/pi-provider`	a `jq` predicate over the same three named fields

No Nix code imports the file, nothing decodes it strictly, and nothing writes it back. A copy of allod/nexus tests/registry-resolver.sh with "preview_port": 8080 added to one fixture entry passed 15 of 15.

Not run with the field in their fixtures: allod/nexus tests/pi-provider.sh, allod/tools tests/git-hooks/setup-tracked-hooks.sh and tests/allod-patch.sh. Their readers are the ones in the table.

No external review pass: R1.

The repository registry may now say which port a site is previewed on, and the registry check refuses a port that is malformed or used twice. Nothing changes on a running machine: no entry in `scripts/repositories.json` gains the field, and every script that reads the registry reads it as before. - **What changes:** an entry may carry the optional field `preview_port`. The `repository-registry` check refuses a value that is not an integer from 1024 to 65535, and refuses two repositories with the same one. - **What stays identical:** the registry file itself, `vm-specs.json`, every machine definition, and every existing rule of the check. - **What proves it:** the check now runs three fixture registries: one with an invalid port and one with a shared port, each refused with its own message, and one with a valid port, accepted. Disabling either rule turns the check red. - **If it is wrong:** revert this commit. The field has no reader until the `allod/tools` change for the same issue lands. Refs allod/tools#240 ## Risk R1. The change is confined to one flake check and the README. The worst credible failure is the check refusing a valid registry or accepting an invalid port; the first is visible at once as a red check, the second ends at `allod site preview` failing to bind. No machine state, secret or provisioning path is touched. ## Validation - `nix build .#checks.x86_64-linux.repository-registry -L --no-link --rebuild`: exit 0. The three new lines are `OK: an invalid preview_port fails with its pinned diagnostic`, `OK: two repositories sharing a preview_port fail with a pinned diagnostic`, `OK: a valid preview_port passes validation`. - `nix flake check`: `all checks passed!`. - Range rule replaced with one that is always true: the check fails with `ERROR: a preview_port outside 1024-65535 still passed validation`. Restored. - Uniqueness rule weakened to need three sharers: the check fails with `ERROR: two repositories sharing a preview_port still passed validation`. Restored. - The invalid fixture is a present `null`, so it also shows the field's presence is tested with `has()`: a `// empty` test would read that entry as having no port and accept it. ## Consumers of the registry The issue asks for confirmation that readers are unaffected by an extra field. Every reader under the ten workspace repositories was read; each names the fields it wants, and the registry already carries one optional field, `hookspath`. | Reader | How it reads an entry | | --- | --- | | `allod/tools` `cmd/allod/registry.go` | `json.Unmarshal` into a struct with `checkout` only; unknown keys are ignored | | `allod/tools` `git-hooks/setup-tracked-hooks` | `jq` `select(.value.hookspath and .value.checkout)`, prints those two fields | | `allod/nexus` `scripts/lib/resolve-repos.sh` | `jq` on `.source`, `.remote`, `.checkout` by name; `bootstrap-vm`, `verify-vm`, `forge-ssh-key`, `vm-ssh-host-key`, `nexus-host-key` and `refresh-local-auth` go through it | | `allod/nexus` `scripts/pi-provider` | a `jq` predicate over the same three named fields | No Nix code imports the file, nothing decodes it strictly, and nothing writes it back. A copy of `allod/nexus` `tests/registry-resolver.sh` with `"preview_port": 8080` added to one fixture entry passed 15 of 15. Not run with the field in their fixtures: `allod/nexus` `tests/pi-provider.sh`, `allod/tools` `tests/git-hooks/setup-tracked-hooks.sh` and `tests/allod-patch.sh`. Their readers are the ones in the table. No external review pass: R1.

allod-agent added 1 commit

2026-09-28 00:13:43 +01:00

registry: validate the optional preview_port field 87a8795caa

A repository entry may carry preview_port; its presence means the
repository is a site that `allod site preview` can serve. The
repository-registry check refuses a value that is not an integer from
1024 to 65535, and refuses two repositories sharing one.

Presence is tested with jq's has(), not `// empty`, so an explicit null
or false is refused rather than read as absent.

Three fixture sites beside the existing sabotage fixtures pin both
diagnostics and run the accepting path, which the real registry cannot:
it has no site in it.

Refs allod/tools#240

allod-agent referenced this pull request from allod/tools

2026-09-28 03:49:01 +01:00

site serve and site view: run a site's own preview app in the VM and forward it to the hypervisor #242