Validate Nexus data checkouts from raw inventory

allod-agent commented

2026-08-21 03:01:35 +01:00

Member

Nexus now declares the profiles checkout alongside its existing inventory, secrets, and host-tooling checkouts. Guest workspace data and the committed VM specification stay unchanged. The registry check now reads every raw machine, so hypervisor alias and duplicate-path mistakes fail before deployment. Sabotage fixtures prove each required Nexus alias, unknown aliases, and duplicate paths are rejected. If this is wrong, revert this PR or keep deployments pinned to the preceding inventory revision.

Refs allod/strategy#34

Details

Add allod/profiles to the synthetic Nexus hypervisor's repository list.
Derive the repository validator's machine input from raw machines, retaining only JSON-safe type, repo, and self-rebuild fields.
Require allod/profiles, allod/secrets, and allod/inventory on every hypervisor and self-rebuilding guest.
Check alias references and duplicate checkout paths across hosts as well as guests.
Pin the public Nexus fixture to exactly its four intended aliases and prove its delta adds only profiles.
Document the host-inclusive contract and its mutation witnesses.

Risk

R2. A bad required-alias rule could block an inventory check or fail to provision a host checkout, but this changes no running machine until a deployment pins it and is recoverable by reverting the pin.

Validation

nix flake check -L
nix build .#checks.x86_64-linux.repository-registry -L
nix build .#checks.x86_64-linux.vm-specs-json .#checks.x86_64-linux.runtime-fact-mutations -L
nix eval --json .#machines.nexus.repos
git diff --check

The repository witness removes each required Nexus alias independently and pins the expected diagnostic. It separately introduces an unknown host alias and two aliases resolving to one checkout path. The unchanged VM-spec check proves the hypervisor-only repository addition did not alter the guest projection.

Nexus now declares the profiles checkout alongside its existing inventory, secrets, and host-tooling checkouts. Guest workspace data and the committed VM specification stay unchanged. The registry check now reads every raw machine, so hypervisor alias and duplicate-path mistakes fail before deployment. Sabotage fixtures prove each required Nexus alias, unknown aliases, and duplicate paths are rejected. If this is wrong, revert this PR or keep deployments pinned to the preceding inventory revision. Refs allod/strategy#34 ## Details - Add `allod/profiles` to the synthetic Nexus hypervisor's repository list. - Derive the repository validator's machine input from raw `machines`, retaining only JSON-safe type, repo, and self-rebuild fields. - Require `allod/profiles`, `allod/secrets`, and `allod/inventory` on every hypervisor and self-rebuilding guest. - Check alias references and duplicate checkout paths across hosts as well as guests. - Pin the public Nexus fixture to exactly its four intended aliases and prove its delta adds only profiles. - Document the host-inclusive contract and its mutation witnesses. ## Risk R2. A bad required-alias rule could block an inventory check or fail to provision a host checkout, but this changes no running machine until a deployment pins it and is recoverable by reverting the pin. ## Validation - `nix flake check -L` - `nix build .#checks.x86_64-linux.repository-registry -L` - `nix build .#checks.x86_64-linux.vm-specs-json .#checks.x86_64-linux.runtime-fact-mutations -L` - `nix eval --json .#machines.nexus.repos` - `git diff --check` The repository witness removes each required Nexus alias independently and pins the expected diagnostic. It separately introduces an unknown host alias and two aliases resolving to one checkout path. The unchanged VM-spec check proves the hypervisor-only repository addition did not alter the guest projection.

allod-agent added 1 commit

2026-08-21 03:01:35 +01:00

Validate Nexus data checkouts from raw inventory 81caf5ccb2

allod-agent commented

2026-08-21 03:06:03 +01:00

Author

Member

Read-only review of commit 81caf5c (gpt-5.5, high effort) found three actionable issues:

Medium — the README overstates microvm witness coverage. The runtime mutation check proves invalid values fail, but never proves a non-hypervisor with runtime = "microvm" succeeds. Removing microvm from the enum could remain green. Add a valid synthetic microvm guest fixture that reaches the real mkVmSpecsJson path.
Low — the unknown-alias sabotage depends on repository ordering. Replacing .nexus.repos[0] assumes that entry is not one of the required aliases. Append the unknown alias so the witness isolates only the intended failure under harmless reordering.
Low — an existing Nexus comment is now false. The host stays out of vmSpecsJson, but this change deliberately makes it affect repository-registry; update the comment.

The reviewer could not run Nix in its read-only sandbox because Nix attempted to open its fetcher cache database. The implementation validation reported in the PR was run separately in the normal worktree and succeeded.

Read-only review of commit `81caf5c` (`gpt-5.5`, high effort) found three actionable issues: 1. **Medium — the README overstates microvm witness coverage.** The runtime mutation check proves invalid values fail, but never proves a non-hypervisor with `runtime = "microvm"` succeeds. Removing `microvm` from the enum could remain green. Add a valid synthetic microvm guest fixture that reaches the real `mkVmSpecsJson` path. 2. **Low — the unknown-alias sabotage depends on repository ordering.** Replacing `.nexus.repos[0]` assumes that entry is not one of the required aliases. Append the unknown alias so the witness isolates only the intended failure under harmless reordering. 3. **Low — an existing Nexus comment is now false.** The host stays out of `vmSpecsJson`, but this change deliberately makes it affect `repository-registry`; update the comment. The reviewer could not run Nix in its read-only sandbox because Nix attempted to open its fetcher cache database. The implementation validation reported in the PR was run separately in the normal worktree and succeeded.

allod-agent added 1 commit

2026-08-21 03:06:42 +01:00

Strengthen inventory mutation witnesses 1a1ca7ac88

allod-agent commented

2026-08-21 03:06:53 +01:00

Author

Member

Review findings are addressed in follow-up commit 1a1ca7a:

a synthetic privacy guest now selects microvm, passes the real mkVmSpecsJson path, and preserves that value in the generated JSON;
the unknown-alias witness appends its bad alias, so it cannot accidentally remove a required alias after list reordering;
the Nexus source comment now distinguishes exclusion from guest JSON from inclusion in repository validation.

Post-fix nix flake check -L rebuilt all three checks successfully, including the new positive microvm witness and every repository sabotage case. git diff --check also passes.

Review findings are addressed in follow-up commit `1a1ca7a`: - a synthetic privacy guest now selects `microvm`, passes the real `mkVmSpecsJson` path, and preserves that value in the generated JSON; - the unknown-alias witness appends its bad alias, so it cannot accidentally remove a required alias after list reordering; - the Nexus source comment now distinguishes exclusion from guest JSON from inclusion in repository validation. Post-fix `nix flake check -L` rebuilt all three checks successfully, including the new positive microvm witness and every repository sabotage case. `git diff --check` also passes.

allod-agent referenced this pull request from allod/nexus

2026-08-21 03:24:51 +01:00

Add recoverable Pi provider lifecycle command #26

allod-agent referenced this pull request from allod/deploy

2026-08-21 04:19:21 +01:00

Compose managed Pi provider lifecycle #4