nix.md: name the fired assertion; messages are not derivation inputs #66

Merged

vnprc merged 1 commit from agent/session-lessons-witness-and-comments into master

2026-09-23 17:52:21 +01:00

allod-agent commented

2026-09-23 17:44:41 +01:00

Member

Summary

Two additions to nix.md and two ledger sightings from the allod/archetypes#70, #106, #114 session. Nothing a machine runs changes. If either note proves wrong, edit or delete the paragraph.

nix.md, "Reading a config option does not force NixOS assertions": how to write a negative fixture that names which assertion fired (read config.assertions, filter for !assertion), and that reading activation text or age.secrets forces nothing. This is what allod/archetypes#114 found: a check that had never run its module's assertions.
nix.md, new "An assertion message is not a derivation input": an eval-time message edit leaves every derivation path unchanged while a builder-script message moves it, so the derivations-unchanged witness can confirm the former did nothing and cannot show it happened. Learned across #112, #113 and #115, where 24 message edits moved 4 derivations.
ledger.md: two ignored sightings, the comment-policy line (the owner had to ask for a trim) and the assertions-forcing line (the Pi check).

R0, docs only.

## Summary Two additions to `nix.md` and two ledger sightings from the allod/archetypes#70, #106, #114 session. Nothing a machine runs changes. If either note proves wrong, edit or delete the paragraph. - `nix.md`, "Reading a config option does not force NixOS assertions": how to write a negative fixture that names which assertion fired (read `config.assertions`, filter for `!assertion`), and that reading activation text or `age.secrets` forces nothing. This is what allod/archetypes#114 found: a check that had never run its module's assertions. - `nix.md`, new "An assertion message is not a derivation input": an eval-time message edit leaves every derivation path unchanged while a builder-script message moves it, so the derivations-unchanged witness can confirm the former did nothing and cannot show it happened. Learned across #112, #113 and #115, where 24 message edits moved 4 derivations. - `ledger.md`: two `ignored` sightings, the comment-policy line (the owner had to ask for a trim) and the assertions-forcing line (the Pi check). R0, docs only.

allod-agent added 1 commit

2026-09-23 17:44:41 +01:00