Port pi-provider from Bash to Go #28

New issue

Open

opened 2026-08-22 04:37:53 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-08-22 04:37:53 +01:00

Member

Replace the large Bash implementation of pi-provider with a Go command while keeping its behavior and security boundaries unchanged.

Primary goals:

Preserve the command — keep add, retarget, rotate, retire, recover, dry-run behavior, and existing file formats compatible.
Preserve secret safety — continue accepting tokens only through a hidden prompt and passing them to Age over standard input, never through arguments, environment variables, logs, or persistent plaintext files.
Make recovery easier to maintain — express validation, multi-repository updates, rollback, and recovery as structured Go code instead of a large shell state machine.
Keep deployment stable — retain the current Nix interfaces and installed pi-provider command name.

Current state

scripts/pi-provider is an 820-line Bash program that now owns parsing, JSON updates, filesystem safety, transaction journaling, and recovery. tests/pi-provider.sh provides the existing 82-assertion black-box lifecycle witness, and flake.nix installs and checks the command through the provisioning package.

The port should add focused Go tests for structured logic while retaining the existing end-to-end behavior check as the compatibility gate. The provisioning contract must still build an executable bin/pi-provider with the same help and lifecycle commands.

Scope

This issue covers the Nexus pi-provider command, its Go build/package wiring, and its tests. It does not redesign the profiles/secrets data contracts, change private deployment data, or port the separate VM-side Pi reconciliation helper in archetypes.

Follow-up to allod/strategy#34.

Replace the large Bash implementation of `pi-provider` with a Go command while keeping its behavior and security boundaries unchanged. Primary goals: - **Preserve the command** — keep add, retarget, rotate, retire, recover, dry-run behavior, and existing file formats compatible. - **Preserve secret safety** — continue accepting tokens only through a hidden prompt and passing them to Age over standard input, never through arguments, environment variables, logs, or persistent plaintext files. - **Make recovery easier to maintain** — express validation, multi-repository updates, rollback, and recovery as structured Go code instead of a large shell state machine. - **Keep deployment stable** — retain the current Nix interfaces and installed `pi-provider` command name. ### Current state `scripts/pi-provider` is an 820-line Bash program that now owns parsing, JSON updates, filesystem safety, transaction journaling, and recovery. `tests/pi-provider.sh` provides the existing 82-assertion black-box lifecycle witness, and `flake.nix` installs and checks the command through the provisioning package. The port should add focused Go tests for structured logic while retaining the existing end-to-end behavior check as the compatibility gate. The provisioning contract must still build an executable `bin/pi-provider` with the same help and lifecycle commands. ### Scope This issue covers the Nexus `pi-provider` command, its Go build/package wiring, and its tests. It does not redesign the profiles/secrets data contracts, change private deployment data, or port the separate VM-side Pi reconciliation helper in archetypes. Follow-up to allod/strategy#34.