rotate-token: accept a raw value format and a tailscale-status verify probe #54

Merged

vnprc merged 1 commit from agent/rotate-token-raw-format-tailscale-probe into master

2026-09-11 21:00:00 +01:00

allod-agent commented

2026-09-11 09:19:31 +01:00

Member

rotate-token learns two names so a tailscale auth key can be registered truthfully: a value format raw (the plaintext is the value itself, rotated exactly as raw-forgejo-token) and a verify probe tailscale-status (prints tailscale status --peers=false, over ssh for a VM). Nothing changes for any existing group: the three formats and three probes behave as before, and an unknown format or probe is still refused with unsupported metadata. The rotate-token test suite (41 tests, two new) and nix flake check prove it; the registry groups for the per-machine tailscale keys are the first consumer. If it is wrong, revert this one commit; no registry on any machine uses the new names until the private secrets PR that declares them merges.

Closes allod/nexus#53.

Change

scripts/rotate-token: raw accepted in validate_group_metadata, prepare_item and the encryption switch; tailscale-status accepted in the validator and printed by print_group_verification (tailscale status --peers=false for a nixos-host, ssh <system> 'tailscale status --peers=false' otherwise); header comment lists raw.
docs/credentials.md: one sentence naming the four formats and four probes.
tests/rotate-token.sh: fixture group tailnet.dev (service: none, format: raw, one nixos-host and one dev-vm target with tailscale-status); a dry-run test asserting both printed verify lines; a live rotation test asserting the decrypted value; sabotage groups bogus.format and bogus.verify added to the refusal loop.

Out of scope, tracked elsewhere: the Go port allod secret rotate (allod/tools#197) must carry the same two names; retiring rotate-token (allod/nexus#52); renaming the registry.

Risk

R2. Localized to two enum lists and one printed arm in a host script that runs only when an operator rotates a registered group. The worst credible failure is a printed verify line the operator has to fix by hand. Rollback is a revert.

Validation

Run by the integrator in the worktree, on the final code:

bash tests/rotate-token.sh   -> 41 rotate-token tests passed.
git diff --check             -> clean
nix flake check path:.       -> all checks passed (3 checks built on this tree by the worker; the integrator rerun found them cached and passed)

Cross-family review after the final edit, both reading the diff cold via codex at reasoning effort high: gpt-5.6-terra, no findings (its sandbox could not run the suite; traced every dispatch site by hand); gpt-5.6-sol, no findings, and it ran the suite itself to 41 passed. Both reports were checked for emptiness before being read as approval.

rotate-token learns two names so a tailscale auth key can be registered truthfully: a value format `raw` (the plaintext is the value itself, rotated exactly as `raw-forgejo-token`) and a verify probe `tailscale-status` (prints `tailscale status --peers=false`, over ssh for a VM). Nothing changes for any existing group: the three formats and three probes behave as before, and an unknown format or probe is still refused with `unsupported metadata`. The rotate-token test suite (41 tests, two new) and `nix flake check` prove it; the registry groups for the per-machine tailscale keys are the first consumer. If it is wrong, revert this one commit; no registry on any machine uses the new names until the private secrets PR that declares them merges. Closes allod/nexus#53. ## Change - `scripts/rotate-token`: `raw` accepted in `validate_group_metadata`, `prepare_item` and the encryption switch; `tailscale-status` accepted in the validator and printed by `print_group_verification` (`tailscale status --peers=false` for a `nixos-host`, `ssh <system> 'tailscale status --peers=false'` otherwise); header comment lists `raw`. - `docs/credentials.md`: one sentence naming the four formats and four probes. - `tests/rotate-token.sh`: fixture group `tailnet.dev` (`service: none`, `format: raw`, one `nixos-host` and one `dev-vm` target with `tailscale-status`); a dry-run test asserting both printed verify lines; a live rotation test asserting the decrypted value; sabotage groups `bogus.format` and `bogus.verify` added to the refusal loop. Out of scope, tracked elsewhere: the Go port `allod secret rotate` (allod/tools#197) must carry the same two names; retiring rotate-token (allod/nexus#52); renaming the registry. ## Risk R2. Localized to two enum lists and one printed arm in a host script that runs only when an operator rotates a registered group. The worst credible failure is a printed verify line the operator has to fix by hand. Rollback is a revert. ## Validation Run by the integrator in the worktree, on the final code: ``` bash tests/rotate-token.sh -> 41 rotate-token tests passed. git diff --check -> clean nix flake check path:. -> all checks passed (3 checks built on this tree by the worker; the integrator rerun found them cached and passed) ``` Cross-family review after the final edit, both reading the diff cold via codex at reasoning effort high: gpt-5.6-terra, no findings (its sandbox could not run the suite; traced every dispatch site by hand); gpt-5.6-sol, no findings, and it ran the suite itself to 41 passed. Both reports were checked for emptiness before being read as approval.

allod-agent added 1 commit

2026-09-11 09:19:31 +01:00