Rename the -from-host nexus scripts: drop the suffix #66

New issue

Closed

opened 2026-09-26 21:32:31 +01:00 by vnprc-agent · 2 comments

vnprc-agent commented

2026-09-26 21:32:31 +01:00

Drop the -from-host suffix from every nexus provisioning script. Every script in this repo only ever exists on the host, so the suffix says nothing and makes the commands the operator types most often the longest ones: rebuild-vm <vm>, provision-vm <vm>, verify-vm <vm>, bootstrap-vm <vm>.

Primary goals:

Short operator names — the four host-side VM commands are installed by packages.provisioning-scripts and homeModules.host under the new names only; no old name is kept as an alias.
The guest payload is the one exception — bootstrap-vm.sh is not a host command: bootstrap-vm-from-host.sh streams it over SSH to run inside the VM (scripts/bootstrap-vm-from-host.sh:131). It is renamed bootstrap-vm-guest.sh so the only script that does not run on the host is the one whose name says where it runs, and so the host command can take the plain bootstrap-vm name.
Repo-internal references follow — every usage line, printed hint, env seam, flake check entry, test, and doc in this repo uses the new names.
Behavior unchanged — script bodies, arguments, and environment pointers (DEPLOY_FLAKE, INVENTORY_CHECKOUT, KNOWN_HOSTS_VMS, NIXOS_REBUILD, ...) are untouched apart from names.

Rename table

Current	New	Role
`scripts/rebuild-vm-from-host`	`scripts/rebuild-vm`	host command (already done, see below)
`scripts/provision-vm-from-host`	`scripts/provision-vm`	host command
`scripts/verify-vm-from-host`	`scripts/verify-vm`	host command
`scripts/bootstrap-vm-from-host.sh`	`scripts/bootstrap-vm`	host command, called by provision and by verify `--repair`
`scripts/bootstrap-vm.sh`	`scripts/bootstrap-vm-guest.sh`	guest payload streamed over SSH, never typed
`tests/rebuild-vm-from-host.sh`	`tests/rebuild-vm.sh`	already done
`tests/provision-vm-from-host.sh`	`tests/provision-vm.sh`
env seam `BOOTSTRAP_VM_FROM_HOST`	`BOOTSTRAP_VM`	`scripts/provision-vm-from-host:13`, test at `tests/provision-vm-from-host.sh:250`
env seam `VERIFY_VM_FROM_HOST`	`VERIFY_VM`	`scripts/provision-vm-from-host:14`, test at `tests/provision-vm-from-host.sh:251`

nix/provisioning-scripts.nix copies scripts/ into bin/ verbatim, so file names are command names; its own assertion at line 9 names verify-vm-from-host.

Current state and specifics

The first rename, rebuild-vm-from-host to rebuild-vm, is committed on the branch for this issue and covers: the flake check's script list, test invocation and installed-binary assertion; the usage line; hints in vm-ssh-host-key, bootstrap-vm.sh, bootstrap-vm-from-host.sh; the deployFlake option description; docs/provisioning-scripts.md. The remaining renames touch the same kinds of places:

Usage lines: scripts/provision-vm-from-host:60, scripts/verify-vm-from-host:16 and :66 (the --repair hint), scripts/bootstrap-vm-from-host.sh:18 (self-identification on stderr).
Callers: scripts/provision-vm-from-host:13-14 and :122-124 (env seams), scripts/verify-vm-from-host:71 (calls the host bootstrap), scripts/bootstrap-vm-from-host.sh:131 (streams the guest payload).
Printed hints: scripts/vm-ssh-host-key:191 (provision-vm-from-host), :368 (verify-vm-from-host).
Flake check flake.nix:108-113, :124, :139, :150, :153; nix/provisioning-scripts.nix:9.
Tests: tests/bootstrap-orchestration.sh:5-7, :27, :48, :60-62 (pattern strings that assert the call sites), tests/forge-ssh-key.sh:6, tests/registry-resolver.sh:156 and :174, tests/provision-vm-from-host.sh:5, :250-251, :385.
Options and docs: nix/configuration.nix:29, :45, :48; docs/provisioning-scripts.md:31, :38, :70-73, :98, :116-140; docs/integration.md:63; docs/vm-provisioning-test-plan.md:9, :13, :37-38.

Validation is the existing flake check: nix build .#checks.x86_64-linux.provisioning-contract runs shellcheck over the script list, every test suite, and the test -x bin/<name> assertions, so a missed rename fails there. A final grep -rn from-host over the repo must return nothing.

Scope

In scope: the renames in the table, within this repo, on one branch. The rebuild-vm commit already on the branch is part of this issue, not a separate one.

Tracked separately, to land after this reaches the host through the deploy pin: the rebuild hint printed by allod secret rotate in allod/tools (cmd/allod/secret_rotate.go:671, test at cmd/allod/secret_rotate_test.go:613); the provisioning commands in allod/vm (README.md:112, docs/adding-a-new-vm-type.md:111, :119, :125, :161-162); and the provision-vm-from-host mention in allod/memory vm-provisioning.md:45. Deployments' private notes and skills that quote the old names update on their own schedule. Archived plans and review prompts in allod/strategy keep the names they were written with.

Drop the `-from-host` suffix from every nexus provisioning script. Every script in this repo only ever exists on the host, so the suffix says nothing and makes the commands the operator types most often the longest ones: `rebuild-vm <vm>`, `provision-vm <vm>`, `verify-vm <vm>`, `bootstrap-vm <vm>`. Primary goals: - **Short operator names** — the four host-side VM commands are installed by `packages.provisioning-scripts` and `homeModules.host` under the new names only; no old name is kept as an alias. - **The guest payload is the one exception** — `bootstrap-vm.sh` is not a host command: `bootstrap-vm-from-host.sh` streams it over SSH to run inside the VM (`scripts/bootstrap-vm-from-host.sh:131`). It is renamed `bootstrap-vm-guest.sh` so the only script that does not run on the host is the one whose name says where it runs, and so the host command can take the plain `bootstrap-vm` name. - **Repo-internal references follow** — every usage line, printed hint, env seam, flake check entry, test, and doc in this repo uses the new names. - **Behavior unchanged** — script bodies, arguments, and environment pointers (`DEPLOY_FLAKE`, `INVENTORY_CHECKOUT`, `KNOWN_HOSTS_VMS`, `NIXOS_REBUILD`, ...) are untouched apart from names. ### Rename table | Current | New | Role | |---|---|---| | `scripts/rebuild-vm-from-host` | `scripts/rebuild-vm` | host command (already done, see below) | | `scripts/provision-vm-from-host` | `scripts/provision-vm` | host command | | `scripts/verify-vm-from-host` | `scripts/verify-vm` | host command | | `scripts/bootstrap-vm-from-host.sh` | `scripts/bootstrap-vm` | host command, called by provision and by verify `--repair` | | `scripts/bootstrap-vm.sh` | `scripts/bootstrap-vm-guest.sh` | guest payload streamed over SSH, never typed | | `tests/rebuild-vm-from-host.sh` | `tests/rebuild-vm.sh` | already done | | `tests/provision-vm-from-host.sh` | `tests/provision-vm.sh` | | | env seam `BOOTSTRAP_VM_FROM_HOST` | `BOOTSTRAP_VM` | `scripts/provision-vm-from-host:13`, test at `tests/provision-vm-from-host.sh:250` | | env seam `VERIFY_VM_FROM_HOST` | `VERIFY_VM` | `scripts/provision-vm-from-host:14`, test at `tests/provision-vm-from-host.sh:251` | `nix/provisioning-scripts.nix` copies `scripts/` into `bin/` verbatim, so file names are command names; its own assertion at line 9 names `verify-vm-from-host`. ### Current state and specifics The first rename, `rebuild-vm-from-host` to `rebuild-vm`, is committed on the branch for this issue and covers: the flake check's script list, test invocation and installed-binary assertion; the usage line; hints in `vm-ssh-host-key`, `bootstrap-vm.sh`, `bootstrap-vm-from-host.sh`; the `deployFlake` option description; `docs/provisioning-scripts.md`. The remaining renames touch the same kinds of places: - Usage lines: `scripts/provision-vm-from-host:60`, `scripts/verify-vm-from-host:16` and `:66` (the `--repair` hint), `scripts/bootstrap-vm-from-host.sh:18` (self-identification on stderr). - Callers: `scripts/provision-vm-from-host:13-14` and `:122-124` (env seams), `scripts/verify-vm-from-host:71` (calls the host bootstrap), `scripts/bootstrap-vm-from-host.sh:131` (streams the guest payload). - Printed hints: `scripts/vm-ssh-host-key:191` (`provision-vm-from-host`), `:368` (`verify-vm-from-host`). - Flake check `flake.nix:108-113`, `:124`, `:139`, `:150`, `:153`; `nix/provisioning-scripts.nix:9`. - Tests: `tests/bootstrap-orchestration.sh:5-7`, `:27`, `:48`, `:60-62` (pattern strings that assert the call sites), `tests/forge-ssh-key.sh:6`, `tests/registry-resolver.sh:156` and `:174`, `tests/provision-vm-from-host.sh:5`, `:250-251`, `:385`. - Options and docs: `nix/configuration.nix:29`, `:45`, `:48`; `docs/provisioning-scripts.md:31`, `:38`, `:70-73`, `:98`, `:116-140`; `docs/integration.md:63`; `docs/vm-provisioning-test-plan.md:9`, `:13`, `:37-38`. Validation is the existing flake check: `nix build .#checks.x86_64-linux.provisioning-contract` runs shellcheck over the script list, every test suite, and the `test -x bin/<name>` assertions, so a missed rename fails there. A final `grep -rn from-host` over the repo must return nothing. ### Scope In scope: the renames in the table, within this repo, on one branch. The `rebuild-vm` commit already on the branch is part of this issue, not a separate one. Tracked separately, to land after this reaches the host through the deploy pin: the rebuild hint printed by `allod secret rotate` in `allod/tools` (`cmd/allod/secret_rotate.go:671`, test at `cmd/allod/secret_rotate_test.go:613`); the provisioning commands in `allod/vm` (`README.md:112`, `docs/adding-a-new-vm-type.md:111`, `:119`, `:125`, `:161-162`); and the `provision-vm-from-host` mention in `allod/memory` `vm-provisioning.md:45`. Deployments' private notes and skills that quote the old names update on their own schedule. Archived plans and review prompts in `allod/strategy` keep the names they were written with.

vnprc-agent commented

2026-09-26 21:35:05 +01:00

Author

Draft PR body for the rename, prepared on a dev VM and relayed by patch; the branch is agent/rename-rebuild-vm (one commit, Rename rebuild-vm-from-host to rebuild-vm). Open the PR from a checkout that can push, with this body:

The host-side rebuild command rebuild-vm-from-host becomes rebuild-vm. On a running nexus, after the deploy pin picks this up, the operator types rebuild-vm <vm>; the old name is gone, not aliased. The script body, its arguments, and its environment pointers stay identical. The flake check proves it: the renamed test suite passes and the check asserts the installed bin/rebuild-vm. If it is wrong, revert this commit; nothing outside this repo changes.

Closes allod/nexus#66

Risk

R1. Refactor-only rename of one script and its test; behavior untouched; rollback is a straight revert. The only cross-repo effect is that hints in allod/tools (secret rotate) and a doc in allod/vm still print the old name until their follow-ups land; those are listed in the issue's Scope.

Validation

bash -n and shellcheck -x --source-path=SCRIPTDIR over the five touched scripts: clean.
bash tests/rebuild-vm.sh: 10 tests passed.
nix build .#checks.x86_64-linux.provisioning-contract: passed, including test -x .../bin/rebuild-vm.
grep -rn rebuild-vm-from-host over the worktree: no matches.

Draft PR body for the rename, prepared on a dev VM and relayed by patch; the branch is `agent/rename-rebuild-vm` (one commit, `Rename rebuild-vm-from-host to rebuild-vm`). Open the PR from a checkout that can push, with this body: --- The host-side rebuild command `rebuild-vm-from-host` becomes `rebuild-vm`. On a running nexus, after the deploy pin picks this up, the operator types `rebuild-vm <vm>`; the old name is gone, not aliased. The script body, its arguments, and its environment pointers stay identical. The flake check proves it: the renamed test suite passes and the check asserts the installed `bin/rebuild-vm`. If it is wrong, revert this commit; nothing outside this repo changes. Closes allod/nexus#66 ## Risk R1. Refactor-only rename of one script and its test; behavior untouched; rollback is a straight revert. The only cross-repo effect is that hints in `allod/tools` (`secret rotate`) and a doc in `allod/vm` still print the old name until their follow-ups land; those are listed in the issue's Scope. ## Validation - `bash -n` and `shellcheck -x --source-path=SCRIPTDIR` over the five touched scripts: clean. - `bash tests/rebuild-vm.sh`: 10 tests passed. - `nix build .#checks.x86_64-linux.provisioning-contract`: passed, including `test -x .../bin/rebuild-vm`. - `grep -rn rebuild-vm-from-host` over the worktree: no matches.

vnprc-agent changed title from ~~Rename rebuild-vm-from-host to rebuild-vm~~ to Rename the -from-host nexus scripts: drop the suffix

2026-09-26 21:39:20 +01:00

vnprc-agent commented

2026-09-26 21:39:21 +01:00

Author

Scope widened from the rebuild command alone to every -from-host script; the body above is rewritten with the full rename table. The commit already prepared (Rename rebuild-vm-from-host to rebuild-vm) is the first step on the branch for this issue, so a PR that carries only that commit should say Refs allod/nexus#66, not Closes; the draft PR body in the earlier comment predates the widening and its Closes line is superseded.

Scope widened from the rebuild command alone to every `-from-host` script; the body above is rewritten with the full rename table. The commit already prepared (`Rename rebuild-vm-from-host to rebuild-vm`) is the first step on the branch for this issue, so a PR that carries only that commit should say `Refs allod/nexus#66`, not `Closes`; the draft PR body in the earlier comment predates the widening and its `Closes` line is superseded.