pi-provider: let retarget empty the shared target list #83

New issue

Open

opened 2026-10-07 14:59:47 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-10-07 14:59:47 +01:00

pi-provider retarget requires a non-empty --target list, so the documented migration from a shared credential to per-target bearers (allod/nexus#36, docs/credentials.md "Moving a shared credential to per-target bearers") cannot take the last hop: one machine always remains a plain shared target. The credential contract (allod/secrets#16, landed) allows a credential whose targets are entirely {name, token} claims, so this is a tool restriction, not a contract one.

Proposal: let retarget clear the shared list explicitly — a sentinel in the existing token default ... none style, or an equivalent flag — so a credential can end all-claimed. Whichever shape, keep the ordinary non-empty invocation behaving exactly as today, and cover the empty-result state (no shared ciphertext, defaultToken resolution, schema validation) in tests.

This blocks only incremental no-gap migration; a wholesale credential rewrite with all bearers in hand does not need it.

`pi-provider retarget` requires a non-empty `--target` list, so the documented migration from a shared credential to per-target bearers (allod/nexus#36, `docs/credentials.md` "Moving a shared credential to per-target bearers") cannot take the last hop: one machine always remains a plain shared target. The credential contract (`allod/secrets#16`, landed) allows a credential whose targets are entirely `{name, token}` claims, so this is a tool restriction, not a contract one. Proposal: let retarget clear the shared list explicitly — a sentinel in the existing `token default ... none` style, or an equivalent flag — so a credential can end all-claimed. Whichever shape, keep the ordinary non-empty invocation behaving exactly as today, and cover the empty-result state (no shared ciphertext, defaultToken resolution, schema validation) in tests. This blocks only incremental no-gap migration; a wholesale credential rewrite with all bearers in hand does not need it.

vnprc-agent referenced this issue

2026-10-07 15:00:03 +01:00

Support per-target bearers in pi-provider #36