forge-sync: resolve_identity uses nix eval --raw and dies on the integer forgePort #87

New issue

Closed

opened 2026-10-09 17:44:00 +01:00 by vnprc-agent · 1 comment

vnprc-agent commented

2026-10-09 17:44:00 +01:00

forge-sync forge dies at its first identity lookup on a deployment built from the public template, before any mutation.

Evidence, laptop, fresh install from getting-started.sh, forge VM provisioned, 2026-10-09:

$ forge-sync forge
Error: cannot resolve identity.forgePort from /home/<user>/work/allod/secrets
Nothing else was changed. Re-running forge-sync 'forge' converges.

Reproduced against the pristine template clone (allod/secrets master 24f69b3), which is what resolve_identity runs with its stderr discarded:

$ nix eval --raw 'path:.#lib.identity.forgePort'
error: cannot coerce an integer to a string: 2222

scripts/forge-sync resolve_identity uses nix eval --raw, which accepts only strings; the template's forgePort is an integer, as modules/dev-ssh-forge.nix in archetypes expects (Port = forgePort). The two-node witness in allod/archetypes checks/forge-sync.nix did not catch it; whatever its fixture declares for forgePort is worth checking at the same time, and if it is a string, the fixture should carry the template's integer in the same commit as the nexus pin bump that brings the fix, so the check does not go red between the two landings.

`forge-sync forge` dies at its first identity lookup on a deployment built from the public template, before any mutation. Evidence, laptop, fresh install from `getting-started.sh`, forge VM provisioned, 2026-10-09: $ forge-sync forge Error: cannot resolve identity.forgePort from /home/<user>/work/allod/secrets Nothing else was changed. Re-running forge-sync 'forge' converges. Reproduced against the pristine template clone (`allod/secrets` master 24f69b3), which is what `resolve_identity` runs with its stderr discarded: $ nix eval --raw 'path:.#lib.identity.forgePort' error: cannot coerce an integer to a string: 2222 `scripts/forge-sync` `resolve_identity` uses `nix eval --raw`, which accepts only strings; the template's `forgePort` is an integer, as `modules/dev-ssh-forge.nix` in archetypes expects (`Port = forgePort`). The two-node witness in `allod/archetypes` `checks/forge-sync.nix` did not catch it; whatever its fixture declares for `forgePort` is worth checking at the same time, and if it is a string, the fixture should carry the template's integer in the same commit as the nexus pin bump that brings the fix, so the check does not go red between the two landings.

vnprc referenced this issue from a commit

2026-10-09 17:58:09 +01:00

forge-sync: read identity values as JSON, so an integer port resolves

vnprc referenced this issue from a commit

2026-10-09 18:05:20 +01:00

flake.lock: update nexus; the forge-sync witness declares an integer port

vnprc-agent referenced this issue from allod/strategy

2026-10-09 23:10:21 +01:00

A Forgejo VM on the hypervisor: PRs and issues for a forge-less deployment #65

vnprc-agent commented

2026-10-10 13:42:56 +01:00

Author

Landed on allod/nexus master 3039b54: identity values are read as JSON, so the integer forgePort resolves; the archetypes witness fixture declares an integer port since fde8354. Pinned through the deploy template. Witnessed on the second and third clean installs, 2026-10-09.

Landed on allod/nexus master 3039b54: identity values are read as JSON, so the integer forgePort resolves; the archetypes witness fixture declares an integer port since fde8354. Pinned through the deploy template. Witnessed on the second and third clean installs, 2026-10-09.

vnprc-agent closed this issue

2026-10-10 13:42:56 +01:00