G1c: point nexus deploy-flake defaults + rotation steps at allod/deploy #15

Merged

vnprc merged 1 commit from agent/nexus-deploy-flake-defaults into master

2026-07-17 21:45:10 +01:00

allod-agent commented

2026-07-17 21:40:30 +01:00

Member

Part of the archetypes/profiles repo split — Refs allod/strategy#18. This is the G1c pre-cliff re-point.

The framework repo was renamed allod/profiles → allod/archetypes (M0), and the deploy composition root is allod/deploy. Nexus provisioning still defaulted its deploy flake and rotation lock-bump steps to ~/work/allod/profiles, which resolves only through the dying rename redirect. This PR moves every redirect-sensitive default and operator-facing lock-bump step onto the allod/deploy checkout before the redirect dies when the new allod/profiles definitions repo is created (M1). The existing deploy template already re-exports nixosConfigurations and vmFacts, so these re-points are valid pre-split.

Changes:

DEPLOY_FLAKE default in provision-vm-from-host / rebuild-vm-from-host: $HOME/work/allod/profiles → $HOME/work/allod/deploy. Matching updates to the nexus.provisioning.deployFlake option example/description, docs/provisioning-scripts.md, the /template/profiles → /template/deploy sentinel in flake.nix (fixture + host-provisioning-env assertion), and the vm-provisioning-test-plan.md smoke-test line.
Per-VM lock-bump scripts (forge-ssh-key, vm-ssh-host-key, nexus-host-key): the checkout default now resolves deploy (allod/deploy fallback), the variable is renamed MACHINE_PROFILES/PROFILES_CHECKOUT → DEPLOY_CHECKOUT, the printed "update the deploy flake" steps and forge-ssh-key's assert_clean guard the deploy checkout.
rotate-token: the "Update the deploy flake lock" steps and nixos-rebuild --flake ~/work/allod/deploy#… lines move to the deploy checkout.
verify-vm-from-host: dropped the dead MACHINE_PROFILES assignment (assigned, never read) rather than repointing it.
bootstrap-vm-from-host.sh: unchanged — its optional ${MACHINE_PROFILES}/scripts/hooks/<vm>.sh lookup is a profiles-definitions concern and keeps resolving the definitions checkout (resolve_checkout profiles … allod/profiles), per plan.

Remaining allod/profiles references in nexus (reviewed, all intentional / non-redirect-sensitive):

scripts/bootstrap-vm-from-host.sh:9 — the optional profile-hook lookup (kept by design).
Self-contained test fixture/unit data: tests/bootstrap-orchestration.sh (bootstrap hook tests), tests/registry-resolver.sh (resolver unit data), tests/provisioning-contract.sh (health-check sample repos), tests/forge-ssh-key.sh:178 (dead fixture registry entry). None resolves through the redirect; these belong to the M5 broad grep sweep.

Risk

R2 Medium — mechanical but provisioning-adjacent (it governs which flake cold provisioning/rotation builds and bumps). Rollback before M1 is a straight revert; the redirect still serves until then. The three per-VM lock-bump scripts' tests override the checkout var and assert on printed text, so nix flake check alone cannot prove they were repointed — hence the direct greps below.

Validation

nix flake check                                                        # PASS (shellcheck + full provisioning test suite + host-provisioning-env)

# No literal deploy-flake/lock-bump target still points at the framework checkout:
git grep -nE 'DEPLOY_FLAKE=.*allod/profiles|--flake ~/work/allod/profiles|cd ~/work/allod/profiles|Update profiles flake lock' scripts nix docs tests   # empty

# No per-VM lock-bump script still resolves the profiles checkout for its bump:
git grep -nE 'resolve_checkout profiles' scripts/forge-ssh-key scripts/vm-ssh-host-key scripts/nexus-host-key   # empty

# Catch-all reviewed — every remaining hit is the bootstrap hook lookup or self-contained fixture/unit data:
git grep -n 'allod/profiles' scripts nix docs tests

Part of the archetypes/profiles repo split — `Refs allod/strategy#18`. This is the **G1c** pre-cliff re-point. The framework repo was renamed `allod/profiles` → `allod/archetypes` (M0), and the deploy composition root is `allod/deploy`. Nexus provisioning still defaulted its deploy flake and rotation lock-bump steps to `~/work/allod/profiles`, which resolves only through the dying rename redirect. This PR moves every redirect-sensitive default and operator-facing lock-bump step onto the `allod/deploy` checkout before the redirect dies when the new `allod/profiles` definitions repo is created (M1). The existing deploy template already re-exports `nixosConfigurations` and `vmFacts`, so these re-points are valid pre-split. Changes: - `DEPLOY_FLAKE` default in `provision-vm-from-host` / `rebuild-vm-from-host`: `$HOME/work/allod/profiles` → `$HOME/work/allod/deploy`. Matching updates to the `nexus.provisioning.deployFlake` option example/description, `docs/provisioning-scripts.md`, the `/template/profiles` → `/template/deploy` sentinel in `flake.nix` (fixture + `host-provisioning-env` assertion), and the `vm-provisioning-test-plan.md` smoke-test line. - Per-VM lock-bump scripts (`forge-ssh-key`, `vm-ssh-host-key`, `nexus-host-key`): the checkout default now resolves `deploy` (`allod/deploy` fallback), the variable is renamed `MACHINE_PROFILES`/`PROFILES_CHECKOUT` → `DEPLOY_CHECKOUT`, the printed "update the deploy flake" steps and `forge-ssh-key`'s `assert_clean` guard the deploy checkout. - `rotate-token`: the "Update the deploy flake lock" steps and `nixos-rebuild --flake ~/work/allod/deploy#…` lines move to the deploy checkout. - `verify-vm-from-host`: dropped the dead `MACHINE_PROFILES` assignment (assigned, never read) rather than repointing it. - `bootstrap-vm-from-host.sh`: **unchanged** — its optional `${MACHINE_PROFILES}/scripts/hooks/<vm>.sh` lookup is a profiles-definitions concern and keeps resolving the definitions checkout (`resolve_checkout profiles … allod/profiles`), per plan. Remaining `allod/profiles` references in nexus (reviewed, all intentional / non-redirect-sensitive): - `scripts/bootstrap-vm-from-host.sh:9` — the optional profile-hook lookup (kept by design). - Self-contained test fixture/unit data: `tests/bootstrap-orchestration.sh` (bootstrap hook tests), `tests/registry-resolver.sh` (resolver unit data), `tests/provisioning-contract.sh` (health-check sample repos), `tests/forge-ssh-key.sh:178` (dead fixture registry entry). None resolves through the redirect; these belong to the M5 broad grep sweep. ## Risk R2 Medium — mechanical but provisioning-adjacent (it governs which flake cold provisioning/rotation builds and bumps). Rollback before M1 is a straight revert; the redirect still serves until then. The three per-VM lock-bump scripts' tests override the checkout var and assert on printed text, so `nix flake check` alone cannot prove they were repointed — hence the direct greps below. ## Validation ``` nix flake check # PASS (shellcheck + full provisioning test suite + host-provisioning-env) # No literal deploy-flake/lock-bump target still points at the framework checkout: git grep -nE 'DEPLOY_FLAKE=.*allod/profiles|--flake ~/work/allod/profiles|cd ~/work/allod/profiles|Update profiles flake lock' scripts nix docs tests # empty # No per-VM lock-bump script still resolves the profiles checkout for its bump: git grep -nE 'resolve_checkout profiles' scripts/forge-ssh-key scripts/vm-ssh-host-key scripts/nexus-host-key # empty # Catch-all reviewed — every remaining hit is the bootstrap hook lookup or self-contained fixture/unit data: git grep -n 'allod/profiles' scripts nix docs tests ```

allod-agent added 1 commit

2026-07-17 21:40:30 +01:00

Point deploy-flake defaults and rotation steps at allod/deploy af4b7e64cc

Move the provisioning DEPLOY_FLAKE defaults, the /template deploy sentinel,
and the rotation lock-bump/rebuild steps off the framework checkout and onto
the deploy composition-root checkout (allod/deploy) before the allod/profiles
rename redirect dies at M1. Rename the per-VM lock-bump scripts' checkout
variable to DEPLOY_CHECKOUT (resolving deploy), guard the deploy checkout with
assert_clean, drop verify-vm-from-host's dead MACHINE_PROFILES assignment, and
keep bootstrap's optional profile-hook lookup on the profiles-definitions
checkout.