Derive Pi recipients from deployment outputs #31

Merged

vnprc merged 2 commits from agent/pi-provider-deployment-contract into master

2026-08-24 14:30:59 +01:00

allod-agent commented

2026-08-24 06:52:09 +01:00

Member

Owner summary

Problem: pi-provider assumed a host named Nexus in the VM key registry and depended on fixed public checkout/check names.
Behavior: it now resolves deployment repositories and consumes their exact derived profile and recipient outputs.
Safety: planned outputs are evaluated in tmpfs before bearer input; installed-output drift triggers journal rollback.
Private prerequisite: the deployment secrets fork must adopt allod/secrets#15 and export lib.piCredentialRecipients from hypervisorPublicKeys plus VM-only host keys.
Merge order: merge allod/secrets#15, update the private secrets fork/pin, then merge and deploy this PR.
Rollback: keep the prior deployment pins or revert this PR before entering a bearer if the private derived output is not ready.
Unchanged boundary: pi-provider still does not commit, update pins, rebuild machines, verify a live request, or revoke remote tokens.

Verification

nix build --no-link .#checks.x86_64-linux.provisioning-contract -L (includes 254 pi-provider assertions)
nix build --no-link .#checks.x86_64-linux.host-provisioning-env -L
real-repository dry run against inventory, profiles, and the Secrets PR worktree

Closes allod/nexus#29

Depends on: allod/secrets#15

## Owner summary - Problem: `pi-provider` assumed a host named Nexus in the VM key registry and depended on fixed public checkout/check names. - Behavior: it now resolves deployment repositories and consumes their exact derived profile and recipient outputs. - Safety: planned outputs are evaluated in tmpfs before bearer input; installed-output drift triggers journal rollback. - Private prerequisite: the deployment secrets fork must adopt allod/secrets#15 and export `lib.piCredentialRecipients` from `hypervisorPublicKeys` plus VM-only host keys. - Merge order: merge allod/secrets#15, update the private secrets fork/pin, then merge and deploy this PR. - Rollback: keep the prior deployment pins or revert this PR before entering a bearer if the private derived output is not ready. - Unchanged boundary: `pi-provider` still does not commit, update pins, rebuild machines, verify a live request, or revoke remote tokens. ## Verification - `nix build --no-link .#checks.x86_64-linux.provisioning-contract -L` (includes 254 pi-provider assertions) - `nix build --no-link .#checks.x86_64-linux.host-provisioning-env -L` - real-repository dry run against inventory, profiles, and the Secrets PR worktree Closes allod/nexus#29 Depends on: allod/secrets#15

allod-agent added 1 commit

2026-08-24 06:52:09 +01:00