Host allod carries the secret namespace; registry groups may have no Forgejo token #50

Merged

vnprc merged 1 commit from agent/secret-tag-and-registry-service into master

2026-09-11 02:01:55 +01:00

allod-agent commented

2026-09-11 00:15:50 +01:00

Member

After the next host rebuild with a bumped allod-tools pin, Nexus's allod gains allod secret create and allod secret rekey, the command that lands an encrypted credential in the secrets repository; until that pin moves, the new build tag names no code and the binary is unchanged. rotate-token now accepts a registry group whose service is none, for a credential that is not a Forgejo token, and prints generic instead of Forgejo copy for it; every existing group is forgejo and behaves exactly as before. What proves it: the nexus flake check passes, the rotate-token suite passes with two new refusals and one new dry-run case, and the tools side was smoke-tested separately. If it is wrong, revert this commit: the tag comes off the build and the validator returns to requiring forgejo.

Closes allod/tools#182. The other landings are allod/secrets#19 (the pending inventory state) and allod/tools#195 (the command). Merge order: secrets, tools, then this; after tools merges, bump the allod-tools input here and in the deploy flake so the tag reaches code.

Risk

R2. The build-tag line changes one host package; a wrong tag is a build error, not a runtime one. The validator change widens what rotate-token accepts, and the two new negative fixtures show it still refuses an unknown service and a Forgejo group without an account.

Validation

nix flake check on this branch: all checks passed.
bash tests/rotate-token.sh: 37 passed, including the new service none group dry-run omits the Forgejo copy and the bogus.service and forgejo.no-account cases in the unsupported-metadata loop.
The allod secret binary itself was exercised in allod/tools#195; nothing here runs it.

Left to the operator

The private save-encrypted-credential skill retires by hand once this lands, as the issue's comment says; its paste-safe relay shape already lives in the public agent-behavior.md.
The private deployment's site hosting group can drop its placeholder account and ui_token_name by setting service to none.

After the next host rebuild with a bumped `allod-tools` pin, Nexus's `allod` gains `allod secret create` and `allod secret rekey`, the command that lands an encrypted credential in the secrets repository; until that pin moves, the new build tag names no code and the binary is unchanged. `rotate-token` now accepts a registry group whose `service` is `none`, for a credential that is not a Forgejo token, and prints generic instead of Forgejo copy for it; every existing group is `forgejo` and behaves exactly as before. What proves it: the nexus flake check passes, the rotate-token suite passes with two new refusals and one new dry-run case, and the tools side was smoke-tested separately. If it is wrong, revert this commit: the tag comes off the build and the validator returns to requiring `forgejo`. Closes allod/tools#182. The other landings are allod/secrets#19 (the `pending` inventory state) and allod/tools#195 (the command). Merge order: secrets, tools, then this; after tools merges, bump the `allod-tools` input here and in the deploy flake so the tag reaches code. ## Risk R2. The build-tag line changes one host package; a wrong tag is a build error, not a runtime one. The validator change widens what `rotate-token` accepts, and the two new negative fixtures show it still refuses an unknown service and a Forgejo group without an account. ## Validation - `nix flake check` on this branch: all checks passed. - `bash tests/rotate-token.sh`: 37 passed, including the new `service none group dry-run omits the Forgejo copy` and the `bogus.service` and `forgejo.no-account` cases in the unsupported-metadata loop. - The `allod secret` binary itself was exercised in allod/tools#195; nothing here runs it. ## Left to the operator - The private `save-encrypted-credential` skill retires by hand once this lands, as the issue's comment says; its paste-safe relay shape already lives in the public `agent-behavior.md`. - The private deployment's site hosting group can drop its placeholder `account` and `ui_token_name` by setting `service` to `none`.

allod-agent added 1 commit

2026-09-11 00:15:50 +01:00