refresh-local-auth: read the renamed rotation registry export #60

Merged

vnprc merged 2 commits from agent/rotation-registry-rename into master

2026-09-19 22:45:31 +01:00

allod-agent commented

2026-09-19 18:54:23 +01:00

Member

refresh-local-auth on the host reads the credential rotation registry through its new flake export, lib.rotationRegistry, instead of lib.forgejoTokenGroups. What changes for a running machine: the host script evaluates the new attribute name from the identity checkout, and the test fixture and the two docs name the registry file rotation-registry.json. What stays identical: every step after the registry is loaded, the registry's shape and validation, and all seventeen refresh-local-auth tests. What proves it: the test script and the provisioning-contract check pass, and a cold review found only the intended landing-order dependency. If it is wrong the symptom is refresh-local-auth failing to load the registry with a Nix error naming rotationRegistry, and the fix is a straight revert.

Land this after allod/secrets PR 31 (allod/secrets#31), which adds the export. A deployment's private fork of allod/secrets must merge that rename before this lands on the host, because the identity checkout the script evaluates is the private one and there is deliberately no fallback to the old name.

Refs allod/secrets#22

Risk

R3. A host-side script that feeds local auth reads a cross-repo interface by a new name. Residual: the ordering dependency above; the failure is loud and precedes any change to host state.

Validation

Run by the integrator on the reviewed commit:

bash tests/refresh-local-auth.sh: 17 refresh-local-auth tests passed., exit 0.
nix build .#checks.x86_64-linux.provisioning-contract --no-link -L: exit 0 (bash -n, shellcheck, and every shell test suite).
grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' . outside .git: no hits.

Cold review: gpt-5.6-sol via codex exec, default effort, read-only sandbox, on commit c42fc593. One finding, major: no compatibility fallback to lib.forgejoTokenGroups for a secrets checkout that predates the export. Discarded: the landing order recorded on allod/secrets#22 puts the secrets rename first, and a silent fallback to the old name is what memory rules out (fail loud, never fall back silently). No missed consumers, no unsupported claims.

`refresh-local-auth` on the host reads the credential rotation registry through its new flake export, `lib.rotationRegistry`, instead of `lib.forgejoTokenGroups`. What changes for a running machine: the host script evaluates the new attribute name from the identity checkout, and the test fixture and the two docs name the registry file `rotation-registry.json`. What stays identical: every step after the registry is loaded, the registry's shape and validation, and all seventeen refresh-local-auth tests. What proves it: the test script and the `provisioning-contract` check pass, and a cold review found only the intended landing-order dependency. If it is wrong the symptom is `refresh-local-auth` failing to load the registry with a Nix error naming `rotationRegistry`, and the fix is a straight revert. Land this after allod/secrets PR 31 (https://forge.anarch.diy/allod/secrets/pulls/31), which adds the export. A deployment's private fork of allod/secrets must merge that rename before this lands on the host, because the identity checkout the script evaluates is the private one and there is deliberately no fallback to the old name. Refs allod/secrets#22 ## Risk R3. A host-side script that feeds local auth reads a cross-repo interface by a new name. Residual: the ordering dependency above; the failure is loud and precedes any change to host state. ## Validation Run by the integrator on the reviewed commit: - `bash tests/refresh-local-auth.sh`: `17 refresh-local-auth tests passed.`, exit 0. - `nix build .#checks.x86_64-linux.provisioning-contract --no-link -L`: exit 0 (bash -n, shellcheck, and every shell test suite). - `grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' .` outside `.git`: no hits. Cold review: `gpt-5.6-sol` via `codex exec`, default effort, read-only sandbox, on commit c42fc593. One finding, major: no compatibility fallback to `lib.forgejoTokenGroups` for a secrets checkout that predates the export. Discarded: the landing order recorded on allod/secrets#22 puts the secrets rename first, and a silent fallback to the old name is what `memory` rules out (fail loud, never fall back silently). No missed consumers, no unsupported claims.

allod-agent added 1 commit

2026-09-19 18:54:24 +01:00

refresh-local-auth: read the renamed rotation registry export c42fc593e7

Evaluate lib.rotationRegistry instead of lib.forgejoTokenGroups, and
update the test fixture and docs to name rotation-registry.json.

Refs allod/secrets#22

allod-agent referenced this pull request from allod/secrets

2026-09-19 18:56:22 +01:00

Rename the rotation registry: forgejo-token-groups.json and lib.forgejoTokenGroups no longer say what they hold #22

allod-agent added 1 commit

2026-09-19 22:01:34 +01:00

Merge remote-tracking branch 'origin/master' into agent/rotation-registry-rename 2032c9c136