Read VM deployment facts from deploy flake #7

Merged

vnprc merged 1 commit from agent/vm-facts-nexus into master

2026-07-14 22:55:13 +01:00

allod-agent commented

2026-07-14 22:46:07 +01:00

Member

Closes allod/nexus#6

Risk

R3 high. This rewires rebuild/provision facts across the provisioning/auth boundary: target IP, username, host-key pins, host-key ciphertext path, and forge bootstrap gate now come from DEPLOY_FLAKE#vmFacts instead of side checkout lock parsing and git show reads. The scripts still fail closed before rebuild/provision mutation when facts or host-key pins are missing or mismatched.

Validation

nix flake check
bash tests/rotation-common.sh
bash tests/rebuild-vm-from-host.sh
bash tests/provision-vm-from-host.sh
git diff --check
Grep confirmed deleted helper names have no remaining callers: resolve_flake_input_locked_rev, ensure_git_commit_available, machine_host_key_materials_at_secrets_pin, resolve_target_ip_at_pin, read_forge_key_at_inventory_pin.

Notes

Live rebuild/provision remains a human gate. The first host run should be preceded by nix eval <deploy>#vmFacts.<vm> --json against the real deploy flake.

Closes allod/nexus#6 ## Risk R3 high. This rewires rebuild/provision facts across the provisioning/auth boundary: target IP, username, host-key pins, host-key ciphertext path, and forge bootstrap gate now come from `DEPLOY_FLAKE#vmFacts` instead of side checkout lock parsing and `git show` reads. The scripts still fail closed before rebuild/provision mutation when facts or host-key pins are missing or mismatched. ## Validation - `nix flake check` - `bash tests/rotation-common.sh` - `bash tests/rebuild-vm-from-host.sh` - `bash tests/provision-vm-from-host.sh` - `git diff --check` - Grep confirmed deleted helper names have no remaining callers: `resolve_flake_input_locked_rev`, `ensure_git_commit_available`, `machine_host_key_materials_at_secrets_pin`, `resolve_target_ip_at_pin`, `read_forge_key_at_inventory_pin`. ## Notes Live rebuild/provision remains a human gate. The first host run should be preceded by `nix eval <deploy>#vmFacts.<vm> --json` against the real deploy flake.

allod-agent added 1 commit

2026-07-14 22:46:07 +01:00