Derive profile checks from inventory-supported platforms #2

New issue

Closed

opened 2026-07-18 15:34:07 +01:00 by vnprc-agent · 2 comments

vnprc-agent commented

2026-07-18 15:34:07 +01:00

So that profile definitions stay portable across supported machines, profile checks should use the shared inventory platform list instead of carrying their own architecture list.

Context

Machine platform facts have one owner: allod/inventory. The profiles flake currently duplicates supported platform keys in its own local checkSystems list, then generates checks from that duplicate list. That can drift from inventory as supported machines are added, removed, or renamed, and it makes architecture policy harder to enforce consistently across public repos.

Exact grep hits

origin/master:flake.nix:21:    checkSystems = [ "x86_64-linux" "aarch64-linux" ];
origin/master:flake.nix:88:    checks = lib.genAttrs checkSystems (system:

Scope

Add or consume an inventory flake input for the profiles repo.
Replace the local checkSystems list with inventory.lib.supportedPlatforms.
Keep check generation behavior otherwise equivalent.
Do not move machine facts into profiles; profiles should consume inventory-owned facts only through the public inventory interface.

Acceptance

flake.nix no longer defines a local machine platform list such as checkSystems = [ "x86_64-linux" ... ];.
checks are generated from inventory.lib.supportedPlatforms.
The repo evaluates and runs its existing checks for every inventory-supported platform.
A repo-local grep for Nix system string literals does not find machine platform policy outside intentional examples or documented exceptions.

So that profile definitions stay portable across supported machines, profile checks should use the shared inventory platform list instead of carrying their own architecture list. ## Context Machine platform facts have one owner: `allod/inventory`. The profiles flake currently duplicates supported platform keys in its own local `checkSystems` list, then generates `checks` from that duplicate list. That can drift from inventory as supported machines are added, removed, or renamed, and it makes architecture policy harder to enforce consistently across public repos. ## Exact grep hits ```text origin/master:flake.nix:21: checkSystems = [ "x86_64-linux" "aarch64-linux" ]; origin/master:flake.nix:88: checks = lib.genAttrs checkSystems (system: ``` ## Scope - Add or consume an `inventory` flake input for the profiles repo. - Replace the local `checkSystems` list with `inventory.lib.supportedPlatforms`. - Keep check generation behavior otherwise equivalent. - Do not move machine facts into profiles; profiles should consume inventory-owned facts only through the public inventory interface. ## Acceptance - `flake.nix` no longer defines a local machine platform list such as `checkSystems = [ "x86_64-linux" ... ];`. - `checks` are generated from `inventory.lib.supportedPlatforms`. - The repo evaluates and runs its existing checks for every inventory-supported platform. - A repo-local grep for Nix system string literals does not find machine platform policy outside intentional examples or documented exceptions.

vnprc-agent referenced this issue

2026-07-20 15:51:00 +01:00

Key the profile shape check off flakeExposed and validate at the consumed surface #3

vnprc-agent commented

2026-07-20 15:51:15 +01:00

Author

Closing in favor of #3, which carries the corrected mechanism.

This issue's goal — don't let a hardcoded architecture list drift from inventory — is sound, but its prescribed fix (add an inventory input and derive checkSystems from inventory.lib.supportedPlatforms) is wrong here. The checkSystems list at flake.nix:21 is not machine-platform policy: the check it keys (flake.nix:88-99) is a platform-independent shape validation, so it can never drift from inventory, and adding an inventory input would break this repo's deliberate definitions-only, no-inventory/no-secrets charter (flake.nix:8) to fix a non-problem. The inventory-single-owner principle the issue wants already lives one layer up, in allod/archetypes (flake.nix:48), where real machine checks are generated.

#3 replaces the mechanism: de-literalize the check keying via nixpkgs.lib.systems.flakeExposed (no new input) and hoist the shape asserts onto lib.profileDefinitions so the framework trips them at composition time — closing a gap where this check currently protects only standalone runs, not consumers. Closing as not planned; see #3.

Closing in favor of #3, which carries the corrected mechanism. This issue's goal — don't let a hardcoded architecture list drift from inventory — is sound, but its prescribed fix (add an `inventory` input and derive `checkSystems` from `inventory.lib.supportedPlatforms`) is wrong here. The `checkSystems` list at `flake.nix:21` is not machine-platform policy: the check it keys (`flake.nix:88-99`) is a platform-independent shape validation, so it can never drift from inventory, and adding an inventory input would break this repo's deliberate definitions-only, no-`inventory`/no-`secrets` charter (`flake.nix:8`) to fix a non-problem. The inventory-single-owner principle the issue wants already lives one layer up, in `allod/archetypes` (`flake.nix:48`), where real machine checks are generated. #3 replaces the mechanism: de-literalize the check keying via `nixpkgs.lib.systems.flakeExposed` (no new input) and hoist the shape asserts onto `lib.profileDefinitions` so the framework trips them at composition time — closing a gap where this check currently protects only standalone runs, not consumers. Closing as not planned; see #3.

vnprc-agent commented

2026-07-20 15:51:16 +01:00

Author

Closed as not planned.

vnprc-agent closed this issue

2026-07-20 15:51:16 +01:00