credential-inventory: sabotage fixture for the pending and active file rules #20

New issue

Closed

opened 2026-09-11 02:19:35 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-11 02:19:35 +01:00

Member

Give the credential-inventory check a sabotage fixture so a regression in a rule the template data never exercises cannot pass green.

Primary goals:

One sabotage per validator — per testing.md, the check proves it can fail: a fixture inventory with a pending entry whose file is present, and an active entry whose file is absent, each rejected.
The real generator, fixture inputs — the check body becomes a function of the inventory, the recipient map, and a file-presence predicate, called once with the repository's data and once with the fixture, so the fixture witnesses production logic rather than a copy of it.
No new assertion surface — the messages and rules stay as they are; only the way they are exercised changes.

Current state and specifics

flake.nix's credential-inventory (allod/secrets#19 added the pending arm at the runCommand body) evaluates the repository's own credentials.nix and secrets.nix. The public template has no pending entry, so the branch that requires the age file absent in that state never runs in nix flake check; the only evidence it works is a manual sabotage recorded in that PR's body. The pi-credential-registry check in the same file shows the shape to copy: a rejects helper over fixture data with one sabotage per rule. A cross-family review of allod/secrets#19 raised this (low severity); the same review's other finding, that ${self} cannot see an untracked ciphertext, is the ordinary flake-source rule and not a defect.

Scope

In: the parameterization and two fixture sabotages for the file-presence rule. Out: the other inventory assertions, which can gain fixtures the same way later, and any change to the rules themselves.

Give the `credential-inventory` check a sabotage fixture so a regression in a rule the template data never exercises cannot pass green. Primary goals: - **One sabotage per validator** — per `testing.md`, the check proves it can fail: a fixture inventory with a `pending` entry whose file is present, and an `active` entry whose file is absent, each rejected. - **The real generator, fixture inputs** — the check body becomes a function of the inventory, the recipient map, and a file-presence predicate, called once with the repository's data and once with the fixture, so the fixture witnesses production logic rather than a copy of it. - **No new assertion surface** — the messages and rules stay as they are; only the way they are exercised changes. ### Current state and specifics `flake.nix`'s `credential-inventory` (allod/secrets#19 added the `pending` arm at the `runCommand` body) evaluates the repository's own `credentials.nix` and `secrets.nix`. The public template has no `pending` entry, so the branch that requires the age file absent in that state never runs in `nix flake check`; the only evidence it works is a manual sabotage recorded in that PR's body. The `pi-credential-registry` check in the same file shows the shape to copy: a `rejects` helper over fixture data with one sabotage per rule. A cross-family review of allod/secrets#19 raised this (low severity); the same review's other finding, that `${self}` cannot see an untracked ciphertext, is the ordinary flake-source rule and not a defect. ### Scope In: the parameterization and two fixture sabotages for the file-presence rule. Out: the other inventory assertions, which can gain fixtures the same way later, and any change to the rules themselves.

allod-agent referenced this issue from allod/tools

2026-09-11 02:28:54 +01:00

allod command to save an encrypted credential into a secrets repo #182

allod-agent referenced this issue from a pull request that will close it,

2026-09-11 02:43:39 +01:00

credential-inventory: run the rules over sabotage fixtures too #21

allod-agent referenced this issue from a commit

2026-09-11 02:43:39 +01:00

credential-inventory: run the rules over sabotage fixtures too