Handoff: migrate the private credential registry to value templates #25

New issue

Closed

opened 2026-09-12 01:09:01 +01:00 by allod-agent · 1 comment

allod-agent commented

2026-09-12 01:09:01 +01:00

Member

Handoff for the deployment's private agent: move the private credential registry from format plus structured verify.type entries to the value-template contract of allod/secrets#23, so the private validator, allod secret, and the archetypes checks all read one declared shape. The work and its receipts live in the private forks; this public issue is the instruction channel.

Primary goals:

Share one vocabulary — the private secrets flake re-exports the public lib.credentialEncodings, and its validator accepts the same wholly-legacy-or-wholly-new credential union as the public credential-registry check, with a positive fixture and one sabotage witness per validator, before any registry entry changes.
Migrate containers with the tool, plain entries by edit — each eligible legacy container credential (credential-store-url, rclone-remote-stanza) goes through allod secret migrate <name> on the host; each plain legacy entry (raw, raw-forgejo-token) becomes new-shape through a reviewed registry edit that drops format and converts every verify object to its command string. No ciphertext changes either way.
Keep the local-auth source legacy — a credential named by local_auth_refresh stays legacy until allod/nexus#52 supplies a new-shape refresh path or retires that dependency; migrate refuses it and rotate-token keeps rotating it.
Bake metadata into commands — the repository URL, user, and context that verification fields carried become part of each target's one-line verify string, exactly the inner command rotate-token printed for that probe type. Template bytes are preserved, trailing newline included.
Stop before anything live — private checks and composed-deployment checks run; nothing is deployed, rotated, or revoked under this issue.

Trigger

Start when all three public PRs of allod/secrets#23 (archetypes compatibility, secrets contract, tools commands) have merged and the deployment's allod-tools pin carries the new commands: allod secret --help on the host lists migrate and rotate. Before that, the private registry stays as it is.

Required sequence

Re-export the public lib.credentialEncodings from the private secrets flake so the private validator and the commands read one encoder list.
Extend the private validator to the transition union: a credential is wholly legacy (format and a structured verify.type object on every target) or wholly new (optional value with exactly one {secret} in value.template, optional value.encode from the exported list, and a non-empty one-line verify string on every target), never a mixture on one credential; credentials in one group share one encoding. Add the positive fixture and sabotage witnesses. Land this before any entry migrates.
Normalize any group whose service classification depended on a legacy credential format, so the classification stays correct once format is gone.
For each eligible legacy container credential, run allod secret migrate <name> on the host, one reviewed branch per run. migrate decrypts only in memory, accepts only the canonical container bytes, proves the extracted field renders back to the original plaintext byte-for-byte, and rewrites only the registry entry. For an rclone container the migrated declaration carries encode: "rclone-obscure" and the stored secret is the currently deployed obscured password; the next allod secret rotate takes a raw password and obscures it.
For each plain legacy entry, edit the registry: remove format, turn each target's verify object into the command string rotate-token printed for it, and drop any target-level metadata field the string now carries. Review the diff like any other registry change.
Treat a green verify command for a credential that is consumed only when a machine later joins as deployment health, not as proof that the standby value was exercised.

Validation and human gate

After each registry change run the private secrets checks and the composed-deployment checks, then stop with the branch and the check output ready for review. Do not deploy, rotate a live value, revoke an old value, or run a verification command against a machine as part of this issue; those remain the owner's acts.

Scope

In scope: the private re-export, validator union and witnesses, group normalization, container migration through allod secret migrate, plain-entry registry edits, verification-command conversion, and private validation. Out of scope: the public implementation for allod/secrets#23, retiring rotate-token and moving local_auth_refresh off the legacy shape (allod/nexus#52), renaming the registry (allod/secrets#22), removing legacy acceptance from the public and private validators (its own follow-up issue), and any live deployment or revocation.

Handoff for the deployment's private agent: move the private credential registry from `format` plus structured `verify.type` entries to the value-template contract of allod/secrets#23, so the private validator, `allod secret`, and the archetypes checks all read one declared shape. The work and its receipts live in the private forks; this public issue is the instruction channel. Primary goals: - **Share one vocabulary** — the private secrets flake re-exports the public `lib.credentialEncodings`, and its validator accepts the same wholly-legacy-or-wholly-new credential union as the public `credential-registry` check, with a positive fixture and one sabotage witness per validator, before any registry entry changes. - **Migrate containers with the tool, plain entries by edit** — each eligible legacy container credential (`credential-store-url`, `rclone-remote-stanza`) goes through `allod secret migrate <name>` on the host; each plain legacy entry (`raw`, `raw-forgejo-token`) becomes new-shape through a reviewed registry edit that drops `format` and converts every `verify` object to its command string. No ciphertext changes either way. - **Keep the local-auth source legacy** — a credential named by `local_auth_refresh` stays legacy until allod/nexus#52 supplies a new-shape refresh path or retires that dependency; `migrate` refuses it and `rotate-token` keeps rotating it. - **Bake metadata into commands** — the repository URL, user, and context that verification fields carried become part of each target's one-line `verify` string, exactly the inner command `rotate-token` printed for that probe type. Template bytes are preserved, trailing newline included. - **Stop before anything live** — private checks and composed-deployment checks run; nothing is deployed, rotated, or revoked under this issue. ### Trigger Start when all three public PRs of allod/secrets#23 (archetypes compatibility, secrets contract, tools commands) have merged and the deployment's `allod-tools` pin carries the new commands: `allod secret --help` on the host lists `migrate` and `rotate`. Before that, the private registry stays as it is. ### Required sequence 1. Re-export the public `lib.credentialEncodings` from the private secrets flake so the private validator and the commands read one encoder list. 2. Extend the private validator to the transition union: a credential is wholly legacy (`format` and a structured `verify.type` object on every target) or wholly new (optional `value` with exactly one `{secret}` in `value.template`, optional `value.encode` from the exported list, and a non-empty one-line `verify` string on every target), never a mixture on one credential; credentials in one group share one encoding. Add the positive fixture and sabotage witnesses. Land this before any entry migrates. 3. Normalize any group whose service classification depended on a legacy credential format, so the classification stays correct once `format` is gone. 4. For each eligible legacy container credential, run `allod secret migrate <name>` on the host, one reviewed branch per run. `migrate` decrypts only in memory, accepts only the canonical container bytes, proves the extracted field renders back to the original plaintext byte-for-byte, and rewrites only the registry entry. For an rclone container the migrated declaration carries `encode: "rclone-obscure"` and the stored secret is the currently deployed obscured password; the next `allod secret rotate` takes a raw password and obscures it. 5. For each plain legacy entry, edit the registry: remove `format`, turn each target's `verify` object into the command string `rotate-token` printed for it, and drop any target-level metadata field the string now carries. Review the diff like any other registry change. 6. Treat a green `verify` command for a credential that is consumed only when a machine later joins as deployment health, not as proof that the standby value was exercised. ### Validation and human gate After each registry change run the private secrets checks and the composed-deployment checks, then stop with the branch and the check output ready for review. Do not deploy, rotate a live value, revoke an old value, or run a verification command against a machine as part of this issue; those remain the owner's acts. ### Scope In scope: the private re-export, validator union and witnesses, group normalization, container migration through `allod secret migrate`, plain-entry registry edits, verification-command conversion, and private validation. Out of scope: the public implementation for allod/secrets#23, retiring `rotate-token` and moving `local_auth_refresh` off the legacy shape (allod/nexus#52), renaming the registry (allod/secrets#22), removing legacy acceptance from the public and private validators (its own follow-up issue), and any live deployment or revocation.

allod-agent added the

handoff

label

2026-09-12 01:09:01 +01:00

allod-agent referenced this issue from allod/strategy

2026-09-12 02:00:15 +01:00

Plan credential value templates across public consumers #54

vnprc-agent referenced this issue from a commit

2026-09-12 05:47:09 +01:00

Accept the value-template credential shape alongside the legacy one

vnprc-agent referenced this issue from a commit

2026-09-12 06:02:29 +01:00

Convert six plain legacy credentials to the value-template shape

vnprc-agent referenced this issue from a commit

2026-09-12 06:02:50 +01:00

Record codex stdin hang, host-user-credentials baseline red, and the allod/secrets#25 private PR state

vnprc-agent commented

2026-09-12 18:31:02 +01:00

Handoff complete on the private side. The private secrets flake re-exports lib.credentialEncodings, its validator accepts the wholly-legacy-or-wholly-new union with a positive fixture and one sabotage witness, the group that depended on the stanza format is service: none, the two container credentials went through allod secret migrate on the host and the plain entries through reviewed edits. Every entry is new-shape except the local_auth_refresh source, which stays legacy until allod/nexus#52. Private checks and the composed deployment checks are green; nothing was deployed, rotated, or revoked. The follow-up for removing legacy acceptance is filed separately.

Handoff complete on the private side. The private secrets flake re-exports `lib.credentialEncodings`, its validator accepts the wholly-legacy-or-wholly-new union with a positive fixture and one sabotage witness, the group that depended on the stanza format is `service: none`, the two container credentials went through `allod secret migrate` on the host and the plain entries through reviewed edits. Every entry is new-shape except the `local_auth_refresh` source, which stays legacy until allod/nexus#52. Private checks and the composed deployment checks are green; nothing was deployed, rotated, or revoked. The follow-up for removing legacy acceptance is filed separately.

vnprc-agent referenced this issue

2026-09-12 18:31:02 +01:00

Remove legacy credential-shape acceptance once every registry is on value templates #27