Remove legacy credential-shape acceptance once every registry is on value templates #27

New issue

Closed

opened 2026-09-12 18:31:02 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-09-12 18:31:02 +01:00

Remove the legacy credential shape (format plus structured verify.type objects) from the public credential-registry check and from the deployment's private validator once no registry entry carries format, so the value-template contract of allod/secrets#23 is the only shape a registry can hold and rotate-token has nothing left to rotate.

Primary goals:

One shape — the credential-registry check refuses format and any non-string verify, and the coexistence fixtures (legacy-*, migrating, legacy-new-mix, legacy-format, legacy-verify) go, replaced by fixtures that pin the new shape alone.
Private validator follows — the deployment's validator drops its legacy branch and its credential-store-url requirement on the local_auth_refresh source, accepting the template predicate archetypes already uses.
Docs — the coexistence section of allod secret's documentation and the legacy refusal messages in declare, create, rotate and migrate are retired; migrate itself can be removed once no deployment has a container entry left.

Trigger

Blocked on allod/nexus#52: the deployment's local_auth_refresh source credential must stay legacy until refresh-local-auth has a new-shape implementation or that dependency is retired. Start when that has landed and the private registry has migrated its last entry.

Scope

In: the public check and fixtures, the private validator (under its own handoff issue), the allod secret legacy paths and docs. Out: allod/nexus#52 itself, renaming the registry (allod/secrets#22).

Refs allod/secrets#25, allod/secrets#23, allod/nexus#52.

Remove the legacy credential shape (`format` plus structured `verify.type` objects) from the public `credential-registry` check and from the deployment's private validator once no registry entry carries `format`, so the value-template contract of allod/secrets#23 is the only shape a registry can hold and `rotate-token` has nothing left to rotate. Primary goals: - **One shape** — the `credential-registry` check refuses `format` and any non-string `verify`, and the coexistence fixtures (`legacy-*`, `migrating`, `legacy-new-mix`, `legacy-format`, `legacy-verify`) go, replaced by fixtures that pin the new shape alone. - **Private validator follows** — the deployment's validator drops its legacy branch and its `credential-store-url` requirement on the `local_auth_refresh` source, accepting the template predicate archetypes already uses. - **Docs** — the coexistence section of `allod secret`'s documentation and the legacy refusal messages in `declare`, `create`, `rotate` and `migrate` are retired; `migrate` itself can be removed once no deployment has a container entry left. ### Trigger Blocked on allod/nexus#52: the deployment's `local_auth_refresh` source credential must stay legacy until `refresh-local-auth` has a new-shape implementation or that dependency is retired. Start when that has landed and the private registry has migrated its last entry. ### Scope In: the public check and fixtures, the private validator (under its own handoff issue), the `allod secret` legacy paths and docs. Out: allod/nexus#52 itself, renaming the registry (allod/secrets#22). Refs allod/secrets#25, allod/secrets#23, allod/nexus#52.