Move the check suite and the registry validators out of flake.nix #37

New issue

Closed

opened 2026-09-22 01:30:27 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-22 01:30:27 +01:00

Member

Bring secrets/flake.nix up to the same standard allod/archetypes#93 set for the framework flake: the checks move to checks/, the registry validators move to lib/, and the flake is the composition of data and exports again.

Primary goals:

flake.nix is composition again — it is 1465 lines today and the checks output starts at line 398, so roughly three quarters of the file is test apparatus sitting beside the data it validates.
Validators live in lib/ — the credential-registry and local-auth-refresh validators are library code that happens to be bound in the flake's top-level scope; lib/ already exists with four files in exactly that role.
Every check a function of its inputs — each takes the registry, the identities and pkgs as arguments and declares them, with checks/default.nix as the index that hands them over.
A pure move — every check's derivation path and the exported lib attribute set are unchanged, which is the same gate allod/archetypes#93 used.

Current state and specifics

Seven checks are declared inline in the checks output: external-ssh-trust-targets (flake.nix:402), dev-ssh-hosts (:437), credential-registry (:543), credential-store-url (:760), local-auth-refresh (:804), pi-credential-registry (:948) and credential-inventory (:1272), running to the end of the file. The top-level scope above them (flake.nix:14-367) mixes reading the data files with the validators over them: credentialRegistryDiagnostics (:40), validateCredentialRegistry (:142), the credential-store-URL predicates (:163-192), and the local-auth-refresh contract and diagnostics (:194-305). lib/dev-ssh-hosts.nix, lib/pi-credential-contract.nix, lib/pi-credential-schema.nix and lib/pi-credential-recipients.nix show the shape the validators should take.

allod/archetypes#93 records the method that made the framework move safe and cheap, and it applies here unchanged: extract each check body verbatim into its own file, discover its free variables from parse-time undefined-variable errors, shift root-relative path literals for the new location, and compare every derivation path before and after with one nix process per check. One extra witness this repo needs: the exported lib set is consumed by allod/archetypes (credentials, forgeSshKeys, rotationRegistry, credentialStoreUrl, isCredentialStoreUrlSource, devIdentities, privacyIdentities, nexusIdentity, identity, vmUsernames, machineHostKeys, vmHostKeySecretFiles, githubCredentialTargets, validatePiProviderReferences, consumedInventorySource), so its attribute names and values must be identical too, and the archetypes gate should be run once against the branch with --override-input secrets.

Scope

In scope: the seven checks, the validators named above, checks/default.nix, and whatever shared helpers the move makes worth extracting.

Explicitly not in scope: changing what any check asserts or what any validator accepts. The gate is that every check's derivation path and the lib export are unchanged by it.

Refs allod/archetypes#93

Bring `secrets/flake.nix` up to the same standard allod/archetypes#93 set for the framework flake: the checks move to `checks/`, the registry validators move to `lib/`, and the flake is the composition of data and exports again. Primary goals: - **`flake.nix` is composition again** — it is 1465 lines today and the `checks` output starts at line 398, so roughly three quarters of the file is test apparatus sitting beside the data it validates. - **Validators live in `lib/`** — the credential-registry and local-auth-refresh validators are library code that happens to be bound in the flake's top-level scope; `lib/` already exists with four files in exactly that role. - **Every check a function of its inputs** — each takes the registry, the identities and `pkgs` as arguments and declares them, with `checks/default.nix` as the index that hands them over. - **A pure move** — every check's derivation path and the exported `lib` attribute set are unchanged, which is the same gate allod/archetypes#93 used. ### Current state and specifics Seven checks are declared inline in the `checks` output: `external-ssh-trust-targets` (`flake.nix:402`), `dev-ssh-hosts` (`:437`), `credential-registry` (`:543`), `credential-store-url` (`:760`), `local-auth-refresh` (`:804`), `pi-credential-registry` (`:948`) and `credential-inventory` (`:1272`), running to the end of the file. The top-level scope above them (`flake.nix:14-367`) mixes reading the data files with the validators over them: `credentialRegistryDiagnostics` (`:40`), `validateCredentialRegistry` (`:142`), the credential-store-URL predicates (`:163-192`), and the local-auth-refresh contract and diagnostics (`:194-305`). `lib/dev-ssh-hosts.nix`, `lib/pi-credential-contract.nix`, `lib/pi-credential-schema.nix` and `lib/pi-credential-recipients.nix` show the shape the validators should take. allod/archetypes#93 records the method that made the framework move safe and cheap, and it applies here unchanged: extract each check body verbatim into its own file, discover its free variables from parse-time undefined-variable errors, shift root-relative path literals for the new location, and compare every derivation path before and after with one `nix` process per check. One extra witness this repo needs: the exported `lib` set is consumed by allod/archetypes (`credentials`, `forgeSshKeys`, `rotationRegistry`, `credentialStoreUrl`, `isCredentialStoreUrlSource`, `devIdentities`, `privacyIdentities`, `nexusIdentity`, `identity`, `vmUsernames`, `machineHostKeys`, `vmHostKeySecretFiles`, `githubCredentialTargets`, `validatePiProviderReferences`, `consumedInventorySource`), so its attribute names and values must be identical too, and the archetypes gate should be run once against the branch with `--override-input secrets`. ### Scope In scope: the seven checks, the validators named above, `checks/default.nix`, and whatever shared helpers the move makes worth extracting. Explicitly not in scope: changing what any check asserts or what any validator accepts. The gate is that every check's derivation path and the `lib` export are unchanged by it. Refs allod/archetypes#93

allod-agent referenced this issue from a commit

2026-09-22 01:48:18 +01:00

Move checks and registry validators out of flake.nix

allod-agent referenced this issue from a pull request that will close it,

2026-09-22 01:48:53 +01:00

Move the check suite and the registry validators out of flake.nix #38