Separate hypervisor Pi recipients from VM keys #15

Merged

vnprc merged 2 commits from agent/pi-split-hypervisor-recipients into master

2026-08-24 14:30:47 +01:00

allod-agent commented

2026-08-24 06:21:46 +01:00

Member

Pi credential recipients now take the hypervisor's ordered keys from identity data and VM keys from the VM registry.
The public template removes Nexus from machine-host-keys.json, while its exported credential inventory stays identical.
Existing external constructor callers keep working through a tested compatibility fallback.
No running machine changes until a deployment updates its secrets pin and rebuilds.
Registry, inventory, split-key sabotage, and the deploy composed-layer canary prove the contract.
If this is wrong, keep the prior secrets pin or revert this PR before adopting the Nexus integration.

Refs allod/nexus#29

Contract

secrets.nix and the flake pass identity.hostPublicKeys as the exact ordered hypervisorPublicKeys list.
machineHostKeys contains VM records only. Duplicate validation covers the hypervisor keys and every VM record, including untargeted machines.
Recipients preserve hypervisor active/staged order, then registry target order with each VM's active key before its staged key.
mkPiCredentialContract accepts explicit hypervisorPublicKeys without nexusName; only omission of the explicit list requires nexusName and reads the historical machineHostKeys.${nexusName} record.

Validation

nix build --no-link .#checks.x86_64-linux.pi-credential-registry -L
nix build --no-link .#checks.x86_64-linux.credential-inventory -L
nix build --no-link --override-input secrets path:<this-worktree> .#checks.x86_64-linux.composed-layer -L in allod/deploy
nix eval --json .#lib.credentials | sha256sum matched master: e7175c2e08265b60553818fa3887dca15d347a6b33ef1a42d4013659152773e2

Risk is R3 because this changes a shared recipient interface. Independent gpt-5.6-sol review found global duplicate coverage, public ownership migration, and malformed-input diagnostic gaps; all were fixed and witnessed before submission. The known deploy consumer was measured against this exact checkout.

Pi credential recipients now take the hypervisor's ordered keys from identity data and VM keys from the VM registry. The public template removes Nexus from `machine-host-keys.json`, while its exported credential inventory stays identical. Existing external constructor callers keep working through a tested compatibility fallback. No running machine changes until a deployment updates its secrets pin and rebuilds. Registry, inventory, split-key sabotage, and the deploy composed-layer canary prove the contract. If this is wrong, keep the prior secrets pin or revert this PR before adopting the Nexus integration. Refs allod/nexus#29 ## Contract - `secrets.nix` and the flake pass `identity.hostPublicKeys` as the exact ordered `hypervisorPublicKeys` list. - `machineHostKeys` contains VM records only. Duplicate validation covers the hypervisor keys and every VM record, including untargeted machines. - Recipients preserve hypervisor active/staged order, then registry target order with each VM's active key before its staged key. - `mkPiCredentialContract` accepts explicit `hypervisorPublicKeys` without `nexusName`; only omission of the explicit list requires `nexusName` and reads the historical `machineHostKeys.${nexusName}` record. ## Validation - `nix build --no-link .#checks.x86_64-linux.pi-credential-registry -L` - `nix build --no-link .#checks.x86_64-linux.credential-inventory -L` - `nix build --no-link --override-input secrets path:<this-worktree> .#checks.x86_64-linux.composed-layer -L` in `allod/deploy` - `nix eval --json .#lib.credentials | sha256sum` matched master: `e7175c2e08265b60553818fa3887dca15d347a6b33ef1a42d4013659152773e2` Risk is R3 because this changes a shared recipient interface. Independent `gpt-5.6-sol` review found global duplicate coverage, public ownership migration, and malformed-input diagnostic gaps; all were fixed and witnessed before submission. The known deploy consumer was measured against this exact checkout.

allod-agent added 1 commit

2026-08-24 06:21:46 +01:00