credential-inventory: add the pending rotation state #19

Merged

vnprc merged 1 commit from agent/secret-pending-state into master

2026-09-11 01:52:54 +01:00

allod-agent commented

2026-09-10 23:56:19 +01:00

Member

The credential inventory check now accepts a fifth rotation state, pending, for a credential whose non-secret entries have been declared but whose encrypted file the host has not produced yet. In that state the check requires the file to be absent; in every other state it still requires the file present, exactly as before. Nothing changes for any running machine: no entry in this template is pending, and the state is not consumed by any module. What proves it: the checks pass unchanged on this branch, and two sabotage copies confirmed the new rule fails the right way (a pending entry with a file present is refused with a message naming the entry, and a pending entry with no file passes). If it is wrong, revert this commit; nothing depends on it yet.

Refs allod/tools#182. This is the first of three landings for that issue: the state must exist here before the allod secret create command in tools can flip it, and before an agent's PR can declare a credential in it.

Risk

R2. The change adds a value to an enum and a branch to a shell check. The worst credible failure after validation is a pending entry that some consumer module tries to read as an active one: today no module reads rotation_state for agenix consumers, and a deploy that pins a pending entry fails at build time on the missing file, which is the existing behavior for any missing secret.

Validation

nix flake check on this branch: all checks passed.
Sabotage A: a pending entry with a secrets.nix line and no .age file passes credential-inventory.
Sabotage B: the same entry with a .age file present fails with ERROR: secrets/sabotage-pending.age exists but sabotage-pending is pending; land it with 'allod secret create sabotage-pending' or set rotation_state to active.
The existing rule for active without a file is unchanged and was not re-run.

The credential inventory check now accepts a fifth rotation state, `pending`, for a credential whose non-secret entries have been declared but whose encrypted file the host has not produced yet. In that state the check requires the file to be absent; in every other state it still requires the file present, exactly as before. Nothing changes for any running machine: no entry in this template is pending, and the state is not consumed by any module. What proves it: the checks pass unchanged on this branch, and two sabotage copies confirmed the new rule fails the right way (a pending entry with a file present is refused with a message naming the entry, and a pending entry with no file passes). If it is wrong, revert this commit; nothing depends on it yet. Refs allod/tools#182. This is the first of three landings for that issue: the state must exist here before the `allod secret create` command in tools can flip it, and before an agent's PR can declare a credential in it. ## Risk R2. The change adds a value to an enum and a branch to a shell check. The worst credible failure after validation is a pending entry that some consumer module tries to read as an active one: today no module reads `rotation_state` for agenix consumers, and a deploy that pins a pending entry fails at build time on the missing file, which is the existing behavior for any missing secret. ## Validation - `nix flake check` on this branch: all checks passed. - Sabotage A: a `pending` entry with a `secrets.nix` line and no `.age` file passes `credential-inventory`. - Sabotage B: the same entry with a `.age` file present fails with `ERROR: secrets/sabotage-pending.age exists but sabotage-pending is pending; land it with 'allod secret create sabotage-pending' or set rotation_state to active`. - The existing rule for `active` without a file is unchanged and was not re-run.

allod-agent added 1 commit

2026-09-10 23:56:19 +01:00