credential-inventory: run the rules over sabotage fixtures too

allod-agent commented

2026-09-11 02:43:39 +01:00

Member

The credential inventory check now proves its own file-presence rules on every run: it evaluates the same rules over two built-in fixtures, one that must pass and one that must fail, and refuses if either comes out wrong. For the repository's real data nothing changes: the same rules, the same messages, the same pass. The one mechanical difference is that "does the ciphertext exist" is now answered while evaluating rather than in the build step, which is what lets a fixture answer it from a table. What proves it: the checks pass on this branch; inverting the rule in a copy makes the fixture assertion fail; and a copy with a committed ciphertext beside a pending entry fails with the same message as before. If it is wrong, revert; the previous check is one commit back.

Closes allod/secrets#20. The rule under test landed in allod/secrets#19; this is the standing witness that pass's manual sabotage lacked.

Risk

R1. The rules and messages are unchanged; the refactor moves them into a function and adds assertions that only ever read fixture data. The worst credible failure is a fixture assertion that is wrong in a way the real data also is, which the inverted-rule run rules out for both file rules.

Validation

nix flake check on this branch: all checks passed.
Rule inverted in a copy (pending requires the file present): fails with credential-inventory: fixture with the right files present was refused.
Real-data sabotage in a copy (a committed .age beside a pending entry): fails with credential-inventory: secrets/sabotage-pending.age exists but sabotage-pending is pending; land it with 'allod secret create sabotage-pending' or set rotation_state to active.

The credential inventory check now proves its own file-presence rules on every run: it evaluates the same rules over two built-in fixtures, one that must pass and one that must fail, and refuses if either comes out wrong. For the repository's real data nothing changes: the same rules, the same messages, the same pass. The one mechanical difference is that "does the ciphertext exist" is now answered while evaluating rather than in the build step, which is what lets a fixture answer it from a table. What proves it: the checks pass on this branch; inverting the rule in a copy makes the fixture assertion fail; and a copy with a committed ciphertext beside a pending entry fails with the same message as before. If it is wrong, revert; the previous check is one commit back. Closes allod/secrets#20. The rule under test landed in allod/secrets#19; this is the standing witness that pass's manual sabotage lacked. ## Risk R1. The rules and messages are unchanged; the refactor moves them into a function and adds assertions that only ever read fixture data. The worst credible failure is a fixture assertion that is wrong in a way the real data also is, which the inverted-rule run rules out for both file rules. ## Validation - `nix flake check` on this branch: all checks passed. - Rule inverted in a copy (`pending` requires the file present): fails with `credential-inventory: fixture with the right files present was refused`. - Real-data sabotage in a copy (a committed `.age` beside a `pending` entry): fails with `credential-inventory: secrets/sabotage-pending.age exists but sabotage-pending is pending; land it with 'allod secret create sabotage-pending' or set rotation_state to active`.

allod-agent added 1 commit

2026-09-11 02:43:39 +01:00

credential-inventory: run the rules over sabotage fixtures too 96d79cfc58

The check's rules become a function of the inventory, the recipient map, the machine keys and a file-presence predicate. The real run passes the repository's data and asks the flake source whether each ciphertext exists; two fixture runs pass a pending and an active entry with a table of present files, one arranged so both file rules hold and one so both fail, and the check asserts each outcome. File presence moves from the build shell to evaluation so it can be parameterized; messages are unchanged.

Refs allod/secrets#20

vnprc merged commit 96d79cfc58 into master

2026-09-11 02:44:41 +01:00

vnprc deleted branch agent/inventory-sabotage-fixture

2026-09-11 02:44:42 +01:00

Rows
Columns

credential-inventory: run the rules over sabotage fixtures too #21

Risk

Validation