credential-registry: accept the value-template shape only #28

Merged

vnprc merged 2 commits from agent/credential-registry-new-shape into master

2026-09-13 02:44:12 +01:00

allod-agent commented

2026-09-13 00:51:29 +01:00

Member

Summary

The credential-registry check now accepts one credential shape only: an optional value template plus a string verify command on every target. An entry carrying the retired format field is refused by name, and a target whose verify is not a string is refused with its own message; the coexistence fixtures that kept the old shape alive (legacy-*, migrating, legacy-new-mix, legacy-format, legacy-verify) are gone and two sabotage fixtures pin the new refusals. Nothing deployed changes: the public registry in this repo carries no format entry (verified with jq before editing), so the check's positive path evaluates exactly as before, and the ciphertext, groups, and local_auth_refresh metadata are untouched. The check rebuilt clean with 19 sabotage fixtures passing, and nix flake check is green. If it is wrong, revert the two commits; the check goes back to accepting both shapes.

Refs allod/secrets#27. The tools slice of that issue (removing allod secret migrate and the legacy refusals) is a separate allod/tools PR, and the archetypes predicate is allod/archetypes#77; the issue closes on the tools PR, last in the chain.

Change

flake.nix: isLegacyVerify, hasFormat, legacyDiagnostics, and the mixed-shape diagnostic are removed; each target's verify is classified once (missing, non-string, or not a one-line command) so a credential with several bad targets surfaces each kind; a credential carrying format gets one diagnostic naming it, with a placeholder when its credential field is not a string, so a malformed entry cannot make the validator itself throw.
Fixtures: the positive coexistence group becomes tokens (new shape only); every sabotage that used the legacy credential as its valid neighbour now uses the new-shape one; format-field, format-field-non-string-name, and non-string-verify pin the refusals.
README.md: the coexistence paragraph is replaced with the one accepted shape and its two refusals.

Risk

R2. A validator narrowing inside a check with one sabotage witness per rule; no module, secret, or deployed output changes; rollback is a straight revert.

Validation

jq '[.[] | .credentials[]? | select(has("format"))] | length' forgejo-token-groups.json printed 0. nix build --rebuild -L .#checks.x86_64-linux.credential-registry: credential registry validation and 19 sabotage fixtures passed. nix flake check: all checks passed. Cold cross-family review by gpt-5.5 (codex, read-only sandbox) on the first commit found one defect, the toString on a non-string credential name aborting evaluation; the second commit fixes it and adds the fixture that pins it.

## Summary The `credential-registry` check now accepts one credential shape only: an optional `value` template plus a string `verify` command on every target. An entry carrying the retired `format` field is refused by name, and a target whose `verify` is not a string is refused with its own message; the coexistence fixtures that kept the old shape alive (`legacy-*`, `migrating`, `legacy-new-mix`, `legacy-format`, `legacy-verify`) are gone and two sabotage fixtures pin the new refusals. Nothing deployed changes: the public registry in this repo carries no `format` entry (verified with `jq` before editing), so the check's positive path evaluates exactly as before, and the ciphertext, groups, and `local_auth_refresh` metadata are untouched. The check rebuilt clean with 19 sabotage fixtures passing, and `nix flake check` is green. If it is wrong, revert the two commits; the check goes back to accepting both shapes. Refs allod/secrets#27. The tools slice of that issue (removing `allod secret migrate` and the legacy refusals) is a separate allod/tools PR, and the archetypes predicate is https://forge.anarch.diy/allod/archetypes/pulls/77; the issue closes on the tools PR, last in the chain. ## Change - `flake.nix`: `isLegacyVerify`, `hasFormat`, `legacyDiagnostics`, and the mixed-shape diagnostic are removed; each target's `verify` is classified once (missing, non-string, or not a one-line command) so a credential with several bad targets surfaces each kind; a credential carrying `format` gets one diagnostic naming it, with a placeholder when its `credential` field is not a string, so a malformed entry cannot make the validator itself throw. - Fixtures: the positive `coexistence` group becomes `tokens` (new shape only); every sabotage that used the legacy credential as its valid neighbour now uses the new-shape one; `format-field`, `format-field-non-string-name`, and `non-string-verify` pin the refusals. - `README.md`: the coexistence paragraph is replaced with the one accepted shape and its two refusals. ## Risk R2. A validator narrowing inside a check with one sabotage witness per rule; no module, secret, or deployed output changes; rollback is a straight revert. ## Validation `jq '[.[] | .credentials[]? | select(has("format"))] | length' forgejo-token-groups.json` printed 0. `nix build --rebuild -L .#checks.x86_64-linux.credential-registry`: `credential registry validation and 19 sabotage fixtures passed`. `nix flake check`: all checks passed. Cold cross-family review by gpt-5.5 (codex, read-only sandbox) on the first commit found one defect, the `toString` on a non-string credential name aborting evaluation; the second commit fixes it and adds the fixture that pins it.

allod-agent added 2 commits

2026-09-13 00:51:29 +01:00