Export lib.mkLocalAuthRefreshSources beside its applied result #36

Merged

vnprc merged 1 commit from agent/local-auth-refresh-constructor into master

2026-09-20 17:08:31 +01:00

allod-agent commented

2026-09-20 17:07:15 +01:00

Member

Nothing changes for a running machine: lib.localAuthRefreshSources, the attribute refresh-local-auth evaluates at preflight, has the same value as before, byte for byte. What is new is lib.mkLocalAuthRefreshSources, the same validated projection as a function of a caller-supplied registry, so a deployment's fork applies it to its own registry instead of copying the field mapping and gating it with the diagnostics itself. This is the shape lib.mkPiCredentialContract already has beside lib.piCredentials. The public registry, its diagnostics, and every other export stay identical. Proof: nix flake check passes, the local-auth-refresh check runs the public registry and every sabotage fixture through the exported binding, and the refresh script's exact nix eval line answers the same JSON on this branch as on master. If it is wrong, revert this one commit; no consumer has switched to the new name.

Closes allod/secrets#35. Refs allod/secrets#29.

What changed

flake.nix: validateLocalAuthRefresh is renamed mkLocalAuthRefreshSources and exported as lib.mkLocalAuthRefreshSources; lib.localAuthRefreshSources is now defined as that constructor applied to rotationRegistry. The local-auth-refresh check references the renamed binding; its assertions are unchanged.
README.md: one row in the export table for lib.mkLocalAuthRefreshSources, beside lib.localAuthRefreshSources.

Risk

R1. A rename plus one added export in a single repository. The only observable behaviour for existing consumers is the value of lib.localAuthRefreshSources, which is measured identical below. Rollback is a straight revert. No secrets, host commands, provisioning, or cross-repo ordering: allod/nexus and allod/archetypes keep reading the applied export and need no change.

Validation

Run on this branch at its head commit:

nix flake check in the worktree: all six checks pass, including local-auth-refresh, which forces the public projection and runs every sabotage fixture through mkLocalAuthRefreshSources.
nix eval .#lib.mkLocalAuthRefreshSources --apply 'f: f {}' evaluates to { }.
nix eval .#lib --apply 'l: l.mkLocalAuthRefreshSources l.rotationRegistry == l.localAuthRefreshSources' evaluates to true.
A malformed registry ({ g = { credentials = []; local_auth_refresh = [ 1 ]; }; }) passed to the exported constructor fails under tryEval, so the gate travels with the export.
The refresh script's exact read, nix eval --json "path:<checkout>#lib.localAuthRefreshSources", produces byte-identical JSON on this branch and on master (cmp clean).
tests/refresh-local-auth.sh in allod/nexus: 21 tests pass. Note this suite stubs nix and never reads a real secrets checkout, so it witnesses only that the consumer's contract is unchanged, not this flake; the cmp above is the witness for the real read.

Nothing changes for a running machine: `lib.localAuthRefreshSources`, the attribute `refresh-local-auth` evaluates at preflight, has the same value as before, byte for byte. What is new is `lib.mkLocalAuthRefreshSources`, the same validated projection as a function of a caller-supplied registry, so a deployment's fork applies it to its own registry instead of copying the field mapping and gating it with the diagnostics itself. This is the shape `lib.mkPiCredentialContract` already has beside `lib.piCredentials`. The public registry, its diagnostics, and every other export stay identical. Proof: `nix flake check` passes, the `local-auth-refresh` check runs the public registry and every sabotage fixture through the exported binding, and the refresh script's exact `nix eval` line answers the same JSON on this branch as on master. If it is wrong, revert this one commit; no consumer has switched to the new name. Closes allod/secrets#35. Refs allod/secrets#29. ## What changed - `flake.nix`: `validateLocalAuthRefresh` is renamed `mkLocalAuthRefreshSources` and exported as `lib.mkLocalAuthRefreshSources`; `lib.localAuthRefreshSources` is now defined as that constructor applied to `rotationRegistry`. The `local-auth-refresh` check references the renamed binding; its assertions are unchanged. - `README.md`: one row in the export table for `lib.mkLocalAuthRefreshSources`, beside `lib.localAuthRefreshSources`. ## Risk R1. A rename plus one added export in a single repository. The only observable behaviour for existing consumers is the value of `lib.localAuthRefreshSources`, which is measured identical below. Rollback is a straight revert. No secrets, host commands, provisioning, or cross-repo ordering: `allod/nexus` and `allod/archetypes` keep reading the applied export and need no change. ## Validation Run on this branch at its head commit: - `nix flake check` in the worktree: all six checks pass, including `local-auth-refresh`, which forces the public projection and runs every sabotage fixture through `mkLocalAuthRefreshSources`. - `nix eval .#lib.mkLocalAuthRefreshSources --apply 'f: f {}'` evaluates to `{ }`. - `nix eval .#lib --apply 'l: l.mkLocalAuthRefreshSources l.rotationRegistry == l.localAuthRefreshSources'` evaluates to `true`. - A malformed registry (`{ g = { credentials = []; local_auth_refresh = [ 1 ]; }; }`) passed to the exported constructor fails under `tryEval`, so the gate travels with the export. - The refresh script's exact read, `nix eval --json "path:<checkout>#lib.localAuthRefreshSources"`, produces byte-identical JSON on this branch and on master (`cmp` clean). - `tests/refresh-local-auth.sh` in `allod/nexus`: 21 tests pass. Note this suite stubs `nix` and never reads a real secrets checkout, so it witnesses only that the consumer's contract is unchanged, not this flake; the `cmp` above is the witness for the real read.

allod-agent added 1 commit

2026-09-20 17:07:15 +01:00

Export lib.mkLocalAuthRefreshSources beside its applied result 94eb310ccf

The validated local_auth_refresh projection was only exported applied to
this repository's registry. A fork that validates its own registry had
to copy the field mapping and gate it with lib.localAuthRefreshDiagnostics
itself. Rename validateLocalAuthRefresh to mkLocalAuthRefreshSources,
export it as a function of a registry, and define
lib.localAuthRefreshSources through it, the way lib.mkPiCredentialContract
sits beside lib.piCredentials. The applied export's value is unchanged.

Refs allod/secrets#35

allod-agent referenced this pull request

2026-09-20 17:07:24 +01:00

One credential-store URL predicate: stop hand-synchronising five spellings of one grammar #29