Move the check suite and the registry validators out of flake.nix #38

Merged

vnprc merged 1 commit from agent/secrets-checks-out-of-flake into master

2026-09-22 03:34:24 +01:00

allod-agent commented

2026-09-22 01:48:53 +01:00

Member

The seven checks move out of flake.nix into checks/ and the registry validators into lib/, and nothing any check asserts or any validator accepts changes: six of the seven check derivation paths and 26 of the 28 exported lib values are byte-identical before and after, and the remaining three differ only by this repository's own source-tree hash, which every commit shifts. flake.nix goes from 1465 lines to 165 and is the composition of data files and exports again. What proves it is the derivation-path comparison, the hash-normalized comparison for the three, all seven checks building, and allod/archetypes evaluating identically against this branch and against master. If it is wrong, revert the one commit.

What changed

checks/<name>.nix for each of the seven checks, each declaring exactly the arguments it reads (discovered from parse-time undefined-variable errors), with checks/default.nix as the index in the shape allod/archetypes#96 established.
lib/credential-registry.nix, lib/credential-store-url.nix, lib/local-auth-refresh.nix: the validators that were bindings in the flake's top-level scope, now beside the four lib/ files that already had that role. flake.nix imports them and exports the same names with the same values.
Two root-relative path literals shifted for their new location (../rotation-registry.json, ../lib/pi-credential-recipients.nix); a string "../escape" that is a deliberately malicious fixture key was left alone.
README: the layout list names the new files, and a "Checks" section describes the index, in the shape of the archetypes README's.

Risk

R2. Test apparatus and pure library code move; no ciphertext, recipient, identity or deployed path changes. The derivation-path witness covers every check and every exported value, and archetypes, the consumer of lib, was evaluated against the branch. Residual risk is prose describing the old layout. Rollback is a straight revert.

Validation

Derivation paths and lib values captured one nix process per item on master and on the branch. Identical: 6 checks and 26 lib attributes. Differ: credential-inventory, lib.devIdentities, lib.vmHostKeySecretFiles. Each of the three references self or a flake path as a string, so the flake's own source store path is part of its value; with that one hash normalized the two lib values are identical and the check's derivation differs only in its source input and, consequently, its output path. The worker also reproduced the same three-line diff by adding one unrelated tracked file to an unchanged tree.
All seven checks build (nix build .#checks.x86_64-linux.<name>, one at a time).
Cross-repo: allod/archetypes vmFacts and the credential-profiles and credential-store-url-parity check derivations, evaluated with --override-input secrets pointing at secrets master and at this branch: vmFacts identical with the source hash normalized; credential-profiles derivation path identical outright; credential-store-url-parity differs only in its secrets source input, because it reads ${secrets}/credential-store-url.json through the whole secrets tree, so its derivation shifts on every secrets commit (confirmed by diffing the two derivations with store hashes normalized: only the source input and the output path differ).
Every file parses (nix-instantiate --parse).
One cold cross-family review of the diff (gpt-5.6-terra on codex, high effort): no findings, after reading the index, the three lib files, the new check files and the README (transcript of 335 KB; an empty review was ruled out before it was read as approval).

Closes allod/secrets#37

The seven checks move out of `flake.nix` into `checks/` and the registry validators into `lib/`, and nothing any check asserts or any validator accepts changes: six of the seven check derivation paths and 26 of the 28 exported `lib` values are byte-identical before and after, and the remaining three differ only by this repository's own source-tree hash, which every commit shifts. `flake.nix` goes from 1465 lines to 165 and is the composition of data files and exports again. What proves it is the derivation-path comparison, the hash-normalized comparison for the three, all seven checks building, and allod/archetypes evaluating identically against this branch and against master. If it is wrong, revert the one commit. ## What changed - `checks/<name>.nix` for each of the seven checks, each declaring exactly the arguments it reads (discovered from parse-time undefined-variable errors), with `checks/default.nix` as the index in the shape allod/archetypes#96 established. - `lib/credential-registry.nix`, `lib/credential-store-url.nix`, `lib/local-auth-refresh.nix`: the validators that were bindings in the flake's top-level scope, now beside the four `lib/` files that already had that role. `flake.nix` imports them and exports the same names with the same values. - Two root-relative path literals shifted for their new location (`../rotation-registry.json`, `../lib/pi-credential-recipients.nix`); a string `"../escape"` that is a deliberately malicious fixture key was left alone. - README: the layout list names the new files, and a "Checks" section describes the index, in the shape of the archetypes README's. ## Risk R2. Test apparatus and pure library code move; no ciphertext, recipient, identity or deployed path changes. The derivation-path witness covers every check and every exported value, and archetypes, the consumer of `lib`, was evaluated against the branch. Residual risk is prose describing the old layout. Rollback is a straight revert. ## Validation - Derivation paths and `lib` values captured one `nix` process per item on master and on the branch. Identical: 6 checks and 26 `lib` attributes. Differ: `credential-inventory`, `lib.devIdentities`, `lib.vmHostKeySecretFiles`. Each of the three references `self` or a flake path as a string, so the flake's own source store path is part of its value; with that one hash normalized the two `lib` values are identical and the check's derivation differs only in its source input and, consequently, its output path. The worker also reproduced the same three-line diff by adding one unrelated tracked file to an unchanged tree. - All seven checks build (`nix build .#checks.x86_64-linux.<name>`, one at a time). - Cross-repo: allod/archetypes `vmFacts` and the `credential-profiles` and `credential-store-url-parity` check derivations, evaluated with `--override-input secrets` pointing at secrets master and at this branch: `vmFacts` identical with the source hash normalized; `credential-profiles` derivation path identical outright; `credential-store-url-parity` differs only in its secrets source input, because it reads `${secrets}/credential-store-url.json` through the whole secrets tree, so its derivation shifts on every secrets commit (confirmed by diffing the two derivations with store hashes normalized: only the source input and the output path differ). - Every file parses (`nix-instantiate --parse`). - One cold cross-family review of the diff (`gpt-5.6-terra` on codex, high effort): no findings, after reading the index, the three lib files, the new check files and the README (transcript of 335 KB; an empty review was ruled out before it was read as approval). Closes allod/secrets#37

allod-agent added 1 commit

2026-09-22 01:48:53 +01:00

Move checks and registry validators out of flake.nix 8350ac854a

Extract the seven inline checks into checks/<name>.nix with
checks/default.nix as the index, and move credentialRegistryDiagnostics,
validateCredentialRegistry, the credential-store-URL predicates, and the
local-auth-refresh contract and diagnostics into lib/. flake.nix is now
the composition of data files and exports; every check and validator
declares exactly the inputs it reads.

Pure move: every check's derivation path and the exported lib attribute
set are unchanged, except for three outputs (the credential-inventory
check and the devIdentities/vmHostKeySecretFiles lib exports) that embed
a self-relative store path, whose value necessarily shifts whenever any
tracked file in the repo changes -- verified by reproducing the identical
three-line diff from adding one unrelated throwaway tracked file to an
otherwise clean tree at the baseline revision.

Refs allod/secrets#37