Host-provided repos: inject and refresh a checkout from the hypervisor when the guest may not read its remote #62
Labels
No labels
blocked
bug
decision
duplicate
enhancement
help wanted
invalid
landed?
question
ready-to-merge
stale
wontfix
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
allod/strategy#62
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
A dev VM whose forge identity may not read one of its declared repos gets that checkout from the hypervisor, which holds the credential, instead of a guest-side clone that can never succeed.
The framework asserts that every dev VM lists every memory repo (allod/archetypes aef13ef), and the guest bootstrap clones every listed repo with the guest's own forge key under
set -e. A deployment whose public-facing dev VM is denied read access to its private memory fork by design cannot satisfy both: listing the repo makes the machine unprovisionable (the bootstrap dies at that clone andverify-vmfails) and leaves the harness memory symlink dangling, while omitting it fails the eval assert. The witness is allod-dev on 2026-10-01 (allod/nexus#71, allod/archetypes#127).Primary goals:
vm-specs.json; the eval assert stays satisfied because the repo remains inrepos.bootstrap-vmskips host-provided repos in the guest clone step and runs a host step that puts the hypervisor's own checkout at the guest's declared path over the host-to-guest ssh channel the scripts already use. The same step is the update path, soverify-vm --repairrefreshes it andverify-vmkeeps checking that it exists.pull-all,work-diff,flake-update-cascade) skip it by a rule instead of failing.Design notes
Transport is decided in the nexus child: a push from the hypervisor into the guest path with
receive.denyCurrentBranch=updateInstead, which refuses a dirty guest tree loudly, or a git bundle over scp, which is the transport deployments already use by hand between the hypervisor and this machine. The injected checkout should be recognizable as host-provided on the guest, for example by carrying noorigin, so tools skip it by inspection rather than by a list they would have to keep in sync.Children
bootstrap-vmhost step, skip in the guest step, refresh on repairvm-specs.jsonrendering, mirrored by deploymentspull-alland the other checkout walkers skip host-provided checkoutsScope
Tracked separately:
rebuild-vmrunning the verifier after its switch (allod/nexus#71) and a loud activation warning on a missing memory checkout (allod/archetypes#127). Both remain useful once this lands; neither replaces it.All public children are filed and have pull requests open; only the deployment-side child remains, which is tracked privately.
bootstrap-vmhost step, guest-step skip, refresh on repairhost_provided_repos, rendered intovm-specs.jsonpull-allandflake-update-cascadeskip a checkout with nooriginrebuild-vmrunsverify-vmafter the switch (tracked separately)Decisions taken in the children: the marker is
host_provided_repos, a list of registry ids that must each appear in the machine'srepos; the transport is agit pushfrom the hypervisor into a guest-sidegit initwithreceive.denyCurrentBranch=updateInstead, which refuses a dirty tree, guest-local commits, and (by a prep check before the push) a different checked-out branch; the guest copy carries noorigin, and that absence is the rule the tools child keys on. The nexus and inventory changes are independent, sincebootstrap-vmreads the key ashost_provided_repos // []. Each pull request carries its own risk score and validation. This issue stays open for the deployment-side child and for whoever owns it to close.A second repo on allod-dev is in the same position as the memory fork but cannot be host-provided, because the guest writes and pushes it: the traces repo. Tracked as allod/strategy#63, deployment-side.
All four children have landed: allod/nexus#73 (bootstrap-vm host step), allod/inventory#21 (marker and rendering), allod/tools#268 (checkout walkers skip a no-origin checkout), and the deployment-side child, tracked privately, which marked its fork's private memory repo host-provided, bumped its deploy lock, and ran the repair on the hypervisor. Closing as completed.