Plan credential value templates across public consumers

allod-agent commented

2026-09-11 22:41:23 +01:00

Member

This plan replaces copied credential format and verification enums with one checked registry shape across secrets, tools, and archetypes. It keeps legacy entries valid during the private transition, gates the one-time host migration, and makes tools the final merge. The exact contract, safe merge order, rollback paths, and local-auth dependency are recorded before implementation. A source-grounded Claude-family review found and corrected migration, creation, sequencing, quoting, and rollback defects. If the contract proves wrong during implementation, update this active plan before opening the affected implementation PR.

What changes

Adds the R3 cross-repository development plan and its retained review prompt.
Records four implementation slices, the exact issue contract, host-only gates, validation, and rollback.
Records the reviewed distinction between implementation order and safe merge order.

Risk

R0 for this documentation PR. The planned implementation is R3 and receives the review and validation budget described in the plan.

Validation

git diff --check is clean.
Plan review: claude-opus-5, effort high, through the Pi runner; 6 blockers and 10 gaps resolved or dispositioned in the review prompt.

Refs allod/secrets#23

This plan replaces copied credential format and verification enums with one checked registry shape across secrets, tools, and archetypes. It keeps legacy entries valid during the private transition, gates the one-time host migration, and makes tools the final merge. The exact contract, safe merge order, rollback paths, and local-auth dependency are recorded before implementation. A source-grounded Claude-family review found and corrected migration, creation, sequencing, quoting, and rollback defects. If the contract proves wrong during implementation, update this active plan before opening the affected implementation PR. ## What changes - Adds the R3 cross-repository development plan and its retained review prompt. - Records four implementation slices, the exact issue contract, host-only gates, validation, and rollback. - Records the reviewed distinction between implementation order and safe merge order. ## Risk R0 for this documentation PR. The planned implementation is R3 and receives the review and validation budget described in the plan. ## Validation - `git diff --check` is clean. - Plan review: `claude-opus-5`, effort `high`, through the Pi runner; 6 blockers and 10 gaps resolved or dispositioned in the review prompt. Refs allod/secrets#23

allod-agent added 1 commit

2026-09-11 22:41:23 +01:00

Plan credential value templates across public consumers 37d0835eb9

Pass 1 findings: 6 BLOCKER, 10 GAP, 0 QUESTION.
Accepted the migration proof, local-refresh gate, private cutover ordering,
create rendering, safe merge order, current tools baseline, shell quoting,
byte-exact declaration input, exact refresh predicate, transition decoding,
and truthful rollback findings. The review prompt records partial and
discarded findings with reasons.

Model: claude-opus-5

allod-agent commented

2026-09-12 02:00:15 +01:00

Author

Member

Implementation of this plan has shipped as allod/archetypes PR 76, allod/secrets PR 24, and allod/tools PR 208, with handoff issue allod/secrets#25 and follow-up allod/secrets#26. The contract refinements below were found during implementation and code review and are the binding shape now; the PR bodies carry the review evidence. Under the process change in allod/memory PR 55, a plan of this kind is R4-only, so the owner may prefer to close this PR unmerged and let issue allod/secrets#23 plus the three PR bodies stand as the record; the merge order (archetypes, secrets, then tools) is already fixed in the issue's design comment.

Implementation Findings

Contract refinements found during implementation and review, now binding:

Group encoding agreement applies to new-shape credentials only; a legacy credential declares no encoding, so a group migrates one credential at a time.
Every credential declares at least one target and every group at least one credential; a verify command is refused when blank, not only when empty.
lib.forgejoTokenGroups is validated at its export seam, so a malformed registry fails every consumer, not only nix flake check.
The archetypes predicate's blank-line rule is space and tab only, matching awk 'NF'; a source credential carrying both format and value is refused.
migrate declares encode: "rclone-obscure" for an rclone container, with the round-trip proven on plain substitution of the stored (already obscured) password; the next rotate takes a raw password and obscures it. It evaluates the encoder export and validates the built template before decrypting or writing, refuses registry fields it does not model, validates legacy user, repo_url, and deployed_path against declare's grammars before baking them into a command, and rewrites only the credential object's bytes.
Plain legacy entries (raw, raw-forgejo-token) are not migrated by migrate; they become new-shape by a reviewed registry edit, and rotate-token rotates them until then (allod/secrets#25).
Templates are UTF-8 text; every byte is preserved, and non-UTF-8 input is refused rather than altered by the JSON encoder.

Implementation of this plan has shipped as allod/archetypes PR 76, allod/secrets PR 24, and allod/tools PR 208, with handoff issue allod/secrets#25 and follow-up allod/secrets#26. The contract refinements below were found during implementation and code review and are the binding shape now; the PR bodies carry the review evidence. Under the process change in allod/memory PR 55, a plan of this kind is R4-only, so the owner may prefer to close this PR unmerged and let issue allod/secrets#23 plus the three PR bodies stand as the record; the merge order (archetypes, secrets, then tools) is already fixed in the issue's design comment. ## Implementation Findings Contract refinements found during implementation and review, now binding: - Group encoding agreement applies to new-shape credentials only; a legacy credential declares no encoding, so a group migrates one credential at a time. - Every credential declares at least one target and every group at least one credential; a `verify` command is refused when blank, not only when empty. - `lib.forgejoTokenGroups` is validated at its export seam, so a malformed registry fails every consumer, not only `nix flake check`. - The archetypes predicate's blank-line rule is space and tab only, matching `awk 'NF'`; a source credential carrying both `format` and `value` is refused. - `migrate` declares `encode: "rclone-obscure"` for an rclone container, with the round-trip proven on plain substitution of the stored (already obscured) password; the next `rotate` takes a raw password and obscures it. It evaluates the encoder export and validates the built template before decrypting or writing, refuses registry fields it does not model, validates legacy `user`, `repo_url`, and `deployed_path` against `declare`'s grammars before baking them into a command, and rewrites only the credential object's bytes. - Plain legacy entries (`raw`, `raw-forgejo-token`) are not migrated by `migrate`; they become new-shape by a reviewed registry edit, and `rotate-token` rotates them until then (allod/secrets#25). - Templates are UTF-8 text; every byte is preserved, and non-UTF-8 input is refused rather than altered by the JSON encoder.

vnprc closed this pull request

2026-09-12 02:31:03 +01:00

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

Plan credential value templates across public consumers #54

What changes

Risk

Validation

Implementation Findings

Pull request closed