Add hook guard for machine platform literals outside inventory #107

New issue

Open

opened 2026-07-18 15:51:01 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-07-18 15:51:01 +01:00

Contributor

Problem

Machine platform strings should come from inventory, but it is easy to reintroduce literals such as x86_64-linux and aarch64-linux in non-inventory flakes or modules when adding checks or defaults.

Related cleanup evidence:

allod/profiles issue #2: checkSystems = [ "x86_64-linux" "aarch64-linux" ] duplicates check platform keys outside inventory.
allod/vm issue #1: nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux" duplicates a machine platform inside the VM framework module.

Proposed Direction

Add a shared pre-commit guard in the allod/tools git hook stack.

The guard should inspect staged added lines and reject newly introduced Nix system literals in non-inventory repos unless the line is explicitly allowed as a host-tool exposure surface.

allod/tools is the right owner because it already owns:

git-hooks/protected-refs-policy
tracked hook dispatch via .hookspath
hook setup support through git-hooks/setup-tracked-hooks

Policy Sketch

Read staged additions with git diff --cached -U0.
Resolve the repository identity from git remote get-url origin.
Allow machine platform literals in allod/inventory.
Reject additions in other repos that introduce machine platform literals such as x86_64-linux or aarch64-linux.
Provide an explicit narrow allow mechanism for host-tool/package/check exposure lists where the string is a flake output host key, not a machine fact.

Acceptance

A staged addition of checkSystems = [ "x86_64-linux" "aarch64-linux" ]; in allod/profiles is rejected.
A staged addition of nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; in allod/vm is rejected.
A staged edit to inventory machine facts in allod/inventory is allowed.
Existing host-tool exposure surfaces either pass through a documented allowlist/annotation or fail with a message that explains how to declare the exception.
Tests cover the reject, allow, and exception paths.

## Problem Machine platform strings should come from inventory, but it is easy to reintroduce literals such as `x86_64-linux` and `aarch64-linux` in non-inventory flakes or modules when adding checks or defaults. Related cleanup evidence: - allod/profiles issue #2: `checkSystems = [ "x86_64-linux" "aarch64-linux" ]` duplicates check platform keys outside inventory. - allod/vm issue #1: `nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"` duplicates a machine platform inside the VM framework module. ## Proposed Direction Add a shared `pre-commit` guard in the `allod/tools` git hook stack. The guard should inspect staged added lines and reject newly introduced Nix system literals in non-inventory repos unless the line is explicitly allowed as a host-tool exposure surface. `allod/tools` is the right owner because it already owns: - `git-hooks/protected-refs-policy` - tracked hook dispatch via `.hookspath` - hook setup support through `git-hooks/setup-tracked-hooks` ## Policy Sketch - Read staged additions with `git diff --cached -U0`. - Resolve the repository identity from `git remote get-url origin`. - Allow machine platform literals in `allod/inventory`. - Reject additions in other repos that introduce machine platform literals such as `x86_64-linux` or `aarch64-linux`. - Provide an explicit narrow allow mechanism for host-tool/package/check exposure lists where the string is a flake output host key, not a machine fact. ## Acceptance - A staged addition of `checkSystems = [ "x86_64-linux" "aarch64-linux" ];` in `allod/profiles` is rejected. - A staged addition of `nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";` in `allod/vm` is rejected. - A staged edit to inventory machine facts in `allod/inventory` is allowed. - Existing host-tool exposure surfaces either pass through a documented allowlist/annotation or fail with a message that explains how to declare the exception. - Tests cover the reject, allow, and exception paths.