flake: carry the credential-store-url parity check #224

Merged

vnprc merged 1 commit from agent/credential-store-url-parity-check into master

2026-09-23 03:00:10 +01:00

allod-agent commented

2026-09-22 20:37:41 +01:00

Member

Summary

Nothing changes for any running machine: this repo's flake is development-only, and every consumer imports allod/tools with flake = false, so no built package, VM, or host reads it.

What changes is where one check lives. The byte-for-byte comparison between cmd/allod/testdata/credential-store-url.json (the vector table the Go tests read) and allod/secrets' credential-store-url.json now runs here, as checks.x86_64-linux.credential-store-url-parity, against a new allod-secrets flake input pinned to allod/secrets. allod/archetypes drops its copy of the check in a follow-up PR.

The table's contents, the Go code, and every existing check stay identical; two Go comments now point at this check instead of the archetypes one.

What proves it: the check builds green against the current pin, and a one-byte sabotage of the testdata copy makes it fail with the mismatch message.

If it is wrong: revert this PR. The archetypes check is not deleted until this has merged, so the parity is never unwitnessed.

Refs allod/archetypes#110

Risk

R2. A dev-only flake gains one flake = false input and one runCommand check. Worst credible failure after validation: the pin to allod/secrets goes stale and the check compares against an old table, which is the same exposure the archetypes check already had through its own lock. Rollback is a straight revert.

Validation

Run by the overseer in the PR worktree, after the worker's own runs:

nix build .#checks.x86_64-linux.credential-store-url-parity --no-link -L --rebuild
credential-store-url-parity-check> allod/tools and allod/secrets agree on credential-store-url.json

Sabotage (worker, output read by the overseer): printf '\n' >> cmd/allod/testdata/credential-store-url.json, staged, rebuilt:

cmp: EOF on '/nix/store/...-source/credential-store-url.json' after byte 5540, line 243
ERROR: the credential-store URL vector table differs between repositories
...
error: Cannot build '...-credential-store-url-parity-check.drv'. Reason: builder failed with exit code 1.

Restored and rebuilt green. Full nix flake check -L (worker): all checks passed!, including allod-parity-tests 704/704 and go-checks across all four build-tag combinations.

nix flake metadata --json | jq '.locks.nodes.root.inputs' shows allod-secrets and nixpkgs; the lock diff adds exactly the one node and moves nothing else.

Cross-family review: one cold pass by codex (gpt-5.6-sol, high effort) on the diff. No findings; it verified the fail-closed cmp shape, the path-literal testdata reference, the single-node lock diff (and that the checked-in JSON is byte-identical to the file at the locked revision), the comment-only Go changes, and the absence of a colliding check name.

## Summary Nothing changes for any running machine: this repo's flake is development-only, and every consumer imports allod/tools with `flake = false`, so no built package, VM, or host reads it. What changes is where one check lives. The byte-for-byte comparison between `cmd/allod/testdata/credential-store-url.json` (the vector table the Go tests read) and allod/secrets' `credential-store-url.json` now runs here, as `checks.x86_64-linux.credential-store-url-parity`, against a new `allod-secrets` flake input pinned to allod/secrets. allod/archetypes drops its copy of the check in a follow-up PR. The table's contents, the Go code, and every existing check stay identical; two Go comments now point at this check instead of the archetypes one. What proves it: the check builds green against the current pin, and a one-byte sabotage of the testdata copy makes it fail with the mismatch message. If it is wrong: revert this PR. The archetypes check is not deleted until this has merged, so the parity is never unwitnessed. Refs allod/archetypes#110 ## Risk R2. A dev-only flake gains one `flake = false` input and one `runCommand` check. Worst credible failure after validation: the pin to allod/secrets goes stale and the check compares against an old table, which is the same exposure the archetypes check already had through its own lock. Rollback is a straight revert. ## Validation Run by the overseer in the PR worktree, after the worker's own runs: nix build .#checks.x86_64-linux.credential-store-url-parity --no-link -L --rebuild credential-store-url-parity-check> allod/tools and allod/secrets agree on credential-store-url.json Sabotage (worker, output read by the overseer): `printf '\n' >> cmd/allod/testdata/credential-store-url.json`, staged, rebuilt: cmp: EOF on '/nix/store/...-source/credential-store-url.json' after byte 5540, line 243 ERROR: the credential-store URL vector table differs between repositories ... error: Cannot build '...-credential-store-url-parity-check.drv'. Reason: builder failed with exit code 1. Restored and rebuilt green. Full `nix flake check -L` (worker): `all checks passed!`, including `allod-parity-tests` 704/704 and `go-checks` across all four build-tag combinations. `nix flake metadata --json | jq '.locks.nodes.root.inputs'` shows `allod-secrets` and `nixpkgs`; the lock diff adds exactly the one node and moves nothing else. Cross-family review: one cold pass by codex (gpt-5.6-sol, high effort) on the diff. No findings; it verified the fail-closed cmp shape, the path-literal testdata reference, the single-node lock diff (and that the checked-in JSON is byte-identical to the file at the locked revision), the comment-only Go changes, and the absence of a colliding check name.

allod-agent added 1 commit

2026-09-22 20:37:42 +01:00

flake: carry the credential-store-url parity check 5ed16b7b35

allod/archetypes could not hold this check on a fork whose secrets
input is its own data repo. Move the assertion to the repo that
carries the copy: add allod-secrets (flake = false, development-only,
so nothing downstream pays for it) and a credentialStoreUrlParity
check next to allodParity, cmp-ing the checked-in testdata copy
against allod-secrets' definition byte-for-byte.

Reword the two Go comments that pointed at the old archetypes check
to name this repo's own flake check instead. No behaviour change.

Refs allod/archetypes#110

allod-agent referenced this pull request from allod/memory

2026-09-22 20:37:55 +01:00

nix.md: point the parity example at allod/tools' check #64

allod-agent referenced this pull request from allod/archetypes

2026-09-22 20:40:26 +01:00

Drop credential-store-url-parity: allod/tools carries its own copy now #111