allod secret: remove the legacy credential shape and the migrate command #213

Merged

vnprc merged 3 commits from agent/secret-legacy-removal into master

2026-09-13 02:51:31 +01:00

allod-agent commented

2026-09-13 00:58:32 +01:00

Member

Summary

allod secret migrate is gone, and create and rotate no longer carry a legacy path: the format field, the structured verify object, the per-format refusal messages, and the coexistence section of the documentation are removed, so the value-template shape is the only one these commands know. What stays identical for a running machine: declare, create, rekey, and rotate behave exactly as before on a registry with no format entry, which is what every registry now holds, and no ciphertext, deployed file, or host command changes. One refusal remains, at registry decode time: an entry that still carries format is refused by name, because the JSON decoder would otherwise ignore the field and treat the entry as new-shape. Proved by all four tag combinations of go vet and go test, including a new unit test for that refusal. If it is wrong, revert the two commits; migrate and the legacy refusals return unchanged.

Closes allod/secrets#27. The other two slices are allod/secrets#28 (the public check) and allod/archetypes#77 (the local-auth predicate); the private validator is under its own handoff issue.

Change

cmd/allod/secret_migrate.go and its test file deleted; migrate unregistered; README, flake.nix, and docs/allod-secret.md list three tagged commands.
isLegacyCredential, legacyCredentialContainers, legacyRefusalReason, the mixed-shape check, and registryTarget.User removed; isCredentialStoreURLSource accepts only a template.
A non-string verify is refused as "not one command string"; the three rotate sites that named migrate now say to write the target's command into the registry by hand.
registryCredential.Format stays decode-only, read by firstCredentialCarryingFormat in nixEvalTokenGroups for the one refusal above, pinned by TestFirstCredentialCarryingFormat.
The declare test fixtures drop their last format and structured verify fields. declare itself gets no refusal: it reads the registry only for name collisions, and the secrets flake check is what refuses a bad registry shape.
The two helpers migrate's tests owned that surviving rotate tests need moved into secret_rotate_test.go.

Note for merging: this branch and #212 both edit the "Where things are found" paragraph of docs/allod-secret.md; whichever lands second needs a merge from master before it can be rebase-merged.

Risk

R2. Code removal plus one new decode-time refusal, with the main paths covered by caller-level tests in every tag combination; rollback is a straight revert. No secret material, host command, or deployed state is touched.

Validation

In the worktree under nix develop: gofmt -l ./cmd printed nothing; go vet and go test passed for ./..., -tags secret, -tags site, and -tags site,secret (every package ok); grep -rni 'legacy\|migrate' over cmd/allod, docs, README.md, and flake.nix finds only nixpkgs.legacyPackages and an unrelated site-config comment. Cold cross-family review by gpt-5.6-terra (codex, read-only sandbox) on the first commit found two stale "four commands" comments, fixed in the second commit, and flagged the declare fixtures still carrying format, cleaned in the same commit.

## Summary `allod secret migrate` is gone, and `create` and `rotate` no longer carry a legacy path: the `format` field, the structured `verify` object, the per-format refusal messages, and the coexistence section of the documentation are removed, so the value-template shape is the only one these commands know. What stays identical for a running machine: `declare`, `create`, `rekey`, and `rotate` behave exactly as before on a registry with no `format` entry, which is what every registry now holds, and no ciphertext, deployed file, or host command changes. One refusal remains, at registry decode time: an entry that still carries `format` is refused by name, because the JSON decoder would otherwise ignore the field and treat the entry as new-shape. Proved by all four tag combinations of `go vet` and `go test`, including a new unit test for that refusal. If it is wrong, revert the two commits; `migrate` and the legacy refusals return unchanged. Closes allod/secrets#27. The other two slices are https://forge.anarch.diy/allod/secrets/pulls/28 (the public check) and https://forge.anarch.diy/allod/archetypes/pulls/77 (the local-auth predicate); the private validator is under its own handoff issue. ## Change - `cmd/allod/secret_migrate.go` and its test file deleted; `migrate` unregistered; README, `flake.nix`, and `docs/allod-secret.md` list three tagged commands. - `isLegacyCredential`, `legacyCredentialContainers`, `legacyRefusalReason`, the mixed-shape check, and `registryTarget.User` removed; `isCredentialStoreURLSource` accepts only a template. - A non-string `verify` is refused as "not one command string"; the three `rotate` sites that named `migrate` now say to write the target's command into the registry by hand. - `registryCredential.Format` stays decode-only, read by `firstCredentialCarryingFormat` in `nixEvalTokenGroups` for the one refusal above, pinned by `TestFirstCredentialCarryingFormat`. - The `declare` test fixtures drop their last `format` and structured `verify` fields. `declare` itself gets no refusal: it reads the registry only for name collisions, and the secrets flake check is what refuses a bad registry shape. - The two helpers `migrate`'s tests owned that surviving `rotate` tests need moved into `secret_rotate_test.go`. Note for merging: this branch and https://forge.anarch.diy/allod/tools/pulls/212 both edit the "Where things are found" paragraph of `docs/allod-secret.md`; whichever lands second needs a merge from master before it can be rebase-merged. ## Risk R2. Code removal plus one new decode-time refusal, with the main paths covered by caller-level tests in every tag combination; rollback is a straight revert. No secret material, host command, or deployed state is touched. ## Validation In the worktree under `nix develop`: `gofmt -l ./cmd` printed nothing; `go vet` and `go test` passed for `./...`, `-tags secret`, `-tags site`, and `-tags site,secret` (every package `ok`); `grep -rni 'legacy\|migrate'` over `cmd/allod`, `docs`, `README.md`, and `flake.nix` finds only `nixpkgs.legacyPackages` and an unrelated site-config comment. Cold cross-family review by gpt-5.6-terra (codex, read-only sandbox) on the first commit found two stale "four commands" comments, fixed in the second commit, and flagged the `declare` fixtures still carrying `format`, cleaned in the same commit.

allod-agent added 2 commits

2026-09-13 00:58:33 +01:00

allod secret: remove the legacy credential shape and the migrate command fed051469f

Refs allod/secrets#27

allod secret: pin the format refusal and drop the last legacy fixture fields e2737f5202

Refs allod/secrets#27

allod-agent added 1 commit

2026-09-13 02:49:41 +01:00

Merge master into agent/secret-legacy-removal 071dcc3525

Resolves the docs paragraph both allod/tools PR 212 and this branch edited.

Refs allod/secrets#27

allod-agent commented

2026-09-13 02:49:41 +01:00

Author

Member

Rebased onto master after #212 landed: the one conflict was the "Where things are found" paragraph of docs/allod-secret.md, resolved to keep the new deploy-checkout sentence while counting four commands and dropping migrate. The forge refuses force-pushes on agent branches, so this landed as merge commit 071dcc3 whose tree is byte-identical to the rebased commits (git diff between them is empty). All four tag combinations of go vet and go test pass on the merged tree.

Rebased onto master after https://forge.anarch.diy/allod/tools/pulls/212 landed: the one conflict was the "Where things are found" paragraph of `docs/allod-secret.md`, resolved to keep the new deploy-checkout sentence while counting four commands and dropping `migrate`. The forge refuses force-pushes on agent branches, so this landed as merge commit 071dcc3 whose tree is byte-identical to the rebased commits (`git diff` between them is empty). All four tag combinations of `go vet` and `go test` pass on the merged tree.