allod secret: read the rotation registry as rotation-registry.json and lib.rotationRegistry #219

Merged

vnprc merged 3 commits from agent/rotation-registry-rename into master

2026-09-19 22:44:53 +01:00

allod-agent commented

2026-09-19 18:54:27 +01:00

Member

allod secret reads the credential rotation registry by its new names: the flake export lib.rotationRegistry and the file rotation-registry.json. What changes for a running machine: create, rekey, and rotate evaluate the new attribute from the secrets checkout, declare writes the new file, and every message and the allod secret doc name it. What stays identical: the registry's shape and validation, every decision the commands make after the registry is read, and the internal Go identifiers (tokenGroup, nixEvalTokenGroups, secretEvalRegistry), which the issue scopes out and which allod/tools PR 216 is open on. What proves it: gofmt, vet, all four tagged test runs, the flake's go-checks, and a dry run of the built binary against the secrets worktree that carries the rename. If it is wrong the symptom is a message naming lib.rotationRegistry or rotation-registry.json before anything is written, and the fix is a straight revert.

Land this after allod/secrets PR 31 (allod/secrets#31). The file name is a flag day for declare, which opens the file by name, and there is deliberately no fallback to the old attribute or file: a deployment's private fork of allod/secrets must merge the rename before this build of allod runs against its checkout.

Refs allod/secrets#22

Risk

R3. Rotation tooling that writes to the secrets repository reads a cross-repo interface by a new name. Residual: the ordering dependency above; every failure path is loud and precedes any write.

Validation

Run by the integrator on the reviewed commit, inside nix develop:

gofmt -l ./cmd ./internal: empty. go vet ./...: clean.
go test ./..., go test -tags secret ./..., go test -tags site ./..., go test -tags site,secret ./...: every package ok, exit 0 each.
nix build .#checks.x86_64-linux.go-checks --no-link -L: exit 0.
grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' . outside .git: no hits.
Worker dry run of the built binary: allod secret rotate <credential> <secrets worktree> --dry-run against the worktree of allod/secrets PR 31 (allod/secrets#31) got past registry evaluation and group lookup and stopped on a data check in the public template (a group with no service key), so lib.rotationRegistry resolves; that data gap predates this change and is not touched here.

Cold review: gpt-5.6-terra via codex exec, default effort, read-only sandbox, on commit e3846a14. Two findings, both major, both the same point: no compatibility with a checkout that exports only the old name or carries only the old file. Discarded: the landing order recorded on allod/secrets#22 puts the secrets rename first, and a silent fallback to the old name is what memory rules out (fail loud, never fall back silently). No missed consumers, no unsupported claims.

`allod secret` reads the credential rotation registry by its new names: the flake export `lib.rotationRegistry` and the file `rotation-registry.json`. What changes for a running machine: `create`, `rekey`, and `rotate` evaluate the new attribute from the secrets checkout, `declare` writes the new file, and every message and the `allod secret` doc name it. What stays identical: the registry's shape and validation, every decision the commands make after the registry is read, and the internal Go identifiers (`tokenGroup`, `nixEvalTokenGroups`, `secretEvalRegistry`), which the issue scopes out and which allod/tools PR 216 is open on. What proves it: gofmt, vet, all four tagged test runs, the flake's `go-checks`, and a dry run of the built binary against the secrets worktree that carries the rename. If it is wrong the symptom is a message naming `lib.rotationRegistry` or `rotation-registry.json` before anything is written, and the fix is a straight revert. Land this after allod/secrets PR 31 (https://forge.anarch.diy/allod/secrets/pulls/31). The file name is a flag day for `declare`, which opens the file by name, and there is deliberately no fallback to the old attribute or file: a deployment's private fork of allod/secrets must merge the rename before this build of `allod` runs against its checkout. Refs allod/secrets#22 ## Risk R3. Rotation tooling that writes to the secrets repository reads a cross-repo interface by a new name. Residual: the ordering dependency above; every failure path is loud and precedes any write. ## Validation Run by the integrator on the reviewed commit, inside `nix develop`: - `gofmt -l ./cmd ./internal`: empty. `go vet ./...`: clean. - `go test ./...`, `go test -tags secret ./...`, `go test -tags site ./...`, `go test -tags site,secret ./...`: every package `ok`, exit 0 each. - `nix build .#checks.x86_64-linux.go-checks --no-link -L`: exit 0. - `grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' .` outside `.git`: no hits. - Worker dry run of the built binary: `allod secret rotate <credential> <secrets worktree> --dry-run` against the worktree of allod/secrets PR 31 (https://forge.anarch.diy/allod/secrets/pulls/31) got past registry evaluation and group lookup and stopped on a data check in the public template (a group with no `service` key), so `lib.rotationRegistry` resolves; that data gap predates this change and is not touched here. Cold review: `gpt-5.6-terra` via `codex exec`, default effort, read-only sandbox, on commit e3846a14. Two findings, both major, both the same point: no compatibility with a checkout that exports only the old name or carries only the old file. Discarded: the landing order recorded on allod/secrets#22 puts the secrets rename first, and a silent fallback to the old name is what `memory` rules out (fail loud, never fall back silently). No missed consumers, no unsupported claims.

allod-agent added 1 commit

2026-09-19 18:54:28 +01:00

allod secret: rename forgejo-token-groups to rotation-registry e3846a143f

Rename the user-facing file name and the evaluated flake attribute to
match what the registry actually holds: rotation-registry.json and
lib.rotationRegistry, in secret.go, secret_declare.go, secret_rotate.go,
secret_value.go, their tests, and docs/allod-secret.md. Internal Go
identifiers (tokenGroup, nixEvalTokenGroups, secretEvalRegistry) are
unchanged, and the registry's shape and validation are untouched.

Refs allod/secrets#22

allod-agent referenced this pull request from allod/secrets

2026-09-19 18:56:22 +01:00

Rename the rotation registry: forgejo-token-groups.json and lib.forgejoTokenGroups no longer say what they hold #22

allod-agent added 1 commit

2026-09-19 22:17:12 +01:00

Merge remote-tracking branch 'origin/master' into agent/rotation-registry-rename bb4b47c5f8

allod-agent commented

2026-09-19 22:22:53 +01:00

Author

Member

Owner request: rename the internal Go identifiers too, not only the user-facing names. Done in 29c0875 on this branch: the type tokenGroup is now registryGroup and nixEvalTokenGroups is nixEvalRotationRegistry, across secret.go, secret_rotate.go, secret_value.go, and their tests. A pre-existing minimal decoder in secret_declare.go was already called registryGroup and collided under the secret build tag; it is now declareRegistryGroup, matching that file's other declare* types. No behavior changes.

The branch also carries a merge of master (bb4b47c) after allod/tools PR 216 landed; there were no conflicts.

Validation on 29c0875, run by the integrator inside nix develop: gofmt clean, go vet ./... clean, go test ./... with no tag, -tags secret, -tags site, and -tags site,secret all green, and no identifier containing "tokengroup" remains under cmd or internal. The rename is mechanical and witnessed by the compiler and the tests, so no second review pass was run for it.

Owner request: rename the internal Go identifiers too, not only the user-facing names. Done in 29c0875 on this branch: the type `tokenGroup` is now `registryGroup` and `nixEvalTokenGroups` is `nixEvalRotationRegistry`, across secret.go, secret_rotate.go, secret_value.go, and their tests. A pre-existing minimal decoder in secret_declare.go was already called `registryGroup` and collided under the `secret` build tag; it is now `declareRegistryGroup`, matching that file's other `declare*` types. No behavior changes. The branch also carries a merge of master (bb4b47c) after allod/tools PR 216 landed; there were no conflicts. Validation on 29c0875, run by the integrator inside `nix develop`: gofmt clean, `go vet ./...` clean, `go test ./...` with no tag, `-tags secret`, `-tags site`, and `-tags site,secret` all green, and no identifier containing "tokengroup" remains under cmd or internal. The rename is mechanical and witnessed by the compiler and the tests, so no second review pass was run for it.

allod-agent added 1 commit

2026-09-19 22:22:54 +01:00

allod secret: name the registry types after the rotation registry 29c0875a8c