secret declare: write two files, no secrets.nix line #279

Merged

vnprc merged 1 commit from agent/declare-two-files into master

2026-10-19 05:13:41 +01:00

allod-agent commented

2026-10-19 05:02:31 +01:00

Member

allod secret declare now writes two files, the credentials.nix entry and the rotation-registry.json group, and leaves secrets.nix alone, because that file derives a declared credential's recipients from the registry group since allod/secrets#47 and the deployment fork adopted the same derivation. On a host built from this, declaring a secret on the template works again (it has had no hand-written recipient line to insert after since its entries became derived), and declaring one on a fork no longer writes the template's [ hostKey ] into a file that names its keys differently. create, rekey and rotate are unchanged. What proves it: every declare test now asserts secrets.nix is byte-identical after the run, the registry collision check still refuses a group that already uses the new secret path, and the concurrent-edit test still proves credentials.nix is restored when the second write is refused. If it is wrong, revert the one commit; a fork that had not derived would see create refuse by name, never a ciphertext to wrong recipients.

This is the third step of allod/secrets#46. The companion edit to the public memory's age.md is its own PR on allod/memory.

What changed

secretDeclare reads, validates, writes and prints two files. declareCollisions loses its secrets.nix argument and finding; the registry half still refuses a group keyed by the name, naming the name, or using the secret path. declareSecretsRecipients, declareSecretsLinePattern and declareInsertSecretsLine are deleted.
Help text: two insertions, both files, two paths printed, and the refusal list without the secrets.nix source.
docs/allod-secret.md: the same four sentences, plus rekey's trigger described as a registry or key change rather than a secrets.nix line.
Tests: the fixture secrets.nix takes the derived shape a secrets repo has now; the three secrets.nix collision tests go with the check they covered; every successful run asserts the file unchanged; the concurrent-edit test edits the registry instead and still proves the restore of credentials.nix.

Order

The host binary carries this at the next deploy lock bump of allod-tools. The owner reports the fork step of allod/secrets#46 done and merged, which is the criterion that step set. This VM cannot read the fork to confirm it.

Risk

R2. Generated text an agent reviews in a PR, with the tool's own write guards unchanged; the derived recipients are gated by the secrets repository's own checks, not by this command.

Validation

gofmt -l cmd/allod clean; go vet ./... and go vet -tags site,secret ./... clean.
go test ./..., go test -tags secret ./cmd/allod/ and go test -tags site,secret ./... pass, from nix develop.
Cold cross-family review, one seat as R2 buys, on gpt-5.6-sol through pi's nullsink provider (codex holds no credentials on this VM). Seven findings. One real and fixed: a docs paragraph I had not touched still said three edits are built and three paths printed. One real and already stated under "Not run": the fixture secrets.nix is never evaluated by the Go tests, so they cannot witness the derivation; that witness is the secrets repository's check. Five comment findings, all on comments the diff re-wrapped rather than added, each already one to three lines of contract or pointer; left as they are.
Not run: declare followed by create against a real secrets checkout with nix. The Go tests fake the recipient evaluation, so the derivation itself is witnessed by checks/registry-recipients.nix in allod/secrets, not here.

Closes allod/tools#278

`allod secret declare` now writes two files, the `credentials.nix` entry and the `rotation-registry.json` group, and leaves `secrets.nix` alone, because that file derives a declared credential's recipients from the registry group since allod/secrets#47 and the deployment fork adopted the same derivation. On a host built from this, declaring a secret on the template works again (it has had no hand-written recipient line to insert after since its entries became derived), and declaring one on a fork no longer writes the template's `[ hostKey ]` into a file that names its keys differently. `create`, `rekey` and `rotate` are unchanged. What proves it: every declare test now asserts `secrets.nix` is byte-identical after the run, the registry collision check still refuses a group that already uses the new secret path, and the concurrent-edit test still proves `credentials.nix` is restored when the second write is refused. If it is wrong, revert the one commit; a fork that had not derived would see `create` refuse by name, never a ciphertext to wrong recipients. This is the third step of allod/secrets#46. The companion edit to the public memory's `age.md` is its own PR on `allod/memory`. ## What changed - `secretDeclare` reads, validates, writes and prints two files. `declareCollisions` loses its `secrets.nix` argument and finding; the registry half still refuses a group keyed by the name, naming the name, or using the secret path. `declareSecretsRecipients`, `declareSecretsLinePattern` and `declareInsertSecretsLine` are deleted. - Help text: two insertions, both files, two paths printed, and the refusal list without the `secrets.nix` source. - `docs/allod-secret.md`: the same four sentences, plus `rekey`'s trigger described as a registry or key change rather than a `secrets.nix` line. - Tests: the fixture `secrets.nix` takes the derived shape a secrets repo has now; the three `secrets.nix` collision tests go with the check they covered; every successful run asserts the file unchanged; the concurrent-edit test edits the registry instead and still proves the restore of `credentials.nix`. ## Order The host binary carries this at the next deploy lock bump of `allod-tools`. The owner reports the fork step of allod/secrets#46 done and merged, which is the criterion that step set. This VM cannot read the fork to confirm it. ## Risk R2. Generated text an agent reviews in a PR, with the tool's own write guards unchanged; the derived recipients are gated by the secrets repository's own checks, not by this command. ## Validation - `gofmt -l cmd/allod` clean; `go vet ./...` and `go vet -tags site,secret ./...` clean. - `go test ./...`, `go test -tags secret ./cmd/allod/` and `go test -tags site,secret ./...` pass, from `nix develop`. - Cold cross-family review, one seat as R2 buys, on `gpt-5.6-sol` through pi's `nullsink` provider (codex holds no credentials on this VM). Seven findings. One real and fixed: a docs paragraph I had not touched still said three edits are built and three paths printed. One real and already stated under "Not run": the fixture `secrets.nix` is never evaluated by the Go tests, so they cannot witness the derivation; that witness is the secrets repository's check. Five comment findings, all on comments the diff re-wrapped rather than added, each already one to three lines of contract or pointer; left as they are. - Not run: `declare` followed by `create` against a real secrets checkout with `nix`. The Go tests fake the recipient evaluation, so the derivation itself is witnessed by `checks/registry-recipients.nix` in allod/secrets, not here. Closes allod/tools#278

allod-agent added 1 commit

2026-10-19 05:02:31 +01:00

secret declare: write two files, no secrets.nix line 50d6511819

secrets.nix derives a declared credential's recipients from its rotation registry group (allod/secrets#47), so declare no longer inserts a recipient line, checks that file for a collision, or brace-checks it. It writes the credentials.nix entry and the registry group, prints two paths, and the help, docs and tests say so.

Refs allod/tools#278