Split automated remediation controller into an internal package #178

New issue

Closed

opened 2026-08-16 23:56:05 +01:00 by nimmo · 1 comment

nimmo commented

2026-08-16 23:56:05 +01:00

Owner

Context

scripts/nixos-update-remediation.py is a 3,000+ line security-sensitive controller. Its responsibilities are coherent but concentrated in one file.

Scope

Preserve the public executable path and command-line interface.
Move policy/incident, model sandbox, deterministic validation, publication, and orchestration responsibilities behind a first-class internal Python package boundary.
Preserve fail-closed behavior and existing integration-test seams.

Completion criteria

The executable is a thin compatibility entry point.
Responsibility-based modules are independently understandable.
Remediation regression and integration tests pass unchanged or with boundary-only updates.

## Context `scripts/nixos-update-remediation.py` is a 3,000+ line security-sensitive controller. Its responsibilities are coherent but concentrated in one file. ## Scope - Preserve the public executable path and command-line interface. - Move policy/incident, model sandbox, deterministic validation, publication, and orchestration responsibilities behind a first-class internal Python package boundary. - Preserve fail-closed behavior and existing integration-test seams. ## Completion criteria - The executable is a thin compatibility entry point. - Responsibility-based modules are independently understandable. - Remediation regression and integration tests pass unchanged or with boundary-only updates.

nimmo added this to the Fleet Configuration Boundary Cleanup milestone

2026-08-16 23:56:05 +01:00

nimmo added the

service:auto-update

project:fleet-boundary-cleanup

host:fleet

labels

2026-08-16 23:56:05 +01:00

nimmo referenced this issue

2026-08-17 00:05:45 +01:00

refactor: clarify fleet configuration boundaries #181

nimmo commented

2026-08-17 07:17:35 +01:00

Author

Owner

Implemented by #181 (4a50fd8): the stable controller entry point now delegates to the responsibility-based scripts/nixos_update_remediation package. The full remediation regression and integration suite passed on 2026-08-17.

Implemented by #181 (4a50fd8): the stable controller entry point now delegates to the responsibility-based `scripts/nixos_update_remediation` package. The full remediation regression and integration suite passed on 2026-08-17.

nimmo closed this issue

2026-08-17 07:17:37 +01:00