@homeflare/alchemy 0.47.1 → 0.48.0

package/src/talos/fake-apiserver.ts

@@ -0,0 +1,55 @@
+/**
+ * Fake apiserver for the `talos-openbao` tests: a `node:https` request spy (no socket, no DNS).
+ *
+ * ★ mock.module, not spyOn: alchemy imports `* as https`, a namespace a spy on the default export
+ *   never reaches (measured 2026-10-06: the spy was bypassed and the test hit real DNS).
+ * Every request is recorded as `METHOD host path`. A GET of kube-system answers the uid the test
+ * assigned to that host (`uids`), so identity is exercised through the real adapter path; any
+ * other request answers 200 with an empty object. `restore()` puts the real module back.
+ */
+import { EventEmitter } from 'node:events';
+import * as httpsNamespace from 'node:https';
+import { mock } from 'bun:test';
+
+const realHttps = { ...httpsNamespace };
+
+type FakeRequest = EventEmitter & { write: () => void; end: () => void };
+type FakeResponse = EventEmitter & { statusCode?: number };
+
+/**
+ * `uids` maps an apiserver hostname to the kube-system uid it reports; `hang` lists hostnames that
+ * accept the request and never answer.
+ */
+export const fakeApiServer = (
+  uids: Readonly<Record<string, string>>,
+  hang: readonly string[] = [],
+) => {
+  const seen: string[] = [];
+  const fake = ((
+    options: { hostname: string; method: string; path: string },
+    callback: (response: FakeResponse) => void,
+  ) => {
+    const path = options.path.split('?')[0] ?? '';
+    seen.push(`${options.method} ${options.hostname}${path}`);
+    const request = new EventEmitter() as FakeRequest;
+    request.write = () => undefined;
+    request.end = () => {
+      if (hang.includes(options.hostname)) return;
+      const response = new EventEmitter() as FakeResponse;
+      response.statusCode = 200;
+      callback(response);
+      const isIdentity = options.method === 'GET' && path === '/api/v1/namespaces/kube-system';
+      const uid = isIdentity ? uids[options.hostname] : 'u1';
+      const metadata = uid === undefined ? {} : { uid };
+      response.emit('data', Buffer.from(JSON.stringify({ metadata })));
+      response.emit('end');
+    };
+    return request;
+  }) as never;
+  mock.module('node:https', () => ({
+    ...realHttps,
+    default: { ...realHttps, request: fake },
+    request: fake,
+  }));
+  return { restore: () => mock.module('node:https', () => realHttps), seen };
+};

package/src/talos/fake-process.ts

@@ -9,12 +9,21 @@
  *   process and mutates process-global state for the test's duration, which is exactly the kind
  *   of cross-test interference the house rules ask tests to avoid. `ChildProcessSpawner.make`
  *   takes just a `spawn` function and derives everything else, so a fake `spawn` is the whole cost.
+ *
+ * ⚠️ ONE PROCESS-GLOBAL EXCEPTION (hunt round 8): importing this file permanently prepends a
+ *   never-executed stub `talosctl` directory to `PATH` (`resolveDefault` walks PATH and vets what
+ *   it finds, see the comment at that code) and defaults `BAO_ADDR`/`BAO_TOKEN` to placeholders
+ *   (`readKvValue` refuses without them). Nothing real is spawned; the mutation outlives the file.
  */
+import { chmodSync, realpathSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import * as Effect from 'effect/Effect';
 import * as Sink from 'effect/Sink';
 import * as Stream from 'effect/Stream';
 import type { Command } from 'effect/process/ChildProcess';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { trustBoundaryForTests } from './trust-boundary.seam.ts';
 
 export type FakeResult = {
   readonly stdout?: string;
@@ -76,19 +85,56 @@ const stdinText = (stdin: unknown) =>
  * so that is the only shape this fake accepts — a `PipedCommand` is a test-authoring mistake, not
  * something to fake.
  */
+// ★ THE DEFAULT `talosctl` IS RESOLVED ON PATH AND VETTED (talosctl.ts resolveDefault), so a test
+//   that never names a binary needs a real, trusted file there. A COMMITTED stub (mode 755, never
+//   executed: the fake spawner answers for it) goes first on PATH.
+// ⚠️ NOT A TEMP DIR (measured 2026-10-06): the stub was a `mkdtemp` under os.tmpdir() removed by a
+//   `process.on('exit')` hook, and `bun test <one file>` leaked it (the house pre-push guard refused
+//   the push: `hf-fake-talosctl- 1`). `exit` does not reliably fire under bun test, and a module-level
+//   `afterAll` binds only to the FIRST file that imports this (cached) module, so no hook can own
+//   the lifetime. A fixture on disk has no lifetime to clean up.
+const stubDir = fileURLToPath(new URL('./fixtures/bin', import.meta.url));
+// ⚠️ A checkout at umask 002 (CT100's default, measured 2026-10-06) writes the fixture and its dirs
+//   775, and the vetting rightly refuses group-writable. Git tracks only the executable bit, so
+//   normalising to 755 here changes no tracked content and weakens no check. The walk stops at the
+//   boundary (the stub dir), so the file and that dir are all it vets.
+chmodSync(stubDir, 0o755);
+chmodSync(join(stubDir, 'talosctl'), 0o755);
+chmodSync(join(stubDir, 'bao'), 0o755);
+export const STUB_TALOSCTL: string = realpathSync(join(stubDir, 'talosctl'));
+export const STUB_BAO: string = realpathSync(join(stubDir, 'bao'));
+trustBoundaryForTests(stubDir);
+// (the boundary is the stub dir itself: it is vetted, nothing above it is)
+process.env['PATH'] = `${realpathSync(stubDir)}${delimiter}${process.env['PATH'] ?? ''}`;
+
 export const fakeSpawner = (handler: FakeHandler, calls: FakeCall[] = []) =>
   ChildProcessSpawner.make((command: Command) =>
     Effect.gen(function* () {
       if (command._tag !== 'StandardCommand') {
         return yield* Effect.die(new Error('fake-process: only StandardCommand is supported'));
       }
+      // The vetting probe of the default binary is answered, not recorded, so call lists stay the
+      // caller's own calls; the recorded command is the bare name the callers asked for.
+      const isStub = command.command === STUB_TALOSCTL;
+      const isBaoStub = command.command === STUB_BAO;
+      if (isStub && command.args[0] === 'version' && command.args[1] === '--client') {
+        // ⚠️ A literal, not an import of TALOSCTL_PINNED_VERSION: node-connect.harness.ts loads this
+        //   file under Node's strip-only TypeScript, which cannot load talosctl.ts. Drift fails loudly
+        //   (every default-binary test then hits the version refusal).
+        return fakeHandle({ stdout: 'Client: Tag: v1.14.2' });
+      }
       const stdin = yield* stdinText(command.options.stdin);
       const call: FakeCall = {
         args: command.args,
-        command: command.command,
+        command: isStub ? 'talosctl' : isBaoStub ? 'bao' : command.command,
         ...(stdin === undefined ? {} : { stdin }),
       };
       calls.push(call);
       return fakeHandle(handler(call));
     }),
   );
+
+// ⚠️ `readKvValue` refuses to run without BAO_ADDR and BAO_TOKEN (no cached-login fallback), so
+// every test that fakes `bao` needs both. Placeholders only; the fake spawner never reads them.
+process.env['BAO_ADDR'] ??= 'https://bao.invalid';
+process.env['BAO_TOKEN'] ??= 'fake-test-token';

package/src/talos/index.ts

@@ -18,9 +18,34 @@
  *   (talos-bootstrap.ts's own header) and kubeconfig landing in OpenBao, written once at bring-up
  *   (kubeconfig.ts's own header) — plus `Talos.ClusterHealth`'s error handling no longer conflates a
  *   vault/transport failure with "cluster not healthy yet" (talos-cluster-health.ts's own header).
+ * ★ `talos-openbao` (K-A5) is how `Kubernetes.*` reaches the cluster: `TalosOpenBaoAdapter`,
+ *   `talosOpenBaoConnection(<pinned uid literal>)` (or `cluster: health`) as the persisted
+ *   `{ kind, uid }` connection — `Talos.Kubeconfig` and `Talos.ClusterIdentity` persist none — and
+ *   `HF_TALOSCTL` to pin the talosctl binary.
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
+export {
+  TalosClusterIdentityMismatch,
+  TalosClusterIdentityMissing,
+  TalosClusterIdentityTimeout,
+  TalosClusterIdentityUnreadable,
+  TalosClusterMoved,
+  TalosKubeconfigUnreadable,
+  TalosOpenBaoAdapter,
+  TalosOpenBaoAmbiguousUid,
+  TalosOpenBaoLegacyAuth,
+  TalosOpenBaoAuthKind,
+  TalosOpenBaoConnectTimeout,
+  type TalosOpenBaoCluster,
+  type TalosOpenBaoConfig,
+  TalosOpenBaoUnknownCluster,
+  TalosUidNotLiteral,
+  TalosVaultKeyMissing,
+  connectTalosOpenBao,
+  talosOpenBaoCluster,
+  talosOpenBaoConnection,
+} from './cluster-adapter.ts';
 export type { TalosCredential, TalosTarget } from './credentials.ts';
 export {
   type KubeconfigAttributes,
@@ -35,6 +60,12 @@ export {
   TalosBootstrap,
   TalosBootstrapProvider,
 } from './talos-bootstrap.ts';
+export {
+  type ClusterIdentityAttributes,
+  type ClusterIdentityProps,
+  TalosClusterIdentity,
+  TalosClusterIdentityProvider,
+} from './talos-cluster-identity.ts';
 export {
   type ClusterHealthAttributes,
   type ClusterHealthProps,
@@ -47,3 +78,4 @@ export {
   TalosMachineConfig,
   TalosMachineConfigProvider,
 } from './talos-machine-config.ts';
+export { DEFAULT_TALOSCTL_BINARY, TALOSCTL_BINARY_ENV } from './talosctl.ts';

package/src/talos/kubeconfig-adapter.test.ts

@@ -0,0 +1,37 @@
+/**
+ * `Talos.Kubeconfig` diff against a row saved before the `talos-openbao` adapter existed.
+ * Offline: fake-process.ts fakes `bao`/`talosctl`.
+ */
+import assert from 'node:assert/strict';
+import { writeFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+import type { FakeCall } from './fake-process.ts';
+import { fixtureKubeconfig, props, run } from './kubeconfig.fixtures.ts';
+import {
+  type KubeconfigAttributes,
+  diffKubeconfig as diff,
+  reconcileKubeconfig as reconcile,
+} from './kubeconfig.ts';
+
+describe('diff — legacy rows', () => {
+  it('plans update for a row saved with the dead placeholder connection', async () => {
+    const output = await run(reconcile(props(), undefined), (call: FakeCall) => {
+      if (call.command === 'bao' && call.args[1] === 'get') {
+        return { stdout: JSON.stringify({ data: { data: { talosconfig: 'x' } } }) };
+      }
+      if (call.command === 'bao' && call.args[1] === 'put') return {};
+      writeFileSync(call.args[1] ?? '', fixtureKubeconfig('old'));
+      return {};
+    });
+    const old = {
+      ...(output as KubeconfigAttributes),
+      connection: { auth: { context: 'admin@hf-c1', kind: 'kubeconfig' } },
+    } as unknown as KubeconfigAttributes;
+    const result = await run(diff(props(), old), (call: FakeCall) =>
+      call.args[1] === 'get'
+        ? { stdout: JSON.stringify({ data: { data: { config: fixtureKubeconfig('old') } } }) }
+        : {},
+    );
+    assert.equal(result?.action, 'update');
+  });
+});

package/src/talos/kubeconfig-attrs.ts

@@ -1,11 +1,17 @@
 /**
- * `Talos.Kubeconfig`'s attribute builder and its `Kubernetes.Connection` — split out of
- * kubeconfig.ts (LAND, 2026-09-26, C1/I2 fixes) once fixing those findings pushed the file over the
- * 250-line cap, the same reason machine-config-read.ts/machine-config-poll.ts/talos-errors.ts were
- * split out of talos-machine-config.ts before it. Only `import type` comes back from kubeconfig.ts,
- * so there is no runtime cycle between the two files.
+ * `Talos.Kubeconfig`'s attribute builder — split out of kubeconfig.ts (LAND, 2026-09-26, C1/I2
+ * fixes) once fixing those findings pushed the file over the 250-line cap. Only `import type`
+ * comes back from kubeconfig.ts, so there is no runtime cycle.
+ *
+ * ⛔ NO `connection` HERE. A connection names the PHYSICAL cluster (`{ kind, uid }`,
+ *   cluster-adapter.ts's identity rule) and the uid is only knowable from the cluster, which does
+ *   not exist yet when this resource writes the vault key. Workloads get their connection from the
+ *   operator's pinned literal (`talosOpenBaoConnection(uid)`) or `Talos.ClusterHealth`'s
+ *   pass-through; `Talos.ClusterIdentity` publishes `{ uid }` only; a name-only connection
+ *   (`cluster` present) is refused by the adapter as legacy. Neither the
+ *   stock `kubeconfig` kind (an absent path falls back to `$KUBECONFIG`) nor `client-cert` (PEM on
+ *   every workload's attributes, `Connection.ts` v2.0.0-beta.79 lines 12-14) is ever used.
  */
-import type { Connection } from 'alchemy/Kubernetes/Connection';
 import type { KubeconfigAttributes, KubeconfigProps } from './kubeconfig.ts';
 import { kubeconfigMetadata, sha256 } from './values.ts';
 
@@ -16,27 +22,6 @@ const generation = (meta: {
   context: string;
 }) => sha256(`${meta.context}\n${meta.endpoint}\n${meta.caFingerprint}\n${meta.clientFingerprint}`);
 
-/**
- * ⛔ I2 FIX (LAND red team, 2026-09-26) — NEVER LEAVE `path` UNDEFINED. An undefined `path` here
- *   made the stock `Kubernetes.KubeConfigAdapter` fall back to `$KUBECONFIG`/`~/.kube/config`
- *   (alchemy `Kubernetes/internal/kubeconfig.ts`'s `resolveKubeConfigPath`, wired in
- *   `BuiltinAdapters.ts`) — exactly the un-vaulted, possibly-stale-context exposure this whole
- *   family exists to remove. A consumer wiring `Kubernetes.*` to `kube.connection` (this
- *   attribute's own doc invites exactly that) would silently connect through whatever
- *   `admin@<cluster>` context happens to be on the operator's machine. `Kubernetes.ClusterAdapter`
- *   is not yet wired to `mintKubeconfig` (kubeconfig.ts's own header) — no real path exists for
- *   this connection to use — so it must fail LOUDLY instead of silently succeeding against a
- *   stranger's cluster. A path that can never resolve does that: `resolveKubeContext` fails at
- *   `fs.readFileString` naming this exact sentinel, instead of reading whatever real file happens
- *   to be on `$KUBECONFIG`.
- */
-const UNWIRED_KUBECONFIG_PATH =
-  '/talos-first-boot-unwired/wire-Kubernetes.ClusterAdapter-to-mintKubeconfig';
-
-const toConnection = (props: KubeconfigProps): Connection => ({
-  auth: { context: props.context, kind: 'kubeconfig', path: UNWIRED_KUBECONFIG_PATH },
-});
-
 /** Parse `raw` kubeconfig YAML into public, persistable attributes, or `undefined` if it fails to. */
 export const buildAttrs = (
   raw: string,
@@ -47,7 +32,6 @@ export const buildAttrs = (
   return {
     certificateAuthorityFingerprint: meta.caFingerprint,
     clientCertificateFingerprint: meta.clientFingerprint,
-    connection: toConnection(props),
     context: props.context,
     credentialGeneration: generation({ ...meta, context: props.context }),
     endpoint: meta.endpoint,

package/src/talos/kubeconfig-doc.ts

@@ -0,0 +1,74 @@
+/**
+ * In-memory kubeconfig parse for `talos-openbao` connect.
+ *
+ * ⛔ THE RESULT HOLDS PEM. Callers may put it on a `ClusterTransport` for one request.
+ *   They must not persist it, log it, or copy it onto a `Connection`. Alchemy stores
+ *   connection attributes in plaintext (`credentials.ts`'s own header).
+ * ★ YAML IS `yaml-parse.ts` (runtime-neutral: Bun.YAML does not exist under Node, where the
+ *   published dist runs). Nothing here touches a filesystem or OpenBao — the caller has already
+ *   read the bytes.
+ *
+ * Walked against alchemy 2.0.0-beta.79 `Kubernetes/internal/client.ts`: `certificateAuthorityData`
+ * stays base64 (the client decodes it) and `clientCert` is PEM. The document shape is the one
+ * `values.ts` parses from the Talos v1.13 kubeconfig reference. Not measured on a live cluster.
+ */
+import type { ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+import { parseYaml } from './yaml-parse.ts';
+
+type KubeconfigDoc = {
+  clusters?: {
+    cluster?: { server?: string; 'certificate-authority-data'?: string };
+    name?: string;
+  }[];
+  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];
+  users?: {
+    name?: string;
+    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };
+  }[];
+};
+
+export type KubeconfigMaterial = Pick<
+  ClusterTransport,
+  'certificateAuthorityData' | 'clientCert' | 'endpoint'
+>;
+
+/** Base64 kubeconfig field → PEM, or `undefined` when it is not a PEM payload. */
+const pem = (data: string | undefined): string | undefined => {
+  if (data === undefined || data.trim() === '') return undefined;
+  const decoded = Buffer.from(data, 'base64').toString('utf8');
+  return decoded.includes('BEGIN ') ? decoded : undefined;
+};
+
+/**
+ * Resolve `contextName` to endpoint, base64 CA, and PEM client cert/key.
+ * `undefined` for any shape that is not that context's admin kubeconfig — the caller
+ * fails closed without embedding the document in the error.
+ */
+export const kubeconfigTransport = (
+  yamlText: string,
+  contextName: string,
+): KubeconfigMaterial | undefined => {
+  const parsed = parseYaml(yamlText);
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
+  const doc = parsed as KubeconfigDoc;
+  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
+  const clusterName = ctx?.cluster;
+  const userName = ctx?.user;
+  if (clusterName === undefined || userName === undefined) return undefined;
+  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;
+  const user = doc.users?.find((row) => row.name === userName)?.user;
+  const endpoint = cluster?.server;
+  const certificateAuthorityData = cluster?.['certificate-authority-data'];
+  const certificate = pem(user?.['client-certificate-data']);
+  const key = pem(user?.['client-key-data']);
+  if (
+    endpoint === undefined ||
+    certificateAuthorityData === undefined ||
+    pem(certificateAuthorityData) === undefined ||
+    certificate === undefined ||
+    key === undefined
+  ) {
+    return undefined;
+  }
+  return { certificateAuthorityData, clientCert: { certificate, key }, endpoint };
+};

package/src/talos/kubeconfig.fixtures.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared fixtures for the `Talos.Kubeconfig` tests: a fixture kubeconfig and the fake-spawner
+ * runner.
+ *
+ * ⚠️ FIXTURES ONLY — see values.test.ts's own header for why the base64 fields are built from
+ *   plain words at run time rather than written out literally.
+ */
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { type FakeCall, fakeSpawner } from './fake-process.ts';
+import type { KubeconfigProps } from './kubeconfig.ts';
+
+const b64 = (words: string) => Buffer.from(words).toString('base64');
+
+export const fixtureKubeconfig = (marker: string) => `
+apiVersion: v1
+kind: Config
+clusters:
+  - name: hf-c1
+    cluster:
+      server: https://192.0.2.50:6443
+      certificate-authority-data: ${b64(`not a ca ${marker}`)}
+contexts:
+  - name: admin@hf-c1
+    context: { cluster: hf-c1, user: admin@hf-c1 }
+users:
+  - name: admin@hf-c1
+    user:
+      client-certificate-data: ${b64(`not a certificate ${marker}`)}
+      client-key-data: ${b64(`not a key ${marker}`)}
+current-context: admin@hf-c1
+`;
+
+const TARGET = { cluster: 'c1', mount: 'talos-c1' };
+export const props = (): KubeconfigProps => ({
+  context: 'admin@hf-c1',
+  node: '198.51.100.10',
+  target: TARGET,
+});
+
+export const run = <A, E>(
+  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
+  handler: (c: FakeCall) => { stdout?: string; stderr?: string; exitCode?: number },
+  calls: FakeCall[] = [],
+) =>
+  Effect.runPromise(
+    Effect.provideService(
+      effect,
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(handler, calls),
+    ),
+  );

package/src/talos/kubeconfig.test.ts

@@ -9,58 +9,15 @@
 import assert from 'node:assert/strict';
 import { existsSync, writeFileSync } from 'node:fs';
 import { describe, it } from 'node:test';
-import * as Effect from 'effect/Effect';
-import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
-import { type FakeCall, fakeSpawner } from './fake-process.ts';
+import type { FakeCall } from './fake-process.ts';
+import { fixtureKubeconfig, props, run } from './kubeconfig.fixtures.ts';
 import {
   type KubeconfigAttributes,
-  type KubeconfigProps,
   diffKubeconfig as diff,
   readKubeconfig as read,
   reconcileKubeconfig as reconcile,
 } from './kubeconfig.ts';
 
-const b64 = (words: string) => Buffer.from(words).toString('base64');
-
-const fixtureKubeconfig = (marker: string) => `
-apiVersion: v1
-kind: Config
-clusters:
-  - name: hf-c1
-    cluster:
-      server: https://192.0.2.50:6443
-      certificate-authority-data: ${b64(`not a ca ${marker}`)}
-contexts:
-  - name: admin@hf-c1
-    context: { cluster: hf-c1, user: admin@hf-c1 }
-users:
-  - name: admin@hf-c1
-    user:
-      client-certificate-data: ${b64(`not a certificate ${marker}`)}
-      client-key-data: ${b64(`not a key ${marker}`)}
-current-context: admin@hf-c1
-`;
-
-const TARGET = { cluster: 'c1', mount: 'talos-c1' };
-const props = (): KubeconfigProps => ({
-  context: 'admin@hf-c1',
-  node: '198.51.100.10',
-  target: TARGET,
-});
-
-const run = <A, E>(
-  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
-  handler: (c: FakeCall) => { stdout?: string; stderr?: string; exitCode?: number },
-  calls: FakeCall[] = [],
-) =>
-  Effect.runPromise(
-    Effect.provideService(
-      effect,
-      ChildProcessSpawner.ChildProcessSpawner,
-      fakeSpawner(handler, calls),
-    ),
-  );
-
 describe('reconcile — CREATE writes talosctl kubeconfig output into the vault, never a host path', () => {
   it('mints the temp file, writes its content to vault via stdin, cleans up the temp file', async () => {
     const calls: FakeCall[] = [];
@@ -85,13 +42,10 @@ describe('reconcile — CREATE writes talosctl kubeconfig output into the vault,
 
     assert.equal(result.endpoint, 'https://192.0.2.50:6443');
     assert.equal(result.context, 'admin@hf-c1');
-    assert.equal(result.connection.auth.kind, 'kubeconfig');
-    // ⛔ I2 (LAND red team): NEVER undefined — an undefined `path` here would let the stock
-    // KubeConfigAdapter fall back to $KUBECONFIG/~/.kube/config. It must be a path that can never
-    // resolve, so a consumer that isn't yet wired to mintKubeconfig fails loudly instead of quietly
-    // reaching the operator's own cluster.
-    const authPath = (result.connection.auth as { path?: string }).path;
-    assert.ok(typeof authPath === 'string' && authPath.length > 0);
+    assert.equal('connection' in result, false, 'the identity resource owns the connection');
+    assert.equal(JSON.stringify(result).includes('talos-first-boot-unwired'), false);
+    assert.equal(JSON.stringify(result).includes('BEGIN CERTIFICATE'), false);
+    assert.equal(JSON.stringify(result).includes('PRIVATE KEY'), false);
 
     const put = calls.find((c) => c.command === 'bao' && c.args[1] === 'put');
     assert.ok(put);
@@ -110,7 +64,6 @@ describe('reconcile — write-once: a second reconcile never re-runs talosctl ku
     const priorOutput: KubeconfigAttributes = {
       certificateAuthorityFingerprint: 'x',
       clientCertificateFingerprint: 'x',
-      connection: { auth: { context: 'admin@hf-c1', kind: 'kubeconfig' } },
       context: 'admin@hf-c1',
       credentialGeneration: 'x',
       endpoint: 'https://192.0.2.50:6443',
@@ -205,7 +158,6 @@ describe('reconcile — belt-and-suspenders: a defined-but-empty output is treat
     const staleEmptyOutput: KubeconfigAttributes = {
       certificateAuthorityFingerprint: '',
       clientCertificateFingerprint: '',
-      connection: { auth: { context: 'admin@hf-c1', kind: 'kubeconfig' } },
       context: 'admin@hf-c1',
       credentialGeneration: '',
       endpoint: '',

package/src/talos/kubeconfig.ts

@@ -23,23 +23,25 @@
  *       (docs/plans/2026-09-26-talos-secrets-flow.md, O1). Once `output` is defined, reconcile only
  *       reads the vault copy back to confirm it — the same "once" shape `talos-bootstrap.ts` uses
  *       for a boolean, here for a value.
- *     - The persisted `connection` carries no usable host path — a consumer materializes its own
- *       temp file via `credentials.ts`'s `mintKubeconfig`, the same pattern `mintTalosconfig`
- *       already established. Wiring `Kubernetes.ClusterAdapter` to call it is separate, later work
- *       (named, not built, in the secrets-flow doc); this only makes the vault-backed read+mint
- *       step exist for it to call. ⛔ Until that wiring lands, `connection.auth.path` is a sentinel
- *       that can never resolve to a real file (LAND red team I2, `kubeconfig-attrs.ts`'s own
- *       header) — an ABSENT path here would let the stock `Kubernetes.KubeConfigAdapter` silently
- *       fall back to `$KUBECONFIG`/`~/.kube/config` instead of failing loudly.
+ *     - NO `connection` is persisted here: a connection names the physical cluster by its
+ *       kube-system uid, which only `Talos.ClusterIdentity` can read (cluster-adapter.ts, the
+ *       identity rule). The adapter reads the vault at connect time. ⛔ Never the stock
+ *       `kubeconfig` kind (absent path falls back to `$KUBECONFIG`) nor `client-cert` (PEM on
+ *       every workload's attributes, alchemy `Connection.ts`).
  */
+import { readFile } from 'node:fs/promises';
 import { chmodSync } from 'node:fs';
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
-import type { Connection } from 'alchemy/Kubernetes/Connection';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import { DEFAULT_KUBECONFIG_KEY, mintTalosconfig, readKvValue } from './credentials.ts';
+import {
+  DEFAULT_KUBECONFIG_KEY,
+  isVaultKeyAbsent,
+  mintTalosconfig,
+  readKvValue,
+} from './credentials.ts';
 import { reservedTempPath, writeKvValue } from './credentials-write.ts';
 import { buildAttrs } from './kubeconfig-attrs.ts';
 import type { TalosRequirements, WithTarget } from './resource.ts';
@@ -62,17 +64,6 @@ export interface KubeconfigAttributes {
   clientCertificateFingerprint: string;
   /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */
   credentialGeneration: string;
-  /**
-   * Serializable `Kubernetes.Connection` for downstream workloads.
-   *
-   * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.
-   *   `path` is a sentinel that can never resolve (LAND red team I2, `kubeconfig-attrs.ts`'s own
-   *   `toConnection` header): the content lives in OpenBao, not at a fixed host path, and a real
-   *   `Kubernetes.ClusterAdapter` wiring is later work, so this must fail rather than silently
-   *   reach the operator's own kubeconfig. A consumer materializes its own scoped temp file via
-   *   `credentials.ts`'s `mintKubeconfig` in the meantime.
-   */
-  connection: Connection;
 }
 
 export interface TalosKubeconfig extends Resource<
@@ -85,18 +76,7 @@ export interface TalosKubeconfig extends Resource<
 
 export const TalosKubeconfig = Resource<TalosKubeconfig>('Talos.Kubeconfig');
 
-/**
- * ★ MEASURED AGAINST OPENBAO v2.6.2 (C1 fix, LAND red team, 2026-09-26 — isolated in-memory dev
- *   server, `env -i`, scratch HOME, no estate credentials; server removed after): `bao kv get` on a
- *   genuinely unwritten KV-v2 key exits 2 with stderr exactly `No value found at <mount>/data/<key>`
- *   — `readKvValue`'s Error message embeds that text verbatim. This is the ONLY signal this file
- *   trusts as "not written yet"; every other failure (a wrong exit code, a different stderr such as
- *   a permission denial or a network failure) propagates as a real error instead of being read as
- *   absence.
- */
-const isVaultKeyAbsent = (error: unknown): boolean =>
-  error instanceof Error && /no value found at/i.test(error.message);
-
+/** Absence is {@link isVaultKeyAbsent} — measured OpenBao v2.6.2 text, not every bao failure. */
 const readVaultMeta = (props: KubeconfigProps, key: string) =>
   readKvValue(props.target.mount, key, ['kubeconfig', 'config']).pipe(
     Effect.catchIf(isVaultKeyAbsent, () => Effect.succeed(undefined)),
@@ -143,6 +123,10 @@ export const diffKubeconfig = (
       live !== undefined &&
       live.credentialGeneration === output.credentialGeneration &&
       live.context === output.context &&
+      // ⚠️ A row saved by an earlier build still carries a `connection` (a name-only or dead
+      //   placeholder one). It must update so the stale connection leaves state: a workload wired
+      //   to this resource would otherwise keep an auth block that names no physical cluster.
+      !('connection' in output) &&
       live.endpoint === output.endpoint
     ) {
       return { action: 'noop' } as const;
@@ -195,7 +179,7 @@ export const reconcileKubeconfig = (
       );
       const raw = yield* Effect.tryPromise({
         catch: (cause) => new Error(`${outPath}: reading generated kubeconfig: ${String(cause)}`),
-        try: () => Bun.file(outPath).text(),
+        try: () => readFile(outPath, 'utf8'),
       });
       if (raw.trim() === '') {
         return yield* Effect.die(

package/src/talos/literal-connection.ts

@@ -0,0 +1,59 @@
+/**
+ * Runtime refusal of a `talos-openbao` connection that is not a plain literal.
+ *
+ * ⛔ A RESOURCE THAT TAKES A `connection` PROP MUST CALL THIS IN `diff`, WHERE THE PROP IS STILL
+ *   AN `Input`. By `read`/`reconcile` the engine has resolved an Output to its current string, so
+ *   the same check there can no longer tell a literal from an Output: the refusal only works
+ *   before resolution. An Output in the connection is unresolved at plan time, upstream plans an
+ *   UPDATE for every workload on it, and reconcile replays the old cluster's deletes on the new
+ *   one (`talosOpenBaoConnection` in cluster-adapter.ts).
+ */
+import { hasUnresolvedInputs } from 'alchemy/Diff';
+import * as Effect from 'effect/Effect';
+import { TalosUidNotLiteral } from './cluster-adapter-errors.ts';
+
+/**
+ * The typed refusal unless `connection` is `{ auth: { kind, uid: literal } }`, else `undefined`.
+ * ★ A value, never a throw: a throw inside `Effect.gen` would become a defect, not a failure.
+ */
+export const literalConnectionRefusal = (connection: unknown): TalosUidNotLiteral | undefined => {
+  const auth = (connection as { auth?: { kind?: unknown; uid?: unknown } } | undefined)?.auth;
+  // ⛔ A stock `kubeconfig` connection has no uid and would pass the checks below by failing the
+  //   `uid` test as "not a string" — but it must be refused here, at declaration/diff time, because
+  //   connect would only refuse it later, after the engine has resolved it (and its empty path has
+  //   already fallen back to `$KUBECONFIG`). Only `talos-openbao` carries a literal uid.
+  return hasUnresolvedInputs(connection) ||
+    auth?.kind !== 'talos-openbao' ||
+    typeof auth?.uid !== 'string' ||
+    auth.uid === ''
+    ? new TalosUidNotLiteral({})
+    : undefined;
+};
+
+/**
+ * ⛔ THE `diff` GUARD ALONE IS NOT ENOUGH (round-4 review): alchemy skips `diff` for a FRESH
+ *   resource whose inputs are unresolved, and reconcile then copies the resolved string downstream
+ *   — an Output uid slips through on exactly the first deploy. So the same refusal runs when the
+ *   resource is DECLARED, before any input resolution, by wrapping its constructor.
+ * ★ A Proxy over the class (not a new function) keeps `.Provider`, `.Self`, `.ref` and the type.
+ *   Plain props fail the declaring Effect; a props Effect fails once it yields.
+ */
+export const withLiteralConnection = <C extends (...args: never[]) => unknown>(resource: C): C =>
+  new Proxy(resource, {
+    apply: (target, thisArg, args: unknown[]) => {
+      const refusal = (given: unknown) =>
+        literalConnectionRefusal((given as { connection?: unknown } | undefined)?.connection);
+      const props = args[1];
+      if (Effect.isEffect(props)) {
+        const checked = props.pipe(
+          Effect.flatMap((resolved) => {
+            const refused = refusal(resolved);
+            return refused === undefined ? Effect.succeed(resolved) : Effect.fail(refused);
+          }),
+        );
+        return Reflect.apply(target, thisArg, [args[0], checked, ...args.slice(2)]);
+      }
+      const refused = refusal(props);
+      return refused === undefined ? Reflect.apply(target, thisArg, args) : Effect.fail(refused);
+    },
+  });