graft: recover orphan branch rescue/orphan-7d7132f79c48-merge-den-1418-compose-nix-export-plan-s onto main

.claude/CLAUDE.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.

.gemini/GEMINI.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.

.github/workflows/agents-policy.yml

@@ -0,0 +1,19 @@
+name: agents policy
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agents-policy-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    uses: zed-pkg/zed-monorepo/.github/workflows/agents-policy-reusable.yml@fb2417b1a976459e3de740f788916d3d91d3669e
+    with:
+      policy_ref: fb2417b1a976459e3de740f788916d3d91d3669e

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          components: rustfmt,clippy
+
+      - name: Format
+        run: cargo fmt --check
+
+      - name: Clippy
+        run: cargo clippy --locked --all-targets -- -D warnings
+
+      - name: Test
+        run: cargo test --locked
+
+      - name: Doctest
+        run: cargo test --locked --doc
+
+      - name: Schemas are up to date
+        run: |
+          cargo run --locked --example generate_schemas
+          git diff --exit-code schemas/ \
+            || (echo "schemas/ is stale; run 'cargo run --locked --example generate_schemas' and commit" && exit 1)

.github/workflows/environment-lock-contract.yml

@@ -0,0 +1,113 @@
+name: environment lock contract
+
+on:
+  push:
+    branches:
+      - agent/environment-lock-v1-current-main
+      - main
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/environment_lock.rs
+      - src/lib.rs
+      - examples/generate_schemas.rs
+      - schemas/environment-lock-v1.json
+      - .github/workflows/environment-lock-contract.yml
+  pull_request:
+    branches:
+      - main
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/environment_lock.rs
+      - src/lib.rs
+      - examples/generate_schemas.rs
+      - schemas/environment-lock-v1.json
+      - .github/workflows/environment-lock-contract.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: environment-lock-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust-contract:
+    name: Rust contract / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - macos-15
+          - windows-2025
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+          components: rustfmt,clippy
+
+      - name: Verify formatting, tests, docs, and lint
+        run: |
+          cargo fmt --all -- --check
+          cargo test --locked environment_lock
+          cargo test --locked
+          cargo test --locked --doc
+          cargo clippy --locked --all-targets -- -D warnings
+
+  generated-schema:
+    name: Generated schema is deterministic
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+
+      - name: Regenerate twice and reject drift
+        run: |
+          set -euo pipefail
+          cargo run --locked --example generate_schemas
+          cp schemas/environment-lock-v1.json /tmp/environment-lock-v1.json
+          cargo run --locked --example generate_schemas
+          cmp /tmp/environment-lock-v1.json schemas/environment-lock-v1.json
+          git diff --exit-code -- \
+            schemas/environment-plan-v1.json \
+            schemas/environment-plan.json \
+            schemas/environment-lock-v1.json
+
+  gate:
+    name: All EnvironmentLock checks passed
+    if: always()
+    needs:
+      - rust-contract
+      - generated-schema
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Enforce aggregate result
+        env:
+          RUST_RESULT: ${{ needs.rust-contract.result }}
+          SCHEMA_RESULT: ${{ needs.generated-schema.result }}
+        run: |
+          set -euo pipefail
+          printf 'rust=%s schema=%s\n' "$RUST_RESULT" "$SCHEMA_RESULT"
+          test "$RUST_RESULT" = success
+          test "$SCHEMA_RESULT" = success

.github/workflows/nix.yml

@@ -0,0 +1,58 @@
+name: nix
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/**
+      - examples/**
+      - schemas/**
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - agents.md
+      - README.md
+      - .github/workflows/nix.yml
+  pull_request:
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - src/**
+      - examples/**
+      - schemas/**
+      - flake.nix
+      - flake.lock
+      - .nix/**
+      - agents.md
+      - README.md
+      - .github/workflows/nix.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nix-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  agent-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Run pinned contract checks
+        run: nix develop --no-update-lock-file -c agent-check

.gitignore

@@ -12,3 +12,7 @@ tmp
 temp
 tmp/worktrees
 temp/worktrees
+
+# --- carried over from the grafted branch rescue/orphan-7d7132f79c48-merge-den-1418-compose-nix-export-plan-s ---
+.cache/
+/target

.nix/agent-check.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export CI="${CI:-1}"
+export NO_COLOR="${NO_COLOR:-1}"
+
+repo_root="$(git rev-parse --show-toplevel)"
+cd "$repo_root"
+
+cache_root="${NIX_AGENT_CACHE_ROOT:-$repo_root/.cache/nix-agent}"
+export CARGO_HOME="${CARGO_HOME:-$cache_root/cargo}"
+export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$cache_root/target}"
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$cache_root/xdg}"
+mkdir -p "$CARGO_HOME" "$CARGO_TARGET_DIR" "$XDG_CACHE_HOME"
+
+run_stage() {
+  local stage="$1"
+  printf '\n==> agent-check stage: %s\n' "$stage"
+
+  case "$stage" in
+    preflight)
+      git diff --check
+      nixfmt --check flake.nix .nix/dev-shell.nix
+      shellcheck .nix/agent-check.sh
+      shfmt -i 2 -ci -d .nix/agent-check.sh
+      actionlint .github/workflows/*.yml
+      nix flake check --no-update-lock-file --show-trace
+      ;;
+    format)
+      cargo fmt --check
+      ;;
+    lint)
+      # Nixpkgs currently pins Rust/Clippy 1.95, whose nonminimal_bool advice
+      # conflicts with the explicit, security-auditable path rejection list.
+      # Current stable CI still runs every lint with -D warnings; only this
+      # toolchain-version-specific style lint is exempted in the pinned shell.
+      cargo clippy --locked --all-targets -- \
+        -D warnings \
+        -A clippy::nonminimal_bool
+      ;;
+    test)
+      cargo test --locked
+      cargo test --locked --doc
+      ;;
+    schemas)
+      cargo run --locked --example generate_schemas
+      git diff --exit-code -- schemas/
+      ;;
+    all)
+      local child
+      for child in preflight format lint test schemas; do
+        run_stage "$child"
+      done
+      ;;
+    *)
+      printf 'unknown agent-check stage: %s\n' "$stage" >&2
+      return 64
+      ;;
+  esac
+}
+
+case "${1:-all}" in
+  all | preflight | format | lint | test | schemas)
+    run_stage "${1:-all}"
+    ;;
+  *)
+    printf 'usage: agent-check [all|preflight|format|lint|test|schemas]\n' >&2
+    exit 64
+    ;;
+esac

.nix/dev-shell.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  agentCheck,
+  toolchain,
+}:
+pkgs.mkShell {
+  packages = toolchain ++ [ agentCheck ];
+
+  LANG = if pkgs.stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+  LC_ALL = if pkgs.stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+
+  shellHook = ''
+    export NIX_DEV_SHELL=zed-interfaces
+    export NIX_AGENT_CACHE_ROOT="''${NIX_AGENT_CACHE_ROOT:-$PWD/.cache/nix-agent}"
+    export CARGO_HOME="''${CARGO_HOME:-$NIX_AGENT_CACHE_ROOT/cargo}"
+    export CARGO_TARGET_DIR="''${CARGO_TARGET_DIR:-$NIX_AGENT_CACHE_ROOT/target}"
+    export XDG_CACHE_HOME="''${XDG_CACHE_HOME:-$NIX_AGENT_CACHE_ROOT/xdg}"
+    mkdir -p "$CARGO_HOME" "$CARGO_TARGET_DIR" "$XDG_CACHE_HOME"
+  '';
+}

.openai/AGENTS.md

@@ -0,0 +1 @@
+Read and follow the canonical instructions in `../agents.md`.