quixos-protocol/nix/checked-artifacts.nix

# Candidate artifact evaluation. This is separate from the old server activation path;
# the new coordinator consumes its manifest/receipt, not the legacy server ABI.
{
  source,
  plan,
  generator,
  core,
  sharedRuntime,
  typescript,
  packageRevisionId,
  system ? builtins.currentSystem,
}:
let
  packageSource = builtins.path {
    path = /. + source;
    name = "quixos-package-source";
    filter =
      path: _:
      !(builtins.elem (baseNameOf path) [
        ".git"
        ".jj"
      ]);
  };
  package = builtins.getFlake (
    "path:" + builtins.unsafeDiscardStringContext (toString packageSource)
  );
  pkgs = import package.inputs.nixpkgs { inherit system; };
  buildContext = import ./package-context.nix {
    inherit pkgs packageRevisionId;
    protocol = builtins.storePath generator;
    plan = builtins.path {
      path = /. + plan;
      name = "candidate-execution-plan.json";
    };
  };
  checked =
    package.quixosPackages.${system}.checkedArtifacts
      or (throw "Package ${packageRevisionId} lacks checkedArtifacts for the portable execution world.");
in
checked (
  buildContext
  // {
    inherit packageRevisionId;
    generator = builtins.storePath generator;
    core = builtins.storePath core;
    sharedRuntime = builtins.storePath sharedRuntime;
    typescript = builtins.storePath typescript;
  }
)