From ecf97173b4851c0c5360d5d5620ba96dd31aa961 Mon Sep 17 00:00:00 2001
From: "Timothy J. Aveni" <tja@berkeley.edu>
Date: Sun, 11 Oct 2026 16:39:15 -0700
Subject: [PATCH] Retain private platform source while resolving its
 context-free Nix flake reference

---
 nix/checked-candidate.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nix/checked-candidate.nix b/nix/checked-candidate.nix
index 9446844..5af96c9 100644
--- a/nix/checked-candidate.nix
+++ b/nix/checked-candidate.nix
@@ -81,7 +81,12 @@ let
     else
       assert platformSource.repository == root.lock.quixos.repository;
       assert platformSource.commit == root.lock.quixos.commit;
-      builtins.getFlake "path:${builtins.storePath platformSource.directory}";
+      # getFlake accepts a context-free flake reference. storePath first checks
+      # presence; the resulting flake retains its immutable source as an input.
+      # Dropping string context here does not permit an authored mutable path.
+      builtins.getFlake (
+        builtins.unsafeDiscardStringContext "path:${builtins.storePath platformSource.directory}"
+      );
   runtimePackages = runtime.packages.${system};
   resourceClosure =
     includeBuild: node: