{
  pkgs,
  library,
  nixpkgsSource,
  nixpkgsNarHash,
}:
assert builtins.isString nixpkgsSource;
let
  comparisonIdentity = import ../tools/local-first/derivation-identity.nix;
  inspect = import ./source-qualification-metadata.nix;
  source = pkgs.lib.fileset.toSource {
    root = ./.;
    fileset = pkgs.lib.fileset.unions [
      ./src
      ./test
      ./grammar
      ./proto
      ./nix
      ./package.json
      ./yarn.lock
      ./.yarnrc.yml
      ./.yarn/plugins
      ./tsconfig.json
      ./tsconfig.build.json
      ./tsconfig.test.json
      ./default.nix
      ./source-qualification-metadata.nix
      ./yarn-project.nix
      ./flake.nix
      ./README.md
    ];
  };
  inputs = pkgs.writeText "protocol-source-inputs.json" (
    builtins.toJSON {
      inherit source nixpkgsNarHash;
      narHashContext = builtins.getContext nixpkgsNarHash;
      evaluatorVersion = builtins.nixVersion;
      pinnedNixVersion = pkgs.nix.version;
      # toJSON ingests path values. Keep the original flake input's outPath
      # string, so importing it and interpolating pkgs.path does not copy twice.
      nixpkgs = nixpkgsSource;
      system = pkgs.stdenv.hostPlatform.system;
      expected = comparisonIdentity library;
      expectedMetadata = inspect library;
      expectedSource = builtins.unsafeDiscardStringContext (toString library.src);
      yarn = comparisonIdentity library.yarn-freestanding;
    }
  );
  closure = pkgs.closureInfo { rootPaths = [ nixpkgsSource ]; };
in
pkgs.runCommand "quixos-protocol-source-check"
  {
    nativeBuildInputs = [
      pkgs.nodejs_24
      pkgs.nix
    ];
    passthru.ciDiagnosticArtifacts."protocol-source.json" = {
      file = "protocol-source.json";
      maxBytes = 8192;
    };
  }
  ''
    # The ordinary compiler still owns all tests and emitted fixtures. Finish
    # that same checked build before the new identity-only evaluations.
    test -e ${library}
    export HOME="$TMPDIR/home"
    export NIX_STATE_DIR="$TMPDIR/nix-state"
    export NIX_LOG_DIR="$TMPDIR/nix-log"
    export NIX_CONF_DIR="$TMPDIR/nix-conf"
    export NIX_USER_CONF_FILES=/dev/null
    export NIX_CONFIG='experimental-features = nix-command flakes
    substituters =
    builders =
    max-jobs = 0
    allow-import-from-derivation = false
    accept-flake-config = false'
    export QUIXOS_PROTOCOL_EVALUATION_STORE="$TMPDIR/evaluation-store"
    mkdir -p "$HOME" "$NIX_STATE_DIR" "$NIX_LOG_DIR" "$NIX_CONF_DIR" "$QUIXOS_PROTOCOL_EVALUATION_STORE/nix/store"
    while IFS= read -r dependency; do
      cp -a --no-preserve=ownership "$dependency" "$QUIXOS_PROTOCOL_EVALUATION_STORE$dependency"
    done < ${closure}/store-paths
    nix-store --store "local?root=$QUIXOS_PROTOCOL_EVALUATION_STORE" --load-db < ${closure}/registration
    timeout --kill-after=5s 180s node ${./source-qualification.mjs} ${inputs} "$out"
  ''