Timothy J. Aveni
ad2a851b94
Add exact recursive source checkout, independent Git/jj developer workbenches and source-only backup/recovery commands, with Workspace instance binding outside source. Qualify two empty Reader Graphs, packaged source commands, Agent VM compilation, exact Gitea read grants and reconciled Reader settings/annotation stability. Publish checked Reader Package/root revisions to canonical review branches and retention tags, retain all 57 repositories independently in private versioned storage, verify downloaded-backup recovery and advance the example pin. Add bounded Central pin acquisition and selection-specific read-only identities, qualified against all 57 canonical repositories without write authority. Replace regex fork dependency discovery with compiler-parsed lock imports and rewrite proposals; preserve source identities and unrelated files, passing instance binding through packed and ordinary host checks. Hosted run-pin versus authoring preparation and maintained duplicate removal remain pending. Live source selections, Template defaults and default source branches are unchanged.
419 lines
15 KiB
Nix
419 lines
15 KiB
Nix
# All source trees and recursive locks are fetched by Nix at exact retained
|
|
# revisions. No authoring-directory overlay or externally assembled schema.
|
|
{
|
|
repository,
|
|
commit,
|
|
kind,
|
|
generator,
|
|
contractOnly ? false,
|
|
workspaceId ? null,
|
|
system ? builtins.currentSystem,
|
|
}:
|
|
let
|
|
pkgs = import (/. + "@nixpkgs@") {
|
|
inherit system;
|
|
config = { };
|
|
overlays = [ ];
|
|
};
|
|
protocol = builtins.storePath generator;
|
|
sourceKey = source: "${source.kind}:${source.repository}@${source.commit}";
|
|
fetch =
|
|
source:
|
|
builtins.fetchGit {
|
|
url = source.repository;
|
|
rev = source.commit;
|
|
ref = "refs/tags/quixos-reachability/${source.commit}";
|
|
shallow = true;
|
|
};
|
|
# Memoize by exact source identity. A diamond-shaped dependency graph must
|
|
# not recursively evaluate every path through the same imported subtree.
|
|
loadSource =
|
|
source:
|
|
let
|
|
directory = fetch source;
|
|
lockSource = import ./lock-source.nix { source = directory; };
|
|
lockFile = pkgs.runCommand "qx-source-lock.json" { } ''
|
|
${protocol}/bin/quixos-lock-check ${lockSource}/quixos.lock > "$out"
|
|
'';
|
|
lock = builtins.fromJSON (builtins.readFile lockFile);
|
|
in
|
|
source // { inherit directory lock; };
|
|
sourceEntry = source: {
|
|
key = sourceKey source;
|
|
value = loadSource source;
|
|
};
|
|
sourceGraph = builtins.genericClosure {
|
|
startSet = [ (sourceEntry { inherit kind repository commit; }) ];
|
|
operator =
|
|
entry:
|
|
map (
|
|
resource: sourceEntry (resource.source // { inherit (resource) kind; })
|
|
) entry.value.lock.resources;
|
|
};
|
|
nodeTable = builtins.listToAttrs (
|
|
map (entry: {
|
|
name = entry.key;
|
|
value = entry.value // {
|
|
children = map (
|
|
resource:
|
|
nodeTable.${sourceKey (resource.source // { inherit (resource) kind; })}
|
|
// {
|
|
inherit (resource) binding;
|
|
}
|
|
) entry.value.lock.resources;
|
|
};
|
|
}) sourceGraph
|
|
);
|
|
root = nodeTable.${sourceKey { inherit kind repository commit; }};
|
|
configuration =
|
|
if builtins.pathExists (root.directory + "/quixos.check.json") then
|
|
builtins.fromJSON (builtins.readFile (root.directory + "/quixos.check.json"))
|
|
else
|
|
{ };
|
|
execution = (configuration.backend or "typescript") == "execution";
|
|
runtime = builtins.getFlake (
|
|
"git+${root.lock.quixos.repository}?rev=${root.lock.quixos.commit}&ref=refs/tags/quixos-reachability/${root.lock.quixos.commit}"
|
|
);
|
|
runtimePackages = runtime.packages.${system};
|
|
resourceClosure =
|
|
includeBuild: node:
|
|
map (entry: entry.value) (
|
|
builtins.genericClosure {
|
|
startSet = pkgs.lib.optional (includeBuild || node.kind != "build") {
|
|
key = sourceKey node;
|
|
value = node;
|
|
};
|
|
operator =
|
|
entry:
|
|
map (child: {
|
|
key = sourceKey child;
|
|
value = child;
|
|
}) (builtins.filter (child: includeBuild || child.kind != "build") entry.value.children);
|
|
}
|
|
);
|
|
capabilityFlatten = resourceClosure false;
|
|
# Frontends are an explicit build choice. The capability assembler itself
|
|
# neither discovers React contracts nor loads executable package code.
|
|
queryFrontends =
|
|
node:
|
|
pkgs.lib.unique (
|
|
pkgs.lib.concatMap (
|
|
node:
|
|
let
|
|
config = node.directory + "/quixos.check.json";
|
|
in
|
|
if builtins.pathExists config then
|
|
(builtins.fromJSON (builtins.readFile config)).queryFrontends or [ ]
|
|
else
|
|
[ ]
|
|
) (capabilityFlatten node)
|
|
);
|
|
queryGeneratorFlags =
|
|
node:
|
|
if queryFrontends node == [ ] then
|
|
""
|
|
else if queryFrontends node == [ "react" ] then
|
|
"--query-generator ${protocol}/libexec/quixos-protocol/react-query-generator.mjs"
|
|
else
|
|
throw "Unsupported query frontend selection: ${builtins.toJSON (queryFrontends node)}";
|
|
snapshots =
|
|
node:
|
|
pkgs.writeText "qx-nix-source-graph.json" (
|
|
builtins.toJSON {
|
|
resources = map (node: {
|
|
inherit (node)
|
|
kind
|
|
repository
|
|
commit
|
|
directory
|
|
;
|
|
}) (builtins.filter (entry: entry.kind != "workspace") (resourceClosure true node));
|
|
}
|
|
);
|
|
# Each resource is checked once per exact source/closure/frontend/toolchain.
|
|
# Composition imports these compiler outputs; authoring receipts are never
|
|
# build inputs. Missing entries in ordinary CLI use take the full check path.
|
|
compiledNodes = builtins.mapAttrs (_: node: compileNode node) nodeTable;
|
|
compile = node: compiledNodes.${sourceKey node};
|
|
checkedResources =
|
|
node:
|
|
pkgs.writeText "qx-checked-resources.json" (
|
|
builtins.toJSON (
|
|
map
|
|
(dependency: {
|
|
inherit (dependency) kind repository commit;
|
|
artifact = compile dependency;
|
|
})
|
|
(
|
|
builtins.filter (
|
|
dependency:
|
|
dependency.kind != "workspace"
|
|
&& dependency.kind != "build"
|
|
&& sourceKey dependency != sourceKey node
|
|
) (resourceClosure true node)
|
|
)
|
|
)
|
|
);
|
|
compileNode =
|
|
node:
|
|
pkgs.runCommand "qx-${node.kind}-contract" { QUIXOS_TRACE_PROFILE = "1"; } ''
|
|
mkdir -p "$out"
|
|
${
|
|
if node.kind == "workspace" then
|
|
''
|
|
${protocol}/bin/quixos-workspace-compile --root ${node.directory} \
|
|
${queryGeneratorFlags root} \
|
|
--checked-resources ${checkedResources node} \
|
|
--source-root-commit ${pkgs.lib.escapeShellArg node.commit} \
|
|
${
|
|
pkgs.lib.optionalString (
|
|
workspaceId != null
|
|
) "--workspace-id ${pkgs.lib.escapeShellArg workspaceId}"
|
|
} \
|
|
--checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} \
|
|
--graph-out "$out/graph.json" --schemas-out "$out/package-schemas.json" \
|
|
${
|
|
pkgs.lib.optionalString (execution && kind == "workspace")
|
|
''--execution-plan-out "$out/execution-plan.json" --build-contexts-out "$out/build-contexts.json"''
|
|
} > "$out/candidate.json"
|
|
''
|
|
else
|
|
''
|
|
${protocol}/bin/quixos-resource-compile --root ${node.directory} \
|
|
${queryGeneratorFlags root} \
|
|
--checked-resources ${checkedResources node} \
|
|
--kind ${node.kind} --repository ${pkgs.lib.escapeShellArg node.repository} \
|
|
--commit ${pkgs.lib.escapeShellArg node.commit} \
|
|
--checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} --snapshot-only true \
|
|
--graph-out "$out/graph.json" --schema-out "$out/bindings.json" > "$out/candidate.json"
|
|
''
|
|
}
|
|
'';
|
|
contract = compile root;
|
|
# Parse shared workspace outputs once. Repeating fromJSON in every package
|
|
# makes composition quadratic in package count and in the serialized world.
|
|
workspacePackages = builtins.listToAttrs (
|
|
map
|
|
(pkg: {
|
|
name = sourceKey (pkg.source // { kind = "package"; });
|
|
value = pkg;
|
|
})
|
|
(builtins.fromJSON (builtins.readFile "${contract}/execution-plan.json"))
|
|
.definition.bindingSchema.packages
|
|
);
|
|
workspaceContexts = builtins.fromJSON (builtins.readFile "${contract}/build-contexts.json");
|
|
buildDependencies =
|
|
node:
|
|
builtins.listToAttrs (
|
|
map (dependency: {
|
|
name = dependency.binding;
|
|
value = {
|
|
src = dependency.directory;
|
|
source = { inherit (dependency) repository commit; };
|
|
flake = builtins.getFlake "git+${dependency.repository}?rev=${dependency.commit}&ref=refs/tags/quixos-reachability/${dependency.commit}";
|
|
};
|
|
}) (builtins.filter (dependency: dependency.kind == "build") node.children)
|
|
);
|
|
reactContracts =
|
|
node: moduleInterfaces:
|
|
let
|
|
interfaces = builtins.attrValues (
|
|
builtins.listToAttrs (
|
|
map (dependency: {
|
|
name = sourceKey dependency;
|
|
value = dependency;
|
|
}) (builtins.filter (dependency: dependency.kind == "interface") (capabilityFlatten node))
|
|
)
|
|
);
|
|
in
|
|
pkgs.lib.concatMap (
|
|
dependency:
|
|
if !builtins.pathExists (dependency.directory + "/flake.nix") then
|
|
[ ]
|
|
else
|
|
let
|
|
source = builtins.getFlake "git+${dependency.repository}?rev=${dependency.commit}&ref=refs/tags/quixos-reachability/${dependency.commit}";
|
|
build = source.quixosInterfaces.${system}.reactTypes or null;
|
|
in
|
|
if build == null then
|
|
[ ]
|
|
else if
|
|
!(builtins.any (
|
|
entry:
|
|
let
|
|
resource = builtins.fromJSON (builtins.readFile "${compile dependency}/candidate.json");
|
|
in
|
|
entry.revisionId == resource.revision.revisionId
|
|
|| (entry.definitionId or null) == resource.revision.revisionId
|
|
) moduleInterfaces)
|
|
then
|
|
[ ]
|
|
else
|
|
[
|
|
(build {
|
|
interface = "${compile dependency}/candidate.json";
|
|
generator = protocol;
|
|
typescript = runtimePackages.camino-replica-core.dependencies;
|
|
reactSdk = runtimePackages.camino-react;
|
|
dependencies = buildDependencies dependency;
|
|
})
|
|
]
|
|
) interfaces;
|
|
checkPackage =
|
|
node:
|
|
let
|
|
compiled = compile node;
|
|
candidate =
|
|
if execution && kind == "workspace" then
|
|
{
|
|
revision =
|
|
workspacePackages.${sourceKey node}
|
|
or (throw "Source package missing from workspace compilation: ${node.repository}");
|
|
}
|
|
else
|
|
builtins.fromJSON (builtins.readFile "${compiled}/candidate.json");
|
|
buildContext = import ./package-context.nix {
|
|
inherit pkgs protocol;
|
|
contexts = if kind == "workspace" then "${contract}/build-contexts.json" else null;
|
|
contextData =
|
|
if execution && kind == "workspace" then
|
|
workspaceContexts.${candidate.revision.revisionId}
|
|
else
|
|
null;
|
|
plan = "${compiled}/bindings.json";
|
|
packageRevisionId = candidate.revision.revisionId;
|
|
};
|
|
buildContract = builtins.fromJSON (builtins.readFile buildContext.buildContract);
|
|
componentEntries = if execution then buildContract.definition.package.components or [ ] else [ ];
|
|
package = builtins.getFlake (
|
|
"git+${node.repository}?rev=${node.commit}&ref=refs/tags/quixos-reachability/${node.commit}"
|
|
);
|
|
checked =
|
|
if execution then
|
|
package.quixosPackages.${system}.checkedArtifacts
|
|
or (throw "Package ${node.repository} lacks checkedArtifacts; execution workspaces cannot import legacy servers.")
|
|
else
|
|
package.quixosPackages.${system}.checkedServer
|
|
or (throw "Package ${node.repository} lacks checkedServer; use the supported package scaffold.");
|
|
artifact = checked (
|
|
if execution then
|
|
buildContext
|
|
// {
|
|
generator = protocol;
|
|
core = runtimePackages.camino-replica-core;
|
|
sharedRuntime = runtimePackages.camino-shared-runtime;
|
|
typescript = runtimePackages.camino-replica-core.dependencies;
|
|
packageRevisionId = candidate.revision.revisionId;
|
|
dependencies = buildDependencies node;
|
|
buildEnvironment = {
|
|
inherit pkgs system;
|
|
nixpkgsSource = toString pkgs.path;
|
|
narHash = "@nixpkgsNarHash@";
|
|
};
|
|
}
|
|
// pkgs.lib.optionalAttrs (componentEntries != [ ]) {
|
|
react = {
|
|
sdk = runtimePackages.camino-react;
|
|
runtime = runtimePackages.camino-react-runtime;
|
|
contracts = reactContracts node buildContract.definition.moduleInterfaces;
|
|
};
|
|
}
|
|
else
|
|
{
|
|
schema =
|
|
if kind == "workspace" then
|
|
pkgs.writeText "package-specialization-schema.json" (
|
|
builtins.toJSON
|
|
(builtins.fromJSON (builtins.readFile "${contract}/package-schemas.json"))
|
|
.${candidate.revision.revisionId}
|
|
)
|
|
else
|
|
"${compiled}/bindings.json";
|
|
generator = protocol;
|
|
packageRevisionId = candidate.revision.revisionId;
|
|
}
|
|
);
|
|
in
|
|
{
|
|
packageRevisionId = candidate.revision.revisionId;
|
|
artifactPath = artifact;
|
|
};
|
|
checks =
|
|
if contractOnly then
|
|
[ ]
|
|
else
|
|
map checkPackage (
|
|
builtins.filter
|
|
(node: node.kind == "package" && (kind == "workspace" || sourceKey node == sourceKey root))
|
|
(
|
|
builtins.attrValues (
|
|
builtins.listToAttrs (
|
|
map (node: {
|
|
name = sourceKey node;
|
|
value = node;
|
|
}) (capabilityFlatten root)
|
|
)
|
|
)
|
|
)
|
|
);
|
|
manifest = pkgs.writeText "qx-candidate-checks.json" (builtins.toJSON checks);
|
|
bindingOptions = pkgs.writeText "qx-typescript-options.json" (
|
|
builtins.toJSON (
|
|
(builtins.fromJSON (builtins.readFile "${root.directory}/quixos.check.json")).options or { }
|
|
)
|
|
);
|
|
in
|
|
assert
|
|
workspaceId == null
|
|
|| (
|
|
kind == "workspace"
|
|
&& builtins.isString workspaceId
|
|
&& builtins.match "[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}" workspaceId != null
|
|
);
|
|
pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate") { } ''
|
|
mkdir -p "$out"
|
|
cp ${
|
|
builtins.toFile "qx-candidate-source.json" (builtins.toJSON { inherit repository commit kind; })
|
|
} "$out/source.json"
|
|
cp ${contract}/candidate.json "$out/candidate.json"
|
|
cp ${contract}/graph.json "$out/graph.json"
|
|
cp ${manifest} "$out/checks.json"
|
|
${pkgs.lib.optionalString (execution && kind == "workspace") ''
|
|
${
|
|
if builtins.pathExists "${root.directory}/quixos.entry.json" then
|
|
''
|
|
cp ${root.directory}/quixos.entry.json "$out/entry.json"
|
|
''
|
|
else
|
|
''
|
|
echo null > "$out/entry.json"
|
|
''
|
|
}
|
|
cp ${contract}/execution-plan.json "$out/execution-plan.json"
|
|
${pkgs.lib.optionalString (!contractOnly) ''
|
|
${pkgs.nodejs_24}/bin/node ${./check-execution.mjs} \
|
|
${protocol}/libexec/quixos-protocol/execution-world.mjs \
|
|
"$out/execution-plan.json" "$out/checks.json" "$out"
|
|
mkdir -p "$out/bin"
|
|
cat > "$out/bin/run-isolated" <<EOF
|
|
#!${pkgs.runtimeShell}
|
|
exec ${runtimePackages.camino-isolated-workspace}/bin/camino-isolated-workspace "$out" "\$@"
|
|
EOF
|
|
chmod +x "$out/bin/run-isolated"
|
|
''}
|
|
''}
|
|
${pkgs.lib.optionalString (
|
|
kind != "workspace"
|
|
) ''cp ${contract}/bindings.json "$out/bindings.json"''}
|
|
${pkgs.lib.optionalString (execution && kind == "package" && !contractOnly) ''
|
|
${pkgs.nodejs_24}/bin/node ${./check-package.mjs} \
|
|
${protocol}/libexec/quixos-protocol/execution-world.mjs ${contract}/bindings.json \
|
|
"$out/checks.json" "$out"
|
|
''}
|
|
${pkgs.lib.optionalString (kind == "package" && !execution) ''
|
|
${protocol}/bin/quixos-codegen-ts ${contract}/bindings.json \
|
|
${pkgs.lib.escapeShellArg (builtins.fromJSON (builtins.readFile "${contract}/candidate.json")).revision.revisionId} \
|
|
"$out/bindings.ts" ${bindingOptions}
|
|
''}
|
|
''
|