docs(policy): state the hardened Nix ruling — flakes are removed, not tolerated - #557
Merged
Merged
Conversation
… tolerated
OWNER RULING 2026-07-28: "nix flakes are deprecated and to be thrown from the
estate, we are only doing guix now... you can get rid of them and references to
them now or opportunistically as you think is best."
The canon said "Guix primary; NO Nix mirror" (2026-05-18) but three places in
this repo still read as though a flake were merely discouraged. A consumer
following them would keep the flake and allowlist it. Fixed.
spec/LANGUAGE-POLICY.adoc §Package Management
Adds the HARDENED 2026-07-28 paragraph: Nix is REMOVED, not
deprecated-but-tolerated, and removal is a STANDING OPPORTUNISTIC instruction
— strip it whenever you are in a repo for any reason, including the references
(direnv `use flake`, `nix-shell` recipes, Dependabot's `nix` ecosystem,
package-manager detection, .gitignore/.gitattributes, docs), not just the file.
Also records the measured caveat: ~25% of the estate's guix.scm files are
scaffold stubs, wrong-project, or {{PROJECT_NAME}} placeholders, so the
PRESENCE of guix.scm is not evidence of packaging. Retire the mirror AND make
the Guix side real, or fill the sealed container.
scripts/check-package-policy.sh
The failure guidance said "Do NOT simply delete the flake", which now reads as
permission to keep it. Rewritten to lead with removal while KEEPING the real
engineering point that motivated it: do not leave the repo unpackaged — make
Guix real (or the Containerfile, which is Podman-verifiable where Guix is not
installable) IN THE SAME CHANGE. Explicitly rules out allowlisting the flake.
.github/workflows/governance-reusable.yml
Job renamed "Guix primary / Nix fallback policy" -> "Guix packaging policy
(Nix retired)"; step renamed to match. There is no Nix fallback tier any more
and the name was teaching the opposite of the rule.
RENAME SAFETY CHECKED, NOT ASSUMED: a job rename changes the check-run name, and
a ruleset requiring the old context would become a phantom required check that
never reports — blocking every merge (the known --admin trap). Queried the
rulesets on standards, trope-checker, hermeneia and hypatia: the only required
governance context is "governance / Validate Hypatia Baseline". Nothing requires
the Guix job. Safe.
VERIFIED by running the script both ways:
Nix-only repo, past the retirement date -> exit 1, new guidance printed
repo with guix.scm -> exit 0, "Guix ... detected (primary)"
`bash -n` clean; governance-reusable.yml still parses as YAML.
No behavioural change to the policy logic itself — the decision procedure,
grace-window variables and sealed-container detection are untouched. This
changes what the estate is TOLD, and one job label.
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedUpdates the language policy documentation and governance workflow to establish complete removal of Nix flakes in favor of Guix packaging. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
marked this pull request as ready for review
July 28, 2026 19:39
hyperpolymath
added a commit
that referenced
this pull request
Jul 29, 2026
§2.1 already rules Nix retired and rightly warns against mass-deletion. The owner ruling of 2026-07-28 — *"nix flakes are deprecated and to be thrown from the estate"* — is **reconciled with that warning rather than overriding it**: removal stays a per-repo judgement made while you are *already working in the repo*. Opportunistic, never a fan-out sweep. ## What was genuinely missing **Deleting `flake.nix` does not retire Nix.** Measured on `trope-checker` ([#47](hyperpolymath/trope-checker#47)), one flake had **ten satellites**: | file | what it kept alive | |---|---| | `.envrc` | a direnv `use flake` block | | `Justfile` + `contractiles/Justfile` | a `nix-shell` recipe | | `build/setup.sh` | `nix` in package-manager detection **and** the install switch | | `install-tools.sh` | a flake-detecting branch running **ahead of Guix** | | `.github/dependabot.yml` | a `nix` `package-ecosystem` entry | | `.gitignore` / `.gitattributes` | `flake.lock` and `*.nix` rules | | `compliance/reuse/dep5` | `flake.lock` in the lockfile glob | | docs / `PLAYBOOK.a2ml` | prose | Leave any behind and the toolchain still reaches for Nix. They're now listed in §2.1. ## Two traps recorded, because both cost time - **`dependabot.yml` rejects the whole file on one malformed entry** — re-parse after removing the `nix` ecosystem. - **A root `.githooks/` is usually load-bearing** (CI runs validators straight from it) — allowlist it in `root-allow.txt`; don't "tidy" it away in passing. Plus the standing caveat, restated where it will be read: a repo whose `guix.scm` is a scaffold stub has **no working packaging** once the flake is gone. Make Guix real, or fill the sealed container, *in the same change*. ## Flagged, not resolved — the canon disagrees with itself This repo carries **two** `LANGUAGE-POLICY.adoc` files and they contradict each other: - **`./LANGUAGE-POLICY.adoc`** (this one) self-declares canonical, is the more current — §2.2 records the squisher-corpus identity clobber measured 2026-07-29 across 418 repos — and makes **Bun tier 1**. - **`./rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc`** still lists **Deno** as *"Replaces Node/npm/Bun"*. PR #51 on trope-checker cites the first; the estate `CLAUDE.md` I was working under states the second. **I have not resolved this** — it needs an owner decision on which file is authoritative. Note the Nix hardening was also added to the *other* file earlier (standards #557), so both now carry it; the runtime-tier contradiction is untouched. Renders clean under `asciidoctor`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner ruling, 2026-07-28: "nix flakes are deprecated and to be thrown from the estate, we are only doing guix now… you can get rid of them and references to them now or opportunistically as you think is best."
The canon already said "Guix primary; NO Nix mirror" (2026-05-18), but three places in this repo still read as though a flake were merely discouraged — and one actively tells you to keep it. A maintainer following the current text would retain the flake and allowlist it. This fixes the words, not the logic.
What changed
spec/LANGUAGE-POLICY.adoc§Package Management — adds the hardened paragraph: Nix is removed, not deprecated-but-tolerated, and removal is a standing opportunistic instruction — strip it whenever you're in a repo for any reason, including the references (direnvuse flake,nix-shellrecipes, Dependabot'snixecosystem, package-manager detection branches,.gitignore/.gitattributes, docs), not just the file.It also records the measured caveat: ~25% of the estate's
guix.scmfiles are scaffold stubs, wrong-project, or{{PROJECT_NAME}}placeholders, so the presence ofguix.scmis not evidence of packaging.scripts/check-package-policy.sh— the failure guidance led with "Do NOT simply delete the flake", which now reads as permission to keep it. Rewritten to lead with removal while keeping the real engineering point that motivated it: don't leave the repo unpackaged — make Guix real (or fill theContainerfile, which is Podman-verifiable where Guix isn't installable) in the same change. Explicitly rules out allowlisting the flake..github/workflows/governance-reusable.yml— job renamedGuix primary / Nix fallback policy→Guix packaging policy (Nix retired). There is no Nix fallback tier any more and the name was teaching the opposite of the rule.Rename safety — checked, not assumed
A job rename changes the check-run name. A ruleset requiring the old context would become a phantom required check that never reports, blocking every merge — the known
--admintrap.I queried the rulesets on
standards,trope-checker,hermeneiaandhypatia: the only required governance context isgovernance / Validate Hypatia Baseline. Nothing requires the Guix job. Safe.Verified by running it
exit 1, new guidance printedguix.scmexit 0, "Guix … detected (primary)"bash -nclean;governance-reusable.ymlstill parses as YAML.No behavioural change to the policy logic — the decision procedure, grace-window variables and sealed-container detection are untouched. This changes what the estate is told, plus one job label.
Companion PR
trope-checker#47 is the worked example: flake removed, the fakeguix-nix-policy.ymldeleted, and ten config/script/doc references de-Nixed. Its root-shape gate went FAIL → PASS with 0 failing checks.Scope note
61 other repos still carry a root
flake.nixand 34 still carry the fakeguix-nix-policy.yml. Per the ruling those are to be handled opportunistically; this PR makes the policy say so.🤖 Generated with Claude Code