v4.0.2-9 (experimental)

[github-actions[bot]]

⚠️ Experimental — not yet verified on hardware

This release is published untested on real machines. CI installs
it in a VM; a VM exposes no NPU, one graphics device and no firmware
quirks, so a VM install passing says very little about a laptop.
Real installs have failed where every check was green.

The flake route (nixos-rebuild against this repo, see the
README) is the mature one and is what to use on a machine you care
about. The ISO installer is the least mature part of the project
and it partitions the disk before it can fail.

If you install from this image, please say how it went on the
release discussion — success as much as failure. The experimental
label comes off a release only once someone has reported a
successful install on physical hardware.

These notes could not be derived. The tooling that
reads what changed between v4.0.2-8 and v4.0.2-9 refused
rather than report nothing; see this job's log.
The images below are unaffected.

Getting it

Omarchy 4.0.2, packaged for NixOS. Two images, and the difference
is what they carry.

nixarchy-v4.0.2-9.iso — 5.6G, carries the whole system closure. The install
copies rather than downloads and needs no network at all. Take this
one unless the download is what you mind.

GitHub will not accept a file that size, so it is split. Put it back
together and check it:

cat nixarchy-v4.0.2-9.iso.part-* > nixarchy-v4.0.2-9.iso
sha256sum -c --ignore-missing SHA256SUMS

nixarchy-v4.0.2-9-net.iso — 1.6G, downloads the desktop as it installs.
One file, no reassembly, and it needs a working network: its first
screen offers Wi-Fi if there is no cable.

sha256sum -c --ignore-missing SHA256SUMS

(--ignore-missing because one SHA256SUMS covers both images, and
nobody downloads both.)

Then write one to a USB stick and boot it. See
Fresh-machine install
for what happens next.

What's Changed

• Make the lock screen, the user services, and first run actually work by @olafkfreund in Make the lock screen, the user services, and first run actually work #3
• Let another desktop's input method win by @olafkfreund in Let another desktop's input method win #4
• Cut an option that did nothing and a factory with one product by @olafkfreund in Cut an option that did nothing and a factory with one product #5
• Tell the agent it is on NixOS, not Arch by @olafkfreund in Tell the agent it is on NixOS, not Arch #21
• omarchy reinstall does exist here, it just cannot finish by @olafkfreund in omarchy reinstall does exist here, it just cannot finish #22
• Relink agent skills on every rebuild, not once ever by @olafkfreund in Relink agent skills on every rebuild, not once ever #23
• Stop racing systemd-logind, and test the skill links by @olafkfreund in Stop racing systemd-logind, and test the skill links #24
• Web app keybindings opened the wrong browser, or none by @olafkfreund in Web app keybindings opened the wrong browser, or none #25
• Package the HEY CLI by @olafkfreund in Package the HEY CLI #26
• Doctor: say when the default browser cannot be changed from the menu by @olafkfreund in Doctor: say when the default browser cannot be changed from the menu #27
• The menu jsonc is the one file under ~/.config/omarchy you cannot edit by @olafkfreund in The menu jsonc is the one file under ~/.config/omarchy you cannot edit #28
• Package omawrite and omacalc by @olafkfreund in Package omawrite and omacalc #29
• Package omacut and ttfx by @olafkfreund in Package omacut and ttfx #30
• A rebuild does not update a running session, and now we say so by @olafkfreund in A rebuild does not update a running session, and now we say so #31
• Fail a hung job in half an hour, not six by @olafkfreund in Fail a hung job in half an hour, not six #33
• Disk Usage opened nothing, and LocalSend could not be reached by @olafkfreund in Disk Usage opened nothing, and LocalSend could not be reached #34
• Pin quickshell 0.3.1: 0.3.0's lock screen aborts on DPMS by @olafkfreund in Pin quickshell 0.3.1: 0.3.0's lock screen aborts on DPMS #36
• The doctor was looking for commands that do not exist by @olafkfreund in The doctor was looking for commands that do not exist #37
• ttfx is what the screensaver is made of, not an optional extra by @olafkfreund in ttfx is what the screensaver is made of, not an optional extra #38
• README: what changed, and what proves each of it by @olafkfreund in README: what changed, and what proves each of it #39
• A manual for the port, not a fork of Omarchy's by @olafkfreund in A manual for the port, not a fork of Omarchy's #40
• The manual looks like a manual now by @olafkfreund in The manual looks like a manual now #42
• Add nixarchy-pkg-add, and drive rebuilds through nh by @olafkfreund in Add nixarchy-pkg-add, and drive rebuilds through nh #43
• A wordmark, instead of the word by @olafkfreund in A wordmark, instead of the word #44
• The option index is not there to be found in a test VM by @olafkfreund in The option index is not there to be found in a test VM #52
• Answer "is it already installed" with the table, not with PATH by @olafkfreund in Answer "is it already installed" with the table, not with PATH #55
• The front page never mentioned you can search for anything by @olafkfreund in The front page never mentioned you can search for anything #54
• Omarchy's Neovim config, without taking anyone's editor away by @olafkfreund in Omarchy's Neovim config, without taking anyone's editor away #56
• Two names, and the commands say which is which by @olafkfreund in Two names, and the commands say which is which #58
• Allow unfree by default, behind an option that actually works by @olafkfreund in Allow unfree by default, behind an option that actually works #57
• One disk layout, declared once by @olafkfreund in One disk layout, declared once #59
• Separate the machine from the guest it was hiding in by @olafkfreund in Separate the machine from the guest it was hiding in #60
• The flake the installer writes, written once and correctly by @olafkfreund in The flake the installer writes, written once and correctly #61
• Ask, format, write the flake, install by @olafkfreund in Ask, format, write the flake, install #62
• Install without being asked by @olafkfreund in Install without being asked #63
• Make the installer actually install, and give it a VM to prove it in by @olafkfreund in Make the installer actually install, and give it a VM to prove it in #64
• An ISO that boots into an installer that looks like one by @olafkfreund in An ISO that boots into an installer that looks like one #65
• Say that the installer exists, and show it by @olafkfreund in Say that the installer exists, and show it #66
• Name the splash after the thing it is splashing by @olafkfreund in Name the splash after the thing it is splashing #67
• Show the install happening, not just its beginning and end by @olafkfreund in Show the install happening, not just its beginning and end #68
• The installer, screen by screen — and a floppy disk we were offering to format by @olafkfreund in The installer, screen by screen — and a floppy disk we were offering to format #71
• Bump pinned packages by @github-actions[bot] in Bump pinned packages #70
• Show what you do after the install finishes by @olafkfreund in Show what you do after the install finishes #72
• The installer copies the system instead of rebuilding it by @olafkfreund in The installer copies the system instead of rebuilding it #73
• Say when the machine is rebuilding by @olafkfreund in Say when the machine is rebuilding #74
• Let the skill guard know about the eight skills that landed by @olafkfreund in Let the skill guard know about the eight skills that landed #76
• An ISO that installs with no network by @olafkfreund in An ISO that installs with no network #77
• Fix checks.install, and measure the install by @olafkfreund in Fix checks.install, and measure the install #78
• The install does not need a network, and the README said it did by @olafkfreund in The install does not need a network, and the README said it did #79
• Run the checks that need a real machine on a real machine by @olafkfreund in Run the checks that need a real machine on a real machine #80
• A tag builds an ISO somebody can download by @olafkfreund in A tag builds an ISO somebody can download #81
• The nightly's first real run found three bugs, all mine by @olafkfreund in The nightly's first real run found three bugs, all mine #83
• The install check passed every time and never said so by @olafkfreund in The install check passed every time and never said so #84
• A second image that downloads the desktop instead of carrying it by @olafkfreund in A second image that downloads the desktop instead of carrying it #82
• A size budget that fails, rather than a number in a comment by @olafkfreund in A size budget that fails, rather than a number in a comment #85
• The installer owns the screen, from the first frame to the last by @olafkfreund in The installer owns the screen, from the first frame to the last #88
• Tell people they can download it by @olafkfreund in Tell people they can download it #86
• install-iso hangs the same way install did by @olafkfreund in install-iso hangs the same way install did #89
• A catalogue of services, and a check that it stays usable by @olafkfreund in A catalogue of services, and a check that it stays usable #97
• Bundled services, and the discipline that keeps them out of the way by @olafkfreund in Bundled services, and the discipline that keeps them out of the way #98
• Three files to edit, one line to import by @olafkfreund in Three files to edit, one line to import #99
• A release short enough to finish by @olafkfreund in A release short enough to finish #101
• Services you can pick, rather than a list you can read by @olafkfreund in Services you can pick, rather than a list you can read #100
• Tell people what the catalogue learned since they installed by @olafkfreund in Tell people what the catalogue learned since they installed #103
• Ollama the user already runs is theirs, not ours by @olafkfreund in Ollama the user already runs is theirs, not ours #104
• Every rebuild leaves the last one bootable, and nothing said so by @olafkfreund in Every rebuild leaves the last one bootable, and nothing said so #110
• A roadmap, and CI to stop it lying by @olafkfreund in A roadmap, and CI to stop it lying #113
• Snapshots for the half generations do not cover by @olafkfreund in Snapshots for the half generations do not cover #114
• A factory reset that says why it cannot, instead of failing by @olafkfreund in A factory reset that says why it cannot, instead of failing #115
• A release you can try again by @olafkfreund in A release you can try again #116
• Stop warning on every evaluation of the install check by @olafkfreund in Stop warning on every evaluation of the install check #117
• Flatpaks you can declare, and one decision about deleting by @olafkfreund in Flatpaks you can declare, and one decision about deleting #118
• Roadmap: many machines, one repo by @olafkfreund in Roadmap: many machines, one repo #128
• Two ISOs, two names by @olafkfreund in Two ISOs, two names #120
• A flatpak catalogue with a high bar and one entry by @olafkfreund in A flatpak catalogue with a high bar and one entry #119
• Flatpaks in the file, the menu and the tooling by @olafkfreund in Flatpaks in the file, the menu and the tooling #129
• Flathub in the picker, without giving up the offline index by @olafkfreund in Flathub in the picker, without giving up the offline index #130
• Roadmap: Flatpaks are done by @olafkfreund in Roadmap: Flatpaks are done #131
• The password hash leaves the repo by @olafkfreund in The password hash leaves the repo #132
• installer-vm: give its store a real disk by @olafkfreund in installer-vm: give its store a real disk #134
• The installer's interactive screens, and a check that draws them by @olafkfreund in The installer's interactive screens, and a check that draws them #135
• installer-vm: refuse to start when the disk images cannot fit by @olafkfreund in installer-vm: refuse to start when the disk images cannot fit #136
• A check that answers the installer's questions by @olafkfreund in A check that answers the installer's questions #137
• Run checks.installer-ui, and fail when a check is run by nothing by @olafkfreund in Run checks.installer-ui, and fail when a check is run by nothing #138
• Only trust a width from the terminal being drawn on by @olafkfreund in Only trust a width from the terminal being drawn on #140
• Machines are directories: hosts// in the generated flake by @olafkfreund in Machines are directories: hosts/<name>/ in the generated flake #141
• programs.nixarchy.fleet: machines pull their own updates by @olafkfreund in programs.nixarchy.fleet: machines pull their own updates #142
• The wizard check follows the machine into hosts/ by @olafkfreund in The wizard check follows the machine into hosts/ #143
• nixarchy-install --from --host by @olafkfreund in nixarchy-install --from <repo> --host <name> #145
• Answers from a URL, and an ISO that can be told where to look by @olafkfreund in Answers from a URL, and an ISO that can be told where to look #146
• Docs: many machines, one repo by @olafkfreund in Docs: many machines, one repo #147
• Roadmap: per-project developer environments by @olafkfreund in Roadmap: per-project developer environments #153
• Roadmap: remote desktop by @olafkfreund in Roadmap: remote desktop #160
• devenv in the catalogue: package, the hook in all three shells, the cache by @olafkfreund in devenv in the catalogue: package, the hook in all three shells, the cache #161
• checks.install gates pull requests by @olafkfreund in checks.install gates pull requests #162
• nixarchy dev init <preset>: a working project from one command by @olafkfreund in nixarchy dev init <preset>: a working project from one command #163
• Per-project environments, documented: what devenv promises and what it does not by @olafkfreund in Per-project environments, documented: what devenv promises and what it does not #167
• The coverage guard now asks whether a check gates pull requests by @olafkfreund in The coverage guard now asks whether a check gates pull requests #166
• The devenv skill: which rung an install request belongs on by @olafkfreund in The devenv skill: which rung an install request belongs on #165
• Roadmap: devenv is done, and there are eleven skills by @olafkfreund in Roadmap: devenv is done, and there are eleven skills #173
• hypr-rdp: the RDP daemon, pinned to v0.1.5 by @olafkfreund in hypr-rdp: the RDP daemon, pinned to v0.1.5 #177
• Nixarchy no longer offers to publish a configuration it did not write by @olafkfreund in Nixarchy no longer offers to publish a configuration it did not write #180
• Plymouth: draw the chrome instead of shipping Omarchy's by @olafkfreund in Plymouth: draw the chrome instead of shipping Omarchy's #176
• A configured snapper with nowhere to write now says so by @olafkfreund in A configured snapper with nowhere to write now says so #175
• The evening you spent on your bar, off the disk by @olafkfreund in The evening you spent on your bar, off the disk #179
• The contributor process, written down: CONTRIBUTING, AGENTS, templates, CODEOWNERS by @olafkfreund in The contributor process, written down: CONTRIBUTING, AGENTS, templates, CODEOWNERS #182
• The armed config repo goes stale: surface the drift, and a menu row to reach it by @olafkfreund in The armed config repo goes stale: surface the drift, and a menu row to reach it #181
• Free space install, alongside an existing OS (Free space install, alongside an existing OS #47) by @olafkfreund in Free space install, alongside an existing OS (#47) #174
• Secrets: adopt sops-nix, because the password must go inside the file by @olafkfreund in Secrets: adopt sops-nix, because the password must go inside the file #184
• feat(skills): add nixarchy-bbs, for talking to the other agents by @olafkfreund in feat(skills): add nixarchy-bbs, for talking to the other agents #185
• The doctor names a tmpfs /tmp too small for the closure, which nix reports as a full disk by @olafkfreund in The doctor names a tmpfs /tmp too small for the closure, which nix reports as a full disk #189
• The live image gets a boot splash, and both splashes are proved to be ours by @olafkfreund in The live image gets a boot splash, and both splashes are proved to be ours #192
• Remote desktop over RDP, and a daemon that refuses to start without a password by @olafkfreund in Remote desktop over RDP, and a daemon that refuses to start without a password #190
• Remove the nixarchy-bbs skill by @olafkfreund in Remove the nixarchy-bbs skill #193
• The install check reports on every pull request, so it can be required by @olafkfreund in The install check reports on every pull request, so it can be required #187
• A factory baseline, taken at install time, and a reset that returns to it by @olafkfreund in A factory baseline, taken at install time, and a reset that returns to it #191
• Roadmap: Epic: nixarchy installer - bare metal to desktop in five minutes #6 and Epic: getting back — snapshots, backup and restore #112 are done, and Epic: remote desktop for the Hyprland session (hypr-rdp) #159 is not 'not started' by @olafkfreund in Roadmap: #6 and #112 are done, and #159 is not 'not started' #194
• Something watches the watchers, and says so out loud by @olafkfreund in Something watches the watchers, and says so out loud #198
• The manual page about many machines is in the manual's sidebar by @olafkfreund in The manual page about many machines is in the manual's sidebar #196
• The boot splash animates, and its progress bar is on for every boot by @olafkfreund in The boot splash animates, and its progress bar is on for every boot #197
• Every action runs on a Node the runners still support by @olafkfreund in Every action runs on a Node the runners still support #199
• checks.install-iso passes, for the first time by @olafkfreund in checks.install-iso passes, for the first time #200
• Omarchy 4.0.2, whose new browser-policy helper needs root that NixOS does not give it by @olafkfreund in Omarchy 4.0.2, whose new browser-policy helper needs root that NixOS does not give it #201
• Screen sharing works, because the picker the seeded config names now exists by @olafkfreund in Screen sharing works, because the picker the seeded config names now exists #203
• verify.sh asks the questions whose failure is silence, and AGENTS.md gains the rule Screen sharing silently fails: xdph.conf names a share picker that is never installed #202 needed by @olafkfreund in verify.sh asks the questions whose failure is silence, and AGENTS.md gains the rule #202 needed #205
• The nightly Omarchy bump PR is a briefing, not a template by @olafkfreund in The nightly Omarchy bump PR is a briefing, not a template #206
• The install checks get a budget with room in it by @olafkfreund in The install checks get a budget with room in it #209
• The manual says what enabling remote desktop opens, and argues for the tailnet by @olafkfreund in The manual says what enabling remote desktop opens, and argues for the tailnet #211
• The screenshot editor, imv's Ctrl+E and clipboard image-open all open satty, which we were already shipping by @olafkfreund in The screenshot editor, imv's Ctrl+E and clipboard image-open all open satty, which we were already shipping #213
• A release now says what changed, and refuses when it cannot see by @olafkfreund in A release now says what changed, and refuses when it cannot see #207
• The RDP assertion says why it stopped you and points at the page for the rest by @olafkfreund in The RDP assertion says why it stopped you and points at the page for the rest #216
• A release opens a discussion, so the notes have somewhere to be answered by @olafkfreund in A release opens a discussion, so the notes have somewhere to be answered #219
• The Install-row rewrites move into the menu defaults, and the extension goes back to the user by @olafkfreund in The Install-row rewrites move into the menu defaults, and the extension goes back to the user #220
• The Roadmap lists the two epics that were filed tonight by @olafkfreund in The Roadmap lists the two epics that were filed tonight #233
• AGENTS.md says what the checks cost now, and puts the roadmap remedy where the mistake is made by @olafkfreund in AGENTS.md says what the checks cost now, and puts the roadmap remedy where the mistake is made #234
• A machine can say which nixarchy built it by @olafkfreund in A machine can say which nixarchy built it #212
• The manual's Tailscale example is one that evaluates, and a check keeps it that way by @olafkfreund in The manual's Tailscale example is one that evaluates, and a check keeps it that way #217
• The install check names the download that failed, instead of the ESP that never got made by @olafkfreund in The install check names the download that failed, instead of the ESP that never got made #237
• The generated flake carries the timestamp nix would have written into it by @olafkfreund in The generated flake carries the timestamp nix would have written into it #238
• A second install cannot write the store into the root subvolume by @olafkfreund in A second install cannot write the store into the root subvolume #245
• Crash reports go to the repository the rule names, not the one the command names by @olafkfreund in Crash reports go to the repository the rule names, not the one the command names #243
• A recovery passphrase, so a machine that will not mount is not a reinstall by @olafkfreund in A recovery passphrase, so a machine that will not mount is not a reinstall #247
• The install log lands on the disk, so a failed install still has something to read by @olafkfreund in The install log lands on the disk, so a failed install still has something to read #242
• The installer says when the live store cannot hold what it must fetch by @olafkfreund in The installer says when the live store cannot hold what it must fetch #250
• Answering No goes back to the questions instead of leaving a dead terminal by @olafkfreund in Answering No goes back to the questions instead of leaving a dead terminal #241
• The install job runs its two installs at once by @olafkfreund in The install job runs its two installs at once #232
• The install builds into the target store when the live one is too small by @olafkfreund in The install builds into the target store when the live one is too small #251
• verify.sh walks the merged menu and names the rows whose command is not there by @olafkfreund in verify.sh walks the merged menu and names the rows whose command is not there #253
• The menu-command guard covers nixarchy's own commands, in the menu the shell actually renders by @olafkfreund in The menu-command guard covers nixarchy's own commands, in the menu the shell actually renders #254
• A cache upload that fails does not redden a build that succeeded by @olafkfreund in A cache upload that fails does not redden a build that succeeded #264
• The microvm input, the catalogue, guest.nix and the shell template by @olafkfreund in The microvm input, the catalogue, guest.nix and the shell template #255
• Rootless podman and distrobox, gated behind programs.nixarchy.services.boxes by @olafkfreund in Rootless podman and distrobox, gated behind programs.nixarchy.services.boxes #265
• Declarative MicroVM sandboxes stay inert until a machine is declared by @olafkfreund in Declarative MicroVM sandboxes stay inert until a machine is declared #266
• The nightly asks whether anything is actually reaching the cache by @olafkfreund in The nightly asks whether anything is actually reaching the cache #267
• The store message is true on the network image, and quieter by @olafkfreund in The store message is true on the network image, and quieter #273
• free-space settles the filesystem it just made before mounting it by @olafkfreund in free-space settles the filesystem it just made before mounting it #276
• nixarchy vm, and a check that reads a runner without booting it by @olafkfreund in nixarchy vm, and a check that reads a runner without booting it #274
• programs.nixarchy.services.boxes.machines — the declarative half by @olafkfreund in programs.nixarchy.services.boxes.machines — the declarative half #275
• First-run can finish, so the welcome notification stops coming back by @olafkfreund in First-run can finish, so the welcome notification stops coming back #278
• The target-store build asks for a store that will accept what it hands over by @olafkfreund in The target-store build asks for a store that will accept what it hands over #282
• The doctor and verify are installed, so the commands that name them work by @olafkfreund in The doctor and verify are installed, so the commands that name them work #283
• The doctor reads the GPU and says what it needs by @olafkfreund in The doctor reads the GPU and says what it needs #284
• verify.sh notices a soft-blocked radio and says how to clear it by @olafkfreund in verify.sh notices a soft-blocked radio and says how to clear it #286
• The remaining three MicroVM templates: python, podman, persistent by @olafkfreund in The remaining three MicroVM templates: python, podman, persistent #287
• The sandboxes manual page, nav row, and README row by @olafkfreund in The sandboxes manual page, nav row, and README row #291
• nightly: stop archiving the ISO to a disk the runners will not write to by @olafkfreund in nightly: stop archiving the ISO to a disk the runners will not write to #285
• nixarchy box, and a check that reads a template without pulling it online by @olafkfreund in nixarchy box, and a check that reads a template without pulling it online #288
• The remaining templates: debian, and whatever else upstream's own examples justify by @olafkfreund in The remaining templates: debian, and whatever else upstream's own examples justify #289
• The trigger.box menu group by @olafkfreund in The trigger.box menu group #292
• checks.box-template pins the debian image it now has to check by @olafkfreund in checks.box-template pins the debian image it now has to check #295
• docs/manual/boxes.md, the nav row, and the README feature row by @olafkfreund in docs/manual/boxes.md, the nav row, and the README feature row #293
• Give outside agents a public room, and the setup to join it by @olafkfreund in Give outside agents a public room, and the setup to join it #269
• pkgs/verify.sh: the Boxes section by @olafkfreund in pkgs/verify.sh: the Boxes section #294
• The trigger.vm menu group: Sandboxes, under Trigger by @olafkfreund in The trigger.vm menu group: Sandboxes, under Trigger #290
• The hypr-rdp module records what to delete when upstream gains a password file by @olafkfreund in The hypr-rdp module records what to delete when upstream gains a password file #296
• MicroVM readiness and guests, in verify.sh -- what only real hardware can answer (What only real hardware can answer, in verify.sh #229) by @olafkfreund in MicroVM readiness and guests, in verify.sh -- what only real hardware can answer (#229) #297
• checks.box-boot creates and enters a real box offline, and the workflow wiring checks.box-boot, and the workflow changes it needs #262 proposes by @olafkfreund in checks.box-boot creates and enters a real box offline, and the workflow wiring #262 proposes #299
• The system job survives a substituter blip, at 45 minutes not 30 by @olafkfreund in The system job survives a substituter blip, at 45 minutes not 30 #301
• The network image proves the build can start before it wipes the disk by @olafkfreund in The network image proves the build can start before it wipes the disk #302
• The -tcg MicroVM runner can now boot on the hosts it exists for by @olafkfreund in The -tcg MicroVM runner can now boot on the hosts it exists for #304
• Restore the agent-bus kit that checks.box-boot creates and enters a real box offline, and the workflow wiring #262 proposes #299 deleted without saying so by @olafkfreund in Restore the agent-bus kit that #299 deleted without saying so #305
• checks.microvm-boot boots a declared MicroVM on the -tcg runner, and the workflow wiring Boot a MicroVM in CI, on GitHub's own runners #228 proposes by @olafkfreund in checks.microvm-boot boots a declared MicroVM on the -tcg runner, and the workflow wiring #228 proposes #298
• The crash path searches the agent room, and closes the loop without pasting by @olafkfreund in The crash path searches the agent room, and closes the loop without pasting #307
• The bus redaction rules gain a tripwire for the part a pattern can decide by @olafkfreund in The bus redaction rules gain a tripwire for the part a pattern can decide #303
• The box job has a body again, so build.yml starts at all by @olafkfreund in The box job has a body again, so build.yml starts at all #309
• hey-cli 1.4.0, as the nightly review asked by @olafkfreund in hey-cli 1.4.0, as the nightly review asked #306
• checks.installer-refusal: the The disk is wiped before the build is proven, so a network failure leaves no OS #300 guarantee on a real disk by @olafkfreund in checks.installer-refusal: the #300 guarantee on a real disk #308
• actionlint, so a dead CI gate cannot look like "checks pending" by @olafkfreund in actionlint, so a dead CI gate cannot look like "checks pending" #310
• The microvm boot check moves to the nightly, where its hardware lives by @olafkfreund in The microvm boot check moves to the nightly, where its hardware lives #313
• The two sandbox features, recorded from a running machine by @olafkfreund in The two sandbox features, recorded from a running machine #315
• checks.install-iso-net: the net image installs by fetching, proven by @olafkfreund in checks.install-iso-net: the net image installs by fetching, proven #311
• Both ISO installs, recorded from the checks that prove them by @olafkfreund in Both ISO installs, recorded from the checks that prove them #314
• The roadmap says sandboxes and boxes are done, because they are by @olafkfreund in The roadmap says sandboxes and boxes are done, because they are #319
• agent-bus-mcp as a flake output, and bus-peek.sh gains its test by @olafkfreund in agent-bus-mcp as a flake output, and bus-peek.sh gains its test #316
• The installer walkthrough, from a graphical VM instead of a serial console by @olafkfreund in The installer walkthrough, from a graphical VM instead of a serial console #318
• zen-browser past ffmpeg_7, so downstream flakes evaluate again by @olafkfreund in zen-browser past ffmpeg_7, so downstream flakes evaluate again #320
• The feature demos, shot on the desktop instead of down an ssh pipe by @olafkfreund in The feature demos, shot on the desktop instead of down an ssh pipe #321
• Encrypted installs pin the encrypted initrd modules, not the plain ones by @olafkfreund in Encrypted installs pin the encrypted initrd modules, not the plain ones #322
• zen-browser is pinned, and home-manager says why it is not by @olafkfreund in zen-browser is pinned, and home-manager says why it is not #324
• The coverage guard reads the checks it is guarding, and the two orphans it missed by @olafkfreund in The coverage guard reads the checks it is guarding, and the two orphans it missed #323
• Four error messages stop lying about why they failed by @olafkfreund in Four error messages stop lying about why they failed #325
• The agent room's opt-in is enforced at the connect moment by @olafkfreund in The agent room's opt-in is enforced at the connect moment #317
• The Omarchy bump waits for the checks it advertises, instead of steaming past them with --admin by @olafkfreund in The Omarchy bump waits for the checks it advertises, instead of steaming past them with --admin #327
• The nightly gains a canary that runs tomorrow's flake update, because the weekly cron never did by @olafkfreund in The nightly gains a canary that runs tomorrow's flake update, because the weekly cron never did #328
• Two probes that lied: the VM pin GitHub cannot fetch, and the Install row that never dims by @olafkfreund in Two probes that lied: the VM pin GitHub cannot fetch, and the Install row that never dims #329
• The pacman scan walks every bin and fails closed, instead of trusting seven names by @olafkfreund in The pacman scan walks every bin and fails closed, instead of trusting seven names #330
• A stalled install looks stalled: the bar freezes, then the dashboard says so by @olafkfreund in A stalled install looks stalled: the bar freezes, then the dashboard says so #331
• --from-repo has never run under a test, and now it has by @olafkfreund in --from-repo has never run under a test, and now it has #332
• Main keeps the verdict it paid for, instead of cancelling it by @olafkfreund in Main keeps the verdict it paid for, instead of cancelling it #333
• Nothing irreversible happens before the thing that can fail is proven by @olafkfreund in Nothing irreversible happens before the thing that can fail is proven #326
• The nixpkgs pin moves every night, and 17 apps move with it by @olafkfreund in The nixpkgs pin moves every night, and 17 apps move with it #335
• The four coding agents people actually asked for are installable by @olafkfreund in The four coding agents people actually asked for are installable #337
• checks.install-encrypted: the DEFAULT install path, booted and unlocked by @olafkfreund in checks.install-encrypted: the DEFAULT install path, booted and unlocked #339
• The offline box check stops pinning which of two loud failures wins by @olafkfreund in The offline box check stops pinning which of two loud failures wins #340
• The vendored bus server proves itself, and register.sh fails in sentences (agent bus: a public room outside agents can actually join #268) by @olafkfreund in The vendored bus server proves itself, and register.sh fails in sentences (#268) #342
• hey-cli 1.4.1, and the updater survives upstream's new SBOM files by @olafkfreund in hey-cli 1.4.1, and the updater survives upstream's new SBOM files #341
• .#update runs every updateScript that exists, not one named by hand by @olafkfreund in .#update runs every updateScript that exists, not one named by hand #343
• An installed machine can update itself by @olafkfreund in An installed machine can update itself #338
• Four more pins the nightly can move: updateScripts for the omacom apps by @olafkfreund in Four more pins the nightly can move: updateScripts for the omacom apps #344
• The demo learns to record one scene at a time, and to check its own work by @olafkfreund in The demo learns to record one scene at a time, and to check its own work #345
• The try front door: boot either ISO in a local VM, refusing in sentences by @olafkfreund in The try front door: boot either ISO in a local VM, refusing in sentences #346
• A release that promises a file it did not attach fails by @olafkfreund in A release that promises a file it did not attach fails #348
• What to delete when the hypr-rdp upstream work lands by @olafkfreund in What to delete when the hypr-rdp upstream work lands #350
• A box scene that runs Arch for real, and the microvm scene names its template by @olafkfreund in A box scene that runs Arch for real, and the microvm scene names its template #349
• The welcome notification is checked for not coming back, not just for being guarded by @olafkfreund in The welcome notification is checked for not coming back, not just for being guarded #351
• The doctor's no-VAAPI-driver branch could never fire, and its fixture agreed by @olafkfreund in The doctor's no-VAAPI-driver branch could never fire, and its fixture agreed #352
• Seven feature GIFs that show the feature, verified frame by frame by @olafkfreund in Seven feature GIFs that show the feature, verified frame by frame #353
• Demo GIFs on the pages that describe them, and an llms.txt by @olafkfreund in Demo GIFs on the pages that describe them, and an llms.txt #354
• CI honours the flake's own binary caches instead of discarding them by @olafkfreund in CI honours the flake's own binary caches instead of discarding them #358
• A registration token that can be revoked without a restart by @olafkfreund in A registration token that can be revoked without a restart #359
• A plugin that runs pacman fails the rebuild, not the click by @olafkfreund in A plugin that runs pacman fails the rebuild, not the click #360
• /etc/nixos belongs to the user, because both shipped commands need to write there by @olafkfreund in /etc/nixos belongs to the user, because both shipped commands need to write there #357
• The Roadmap gains Android and stops listing a finished epic by @olafkfreund in The Roadmap gains Android and stops listing a finished epic #365
• Resolve the installed user from /mnt/etc/passwd, not through chroot by @olafkfreund in Resolve the installed user from /mnt/etc/passwd, not through chroot #367
• Say plainly that the ISO installer is the least settled part by @olafkfreund in Say plainly that the ISO installer is the least settled part #371
• Move nixpkgs and nixarchy apart, because they already are by @olafkfreund in Move nixpkgs and nixarchy apart, because they already are #375
• The install dashboard survives a clock that goes backwards by @olafkfreund in The install dashboard survives a clock that goes backwards #373
• The reasoning moves to AGENTS.md, and Claude Code can finally read it by @olafkfreund in The reasoning moves to AGENTS.md, and Claude Code can finally read it #376
• nixpkgs: 20 app version(s) move by @olafkfreund in nixpkgs: 20 app version(s) move #369
• A front door for people who do not have nix yet by @olafkfreund in A front door for people who do not have nix yet #377
• release.yml refuses a tag that is behind main by @olafkfreund in release.yml refuses a tag that is behind main #379
• nixpkgs ships the quickshell that does not strand a locked machine by @olafkfreund in nixpkgs ships the quickshell that does not strand a locked machine #380
• The zen pin names a rev that works with the nixpkgs we ship by @olafkfreund in The zen pin names a rev that works with the nixpkgs we ship #381
• The offline image can fetch what it does not carry by @olafkfreund in The offline image can fetch what it does not carry #384
• Releases say they are experimental, in words a click cannot undo by @olafkfreund in Releases say they are experimental, in words a click cannot undo #385
• The installer image boots the way NixOS's own does by @olafkfreund in The installer image boots the way NixOS's own does #383
• The install matrix, and the username every check gets wrong by @olafkfreund in The install matrix, and the username every check gets wrong #387
• Every attribute generate-config can emit is one the image can satisfy by @olafkfreund in Every attribute generate-config can emit is one the image can satisfy #386
• Hyprland comes from nixpkgs, because nixpkgs caught up by @olafkfreund in Hyprland comes from nixpkgs, because nixpkgs caught up #389
• The newest kernel nixpkgs has, and an initrd pin that survives it moving by @olafkfreund in The newest kernel nixpkgs has, and an initrd pin that survives it moving #388
• OpenCode in the catalogue, and a default agent that reproduces by @olafkfreund in OpenCode in the catalogue, and a default agent that reproduces #390

New Contributors

• @olafkfreund made their first contribution in Make the lock screen, the user services, and first run actually work #3

Full Changelog: https://github.com/olafkfreund/nixarchy/commits/v4.0.2-9

---

This discussion was created from the release v4.0.2-9 (experimental).