alex/millerson-overlay.nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(beads): migrate issue tracking from bd to br
CI / check (push) Has been cancelled
Details

Browse Source 
Agents were told to run bd commands that beads_rust does not have (bd prime,
bd remember, bd dolt push, bd tag, bd note, bd children), and bd's git hooks
were still active, so bd could re-export its stale dolt state over br's
JSONL on commit.

- Rewrite AGENTS.md, docs/agents/issue-tracker.md, docs/agents/triage-labels.md
  and the .serena memories around br's real CLI surface
- Replace bd's generated AGENTS.md block with br's (br agents --add)
- Point the .claude session hooks at `br robot-docs guide`
- Remove bd git hooks and unset core.hooksPath; br installs no hooks
- Ignore br runtime files (local SQLite DB, recovery and merge artifacts)
- Rewrite .beads/README.md, config.yaml and metadata.json for br

Issue: nix-overlay-6pp
This commit is contained in:
Alexander Miroshnichenko
2026-10-21 18:47:16 +03:00
parent eefef7cce2
commit 722d608491
18 changed files with 217 additions and 372 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.beads/.gitignore
+17 -2
View File
@@ -1,7 +1,22 @@
# Dolt database (managed by Dolt, not git)
dolt/
# Database (local only, not git)
# br migrated the bd dolt database to a local SQLite file that kept the name "dolt"
dolt*
embeddeddolt/
# br (beads_rust) runtime artifacts
.br_recovery/
.br_history/
.br-wal-index-*/
# br merge artifacts (temporary files from 3-way merge)
beads.base.jsonl
beads.base.meta.json
beads.left.jsonl
beads.left.meta.json
beads.right.jsonl
beads.right.meta.json
sync_base.jsonl
# Runtime files
bd.sock
bd.sock.startlock
.beads/README.md
+18 -70
View File
@@ -1,81 +1,29 @@
# Beads - AI-Native Issue Tracking
Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
This repository uses [beads_rust](https://github.com/Dicklesworthstone/beads_rust) (`br`) for issue tracking. Issues live next to the code in `.beads/`, so no web UI is needed.
## What is Beads?
## Where the state lives
Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
- `.beads/issues.jsonl` — the versioned source of truth. It is committed to git, so issue state travels with `git push`.
- `.beads/dolt` — the local SQLite database used by `br` (runtime only, not versioned).
- `.beads/config.yaml` — project settings.
**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
`br` never runs git commands. After `br sync --flush-only` you must run `git add .beads/ && git commit` yourself.
## Quick Start
### Essential Commands
## Essential commands
```bash
# Create new issues
bd create "Add user authentication"
# View all issues
bd list
# View issue details
bd show <issue-id>
# Update issue status
bd update <issue-id> --claim
bd update <issue-id> --status done
# Sync with Dolt remote
bd dolt push
br robot-docs guide # session context and command reference (run first)
br ready # unblocked, non-deferred issues
br list # all issues
br show <issue-id> # issue detail
br create "Title" # create an issue
br update <id> --claim # claim work before starting
br close <id> # close an issue
br sync --flush-only # export the database to issues.jsonl
```
### Working with Issues
## Learn more
Issues in Beads are:
- **Git-native**: Stored in Dolt database with version control and branching
- **AI-friendly**: CLI-first design works perfectly with AI coding agents
- **Branch-aware**: Issues can follow your branch workflow
- **Always in sync**: Auto-syncs with your commits
## Why Beads?
✨ **AI-Native Design**
- Built specifically for AI-assisted development workflows
- CLI-first interface works seamlessly with AI coding agents
- No context switching to web UIs
🚀 **Developer Focused**
- Issues live in your repo, right next to your code
- Works offline, syncs when you push
- Fast, lightweight, and stays out of your way
🔧 **Git Integration**
- Automatic sync with git commits
- Branch-aware issue tracking
- Dolt-native three-way merge resolution
## Get Started with Beads
Try Beads in your own projects:
```bash
# Install Beads
curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
# Initialize in your repo
bd init
# Create your first issue
bd create "Try out Beads"
```
## Learn More
- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
- **Quick Start Guide**: Run `bd quickstart`
- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
---
*Beads: Issue tracking that moves at the speed of thought* ⚡
- **Repository**: https://github.com/Dicklesworthstone/beads_rust
- **Agent guide**: `br robot-docs guide`
.beads/config.yaml
+7 -55
View File
@@ -1,56 +1,8 @@
# Beads Configuration File
# This file configures default behavior for all bd commands in this repository
# All settings can also be set via environment variables (BD_* prefix)
# or overridden with command-line flags
# Beads Project Configuration
# issue_prefix: nix-overlay
# default_priority: 2
# default_type: task
# Issue prefix for this repository (used by bd init)
# If not set, bd init will auto-detect from directory name
# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
# issue-prefix: ""
# Use no-db mode: JSONL-only, no Dolt database
# When true, bd will use .beads/issues.jsonl as the source of truth
# no-db: false
# Enable JSON output by default
# json: false
# Feedback title formatting for mutating commands (create/update/close/dep/edit)
# 0 = hide titles, N > 0 = truncate to N characters
# output:
# title-length: 255
# Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
# actor: ""
# Export events (audit trail) to .beads/events.jsonl on each flush/sync
# When enabled, new events are appended incrementally using a high-water mark.
# Use 'bd export --events' to trigger manually regardless of this setting.
# events-export: false
# Multi-repo configuration (experimental - bd-307)
# Allows hydrating from multiple repositories and routing writes to the correct database
# repos:
# primary: "." # Primary repo (where this database lives)
# additional: # Additional repos to hydrate from (read-only)
# - ~/beads-planning # Personal planning repo
# - ~/work-planning # Work planning repo
# JSONL backup (periodic export for off-machine recovery)
# Auto-enabled when a git remote exists. Override explicitly:
# backup:
# enabled: false # Disable auto-backup entirely
# interval: 15m # Minimum time between auto-exports
# git-push: false # Disable git push (export locally only)
# git-repo: "" # Separate git repo for backups (default: project repo)
# Integration settings (access with 'bd config get/set')
# These are stored in the database, not in this file:
# - jira.url
# - jira.project
# - linear.url
# - linear.api-key
# - github.org
# - github.repo
sync.remote: "git+ssh://git@git.millerson.name:22002/alex/millerson-overlay.nix.git"
# Remote for beads state. The JSONL export in .beads/issues.jsonl is committed
# to git, so `git push` is what carries issue state to the shared repository.
sync.remote: "git+ssh://git@git.millerson.name:22002/alex/millerson-overlay.nix.git"
.beads/hooks/post-checkout
-24
View File
@@ -1,24 +0,0 @@
#!/usr/bin/env sh
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
# This section is managed by beads. Do not remove these markers.
if command -v bd >/dev/null 2>&1; then
export BD_GIT_HOOK=1
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
if command -v timeout >/dev/null 2>&1; then
timeout "$_bd_timeout" bd hooks run post-checkout "$@"
_bd_exit=$?
if [ $_bd_exit -eq 124 ]; then
echo >&2 "beads: hook 'post-checkout' timed out after ${_bd_timeout}s — continuing without beads"
_bd_exit=0
fi
else
bd hooks run post-checkout "$@"
_bd_exit=$?
fi
if [ $_bd_exit -eq 3 ]; then
echo >&2 "beads: database not initialized — skipping hook 'post-checkout'"
_bd_exit=0
fi
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
fi
# --- END BEADS INTEGRATION v1.0.3 ---
.beads/hooks/post-merge
-24
View File
@@ -1,24 +0,0 @@
#!/usr/bin/env sh
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
# This section is managed by beads. Do not remove these markers.
if command -v bd >/dev/null 2>&1; then
export BD_GIT_HOOK=1
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
if command -v timeout >/dev/null 2>&1; then
timeout "$_bd_timeout" bd hooks run post-merge "$@"
_bd_exit=$?
if [ $_bd_exit -eq 124 ]; then
echo >&2 "beads: hook 'post-merge' timed out after ${_bd_timeout}s — continuing without beads"
_bd_exit=0
fi
else
bd hooks run post-merge "$@"
_bd_exit=$?
fi
if [ $_bd_exit -eq 3 ]; then
echo >&2 "beads: database not initialized — skipping hook 'post-merge'"
_bd_exit=0
fi
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
fi
# --- END BEADS INTEGRATION v1.0.3 ---
.beads/hooks/pre-commit
-24
View File
@@ -1,24 +0,0 @@
#!/usr/bin/env sh
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
# This section is managed by beads. Do not remove these markers.
if command -v bd >/dev/null 2>&1; then
export BD_GIT_HOOK=1
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
if command -v timeout >/dev/null 2>&1; then
timeout "$_bd_timeout" bd hooks run pre-commit "$@"
_bd_exit=$?
if [ $_bd_exit -eq 124 ]; then
echo >&2 "beads: hook 'pre-commit' timed out after ${_bd_timeout}s — continuing without beads"
_bd_exit=0
fi
else
bd hooks run pre-commit "$@"
_bd_exit=$?
fi
if [ $_bd_exit -eq 3 ]; then
echo >&2 "beads: database not initialized — skipping hook 'pre-commit'"
_bd_exit=0
fi
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
fi
# --- END BEADS INTEGRATION v1.0.3 ---
.beads/hooks/pre-push
-24
View File
@@ -1,24 +0,0 @@
#!/usr/bin/env sh
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
# This section is managed by beads. Do not remove these markers.
if command -v bd >/dev/null 2>&1; then
export BD_GIT_HOOK=1
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
if command -v timeout >/dev/null 2>&1; then
timeout "$_bd_timeout" bd hooks run pre-push "$@"
_bd_exit=$?
if [ $_bd_exit -eq 124 ]; then
echo >&2 "beads: hook 'pre-push' timed out after ${_bd_timeout}s — continuing without beads"
_bd_exit=0
fi
else
bd hooks run pre-push "$@"
_bd_exit=$?
fi
if [ $_bd_exit -eq 3 ]; then
echo >&2 "beads: database not initialized — skipping hook 'pre-push'"
_bd_exit=0
fi
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
fi
# --- END BEADS INTEGRATION v1.0.3 ---
.beads/hooks/prepare-commit-msg
-24
View File
@@ -1,24 +0,0 @@
#!/usr/bin/env sh
# --- BEGIN BEADS INTEGRATION v1.0.3 ---
# This section is managed by beads. Do not remove these markers.
if command -v bd >/dev/null 2>&1; then
export BD_GIT_HOOK=1
_bd_timeout=${BEADS_HOOK_TIMEOUT:-300}
if command -v timeout >/dev/null 2>&1; then
timeout "$_bd_timeout" bd hooks run prepare-commit-msg "$@"
_bd_exit=$?
if [ $_bd_exit -eq 124 ]; then
echo >&2 "beads: hook 'prepare-commit-msg' timed out after ${_bd_timeout}s — continuing without beads"
_bd_exit=0
fi
else
bd hooks run prepare-commit-msg "$@"
_bd_exit=$?
fi
if [ $_bd_exit -eq 3 ]; then
echo >&2 "beads: database not initialized — skipping hook 'prepare-commit-msg'"
_bd_exit=0
fi
if [ $_bd_exit -ne 0 ]; then exit $_bd_exit; fi
fi
# --- END BEADS INTEGRATION v1.0.3 ---
.beads/issues.jsonl
+28 -27
View File
@@ -1,30 +1,31 @@
{"_type":"issue","id":"nix-overlay-pdo","title":"codeaf: carried furrow is unpatched ELF, cannot run on NixOS","description":"The Agent-Field/furrow v0.1.0 release asset that codeaf embeds is a CGO/dynamic binary (INTERP /lib64/ld-linux-x86-64.so.2, NEEDED libc/libm/libgcc_s). codeaf writes it out to CODEAF_HOME/bin/furrow-0.1.0 and execs it; NixOS refuses: 'Could not start dynamically linked executable'. cmd/fetch re-hashes against internal/furrowbin/pin.json, so the artifact cannot be patchelf'd before it is staged. Fix: fetch the asset, autoPatchelfHook it in its own derivation, and point CODEAF_FURROW at it in a wrapper (internal/furrow lookBinary order is CODEAF_FURROW, embedded, PATH).","status":"in_progress","priority":1,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T07:11:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T07:11:43Z","started_at":"2026-10-07T07:11:43Z","lease_expires_at":"2026-10-07T07:16:43Z","heartbeat_at":"2026-10-07T07:11:43Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-5ml","title":"marmel: Landlock sandbox blocks every shell tool call on NixOS","description":"apply_landlock_linux() in src/harness/sandbox.rs allow-lists FHS paths only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var) plus /tmp, /var/tmp and a few HOME dirs. Landlock rules match inodes, not symlinked views, and on NixOS every executable resolves into /nix/store (/bin/sh -\u003e /nix/store/\u003chash\u003e-bash-interactive-5.3p9/bin/bash). pty.rs wraps every tool command in 'marmel --internal-sandbox-exec \u003ccwd\u003e \u003ccmd\u003e', so on NixOS the re-exec of sh is denied.\n\nEvidence, built binary /nix/store/inxx5baqmndi1g1a45zms1lwy75jzv3b-marmel-1.0.0/bin/marmel on laptop-x13 (landlock stacked in /sys/kernel/security/lsm):\n marmel --internal-sandbox-exec $(mktemp -d) 'echo hello \u003e /dev/null'\n Failed to exec shell in sandbox: Permission denied (os error 13) exit=1\n marmel --internal-sandbox-exec / 'echo SANDBOX-EXEC-OK'\n SANDBOX-EXEC-OK exit=0\nSecond run proves the ruleset is applied and /nix/store is the only blocker.\n\nCandidate fix: add \"/nix/store\" to the read-only-plus-execute list (one line, upstream src/harness/sandbox.rs ro_paths). Store paths are world-readable already, so the guard on ~/.ssh and other project dirs still holds because Landlock denies everything not allow-listed. Untested; would also fix test_internal_sandbox_cross_directory_rename in the Nix build (test_internal_sandbox_exec_dev_null_and_dns still needs /etc/resolv.conf, absent with no-network).\n\nPackage side already handled: packages/marmel skips both sandbox-exec tests (nix-overlay-ez7).","notes":"Re-checked at 3f238ff (2026-10-16): apply_landlock_linux() ro_paths in src/harness/sandbox.rs is still FHS-only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var + /tmp family), no /nix/store. Unpatched upstream. Both sandbox-exec tests still skipped in packages/marmel (nix-overlay-ez7).\nVerified real at 3f238ff (= upstream main HEAD, 2026-10-16). Repro on laptop-x13 (NixOS 26.05, kernel 6.18.55, landlock stacked): 'marmel --internal-sandbox-exec $(mktemp -d) echo hello' -\u003e 'Failed to exec shell in sandbox: Permission denied (os error 13)', exit 1. Control: same binary with workspace root /nix/store prints OK and runs 'git --version', so /nix/store is the only missing rule; MARMEL_DISABLE_SANDBOX=1 is the only upstream workaround and it drops Landlock entirely. No NixOS awareness anywhere in src/ (grep -i nixos src/ = 0 hits). No duplicate upstream issue (#13 is the CA-store one).\n\nTemporary downstream patch added: packages/marmel/landlock-nix-store.patch adds \"/nix/store\" to ro_paths (sandbox.rs:417). Verified on ./result: sandboxed exec works, git runs, workspace writes work, ~/.ssh still blocked, /root still blocked. Test skips: cross_directory_rename now runs and passes (lib suite 966 passed, 1 filtered out); dev_null_and_dns stays skipped because /etc/resolv.conf is absent in the no-network build sandbox, not because of Landlock.\n\nUpstream issue text drafted at /tmp/marmel-nixos-landlock-issue.md (not filed yet). Change staged, not committed.\nFiled upstream: https://github.com/Na1w/marmel/issues/14 (open, 2026-10-16, 'Landlock allow-list is FHS-only, so every sandboxed shell command fails on NixOS'). Drop packages/marmel/landlock-nix-store.patch and restore nothing else once upstream ships a store path in ro_paths; the cross_directory_rename skip is already gone.","status":"closed","priority":1,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T19:31:13Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:22:17Z","started_at":"2026-10-16T12:07:21Z","closed_at":"2026-10-16T13:20:05Z","close_reason":"Confirmed real at 3f238ff and fixed downstream: packages/marmel/landlock-nix-store.patch adds /nix/store to the Landlock ro_paths, committed as 51dd95c19c18. Verified on the built binary (sandboxed exec works, ~/.ssh and /root still denied) and in the build (966 lib tests pass, cross_directory_rename skip removed). Upstream issue text drafted, not yet filed.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-dv3","title":"Fix Config screen crash on F2","description":"F2 opens ConfigScreen then Textual raises InvalidSelectValueError because _refresh_aggregator_dropdown assigns Select.BLANK, resolved as False, instead of clearing selection.\\n\\nAcceptance: Config screen opens with saved consensus configuration; regression covers no selected aggregator; targeted tests pass.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:34:03Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:37:47Z","started_at":"2026-08-20T11:34:07Z","closed_at":"2026-08-20T11:37:47Z","close_reason":"Replaced invalid Select.BLANK handling; built haivemind and verified ConfigScreen headlessly.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-a9m","title":"Fix haivemind startup after MainScreen mount","description":"Restore deferred engine startup while preserving MainScreen widget lookup fix.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:20:36Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:21:43Z","started_at":"2026-08-20T11:20:43Z","closed_at":"2026-08-20T11:21:43Z","close_reason":"Restored engine startup after MainScreen mount and verified package build.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-51o","title":"marmel: bump 3f238ff -\u003e 981b35b (main)","description":"Update packages/marmel to latest upstream main commit 981b35b0d356e56de429ab4198e427ccfbe7d85f. Verify src hash, cargoHash, whether patches (landlock-nix-store.patch #14, session-boot-trust-store.patch) still apply / whether follow-ups nix-overlay-pnb / nix-overlay-nn2 can close, and whether the sandbox test skip is still needed.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-18T11:25:08Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-18T11:53:11Z","started_at":"2026-10-18T11:25:13Z","closed_at":"2026-10-18T11:53:11Z","close_reason":"Bumped packages/marmel to 981b35b (main), hash regenerated, full build+tests green (1030+ tests).","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-2fk","title":"marmel: bump d6627d7 (1.0.0) -\u003e 3f238ff (main)","description":"Update packages/marmel to the latest upstream main commit 3f238ff217ee2e1033c937c840bd2d33ec57abc4 (feat: add per-role reasoning_effort configuration, #12). Verify src/hash, cargoHash, and whether the Landlock ro_paths fix landed (see nix-overlay-5ml) so the cargoTestFlags skips can be dropped or kept.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-16T09:30:54Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T10:25:09Z","started_at":"2026-10-16T09:30:59Z","closed_at":"2026-10-16T10:25:09Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-du9","title":"Add kyojin package (Yamz-Labs/kyojin, ExLlamaV3 fork for Strix Halo)","description":"Package https://github.com/Yamz-Labs/kyojin: Yamz inference engine, a fork of ExLlamaV3 targeting AMD Strix Halo (gfx1151) on ROCm 7. Build the python package with the ROCm build of torch from nixpkgs and compile the HIP extension for gfx1151.","notes":"re-pinned to release tag v1.3 (latest GitHub release; v1.1 was stale), version = \"1.3\", updateScript uses tags; rebuilt from v1.3 sources, wrappers --help verified","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T08:44:23Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T15:14:30Z","started_at":"2026-10-07T08:49:12Z","closed_at":"2026-10-07T15:14:30Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-bju","title":"codeaf: build furrow from source instead of embedding the upstream release binary","description":"The codeaf package embeds the upstream Agent-Field/furrow release asset (fetchurl -\u003e cmd/fetch -from -\u003e go:embed). Those bytes are glibc-dynamic and never patched, so the copy codeaf extracts to ~/.codeaf/bin/furrow-0.1.0 dies on NixOS with 'Could not start dynamically linked executable ... stub-ld'. Build furrow (Rust, Apache-2.0, same version as internal/furrowbin/pin.json) from source in this overlay and hand it to codeaf through CODEAF_FURROW, which internal/furrow lookBinary prefers over the embedded copy.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T07:44:58Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T08:33:54Z","started_at":"2026-10-07T07:45:20Z","closed_at":"2026-10-07T08:33:54Z","close_reason":"Shipped in ff1fecc0edc4: packages/codeaf/furrow.nix builds furrow 0.1.0 from source, codeaf wraps its binary with CODEAF_FURROW and no longer stages the upstream release asset.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ez7","title":"marmel: Landlock sandbox-exec tests fail in the Nix build sandbox","description":"Both harness::sandbox::tests::test_internal_sandbox_* tests re-exec sh through marmel --internal-sandbox-exec. Upstream apply_landlock_linux() allow-lists FHS paths only (/usr /bin /lib /opt /etc /var ...), never /nix/store, and PathFd() silently skips paths missing in the sandbox. Inside the Nix sandbox PATH points at /nix/store/-bash/bin and /nix/store/-coreutils/bin, so exec is denied: 'Failed to exec shell in sandbox: Permission denied (os error 13)'. Not a code defect: on a real NixOS host sh resolves through /bin -\u003e system path which the /bin rule covers.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T18:58:44Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T19:31:56Z","started_at":"2026-10-06T18:59:02Z","closed_at":"2026-10-06T19:31:56Z","close_reason":"Skipped both sandbox-exec tests in packages/marmel; nix build .#marmel green (342/344 run). Runtime defect split out to nix-overlay-5ml.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-m5y","title":"Add CodeAF package (Agent-Field/CodeAF)","description":"Add https://github.com/Agent-Field/CodeAF as a new package under packages/codeaf with default.nix + package.nix, staged for blueprint discovery, README table updated, nix build verified.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T18:07:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T18:46:34Z","started_at":"2026-10-06T18:08:19Z","closed_at":"2026-10-06T18:46:34Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-570","title":"radar: ensure package builds without error","description":"Verify nix build .#radar succeeds; fix any build failures.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T16:51:35Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T17:02:59Z","started_at":"2026-10-06T16:51:40Z","closed_at":"2026-10-06T17:02:59Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-olq","title":"graphify: v1.0.0 tag is a stale fork branch - verify PyPI before bumping","description":"Bumping graphify 0.9.61 -\u003e 1.0.0 (commit 6013b17) was a false upgrade. nix-update picks the highest semver tag, and Graphify-Labs/graphify has a v1.0.0 tag that is NOT newer than v0.9.77:\n\n- v1.0.0 = 0a31c086, authored 2026-04-05, its pyproject still says graphifyy 0.1.10\n- v0.9.77 = 5c7b8479, authored 2026-10-05, commit message 'release: 0.9.77'\n- GitHub compare v0.9.77...v1.0.0: diverged, ahead_by 28, behind_by 2126\n- PyPI graphifyy latest is 0.9.77; no 1.0.0 was ever published\n\nv1.0.0 is a six-month-old branch that was never released. Pin is back to v0.9.77 (built + CLI smoke-tested). Two dependency corrections were needed: upstream vendored MinHash into graphify/_minhash.py (datasketch is gone, and with it the pybloomfilter3 metadata workaround in default.nix) and added a direct numpy import, so numpy is now an explicit dep.\n\nWhat made 1.0.0 look unbuildable: its pyproject hard-requires graspologic, which pulls python-future, disabled in nixpkgs for Python \u003e= 3.13 (this flake is on 3.14). Do not chase it - v1.0.0 has no Leiden fallback (cluster.py imports graspologic.partition.leiden unconditionally), so it is worse than 0.9.x even if it built.\n\nGuard: check https://pypi.org/pypi/graphifyy/json before accepting any nix-update bump here.","status":"closed","priority":2,"issue_type":"bug","owner":"alex@millerson.name","created_at":"2026-10-06T16:36:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T16:50:10Z","closed_at":"2026-10-06T16:50:10Z","close_reason":"Pinned back to v0.9.77 in dcbde330e4c3; v1.0.0 confirmed to be a stale branch (2126 behind, never on PyPI). Guard noted in package.nix and bd remember.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-8wl","title":"marmel: bump to 1.0.0 (pin d6627d7c)","description":"Update packages/marmel to version 1.0.0, pinning upstream commit d6627d7cf3bf509d1e6db0d9d78736116e92e82a (the 1.0.0 release commit). Update src hash and cargoHash, verify build.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T15:44:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:34:44Z","started_at":"2026-10-06T15:45:40Z","closed_at":"2026-10-16T13:34:44Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-hcf","title":"Update all overlay packages to latest upstream versions","description":"Bump every package in packages/ to its latest upstream release/commit using nix-update, then verify each builds. Working tree already carries uncommitted bumps for 15 packages (awg-tool, ds4, freebuff, freetoken, g3, graphify, hipengine, kubernetes-mcp-server, llama-cpp, marmel, omniroute, open-code-review, radar, skillsmcp, traycer); remaining packages (aionui, container-use, desloppify, haivemind, loop, mcp-gateway, nftables-analyzer, nftablesbuilder, relay-free-llm, shardr, stakpak) still need checking.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T12:54:12Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T13:46:41Z","started_at":"2026-10-06T12:54:20Z","closed_at":"2026-10-06T13:46:41Z","close_reason":"All 26 packages checked: 16 committed in 6013b17aadbc; aionui/container-use/desloppify/loop/mcp-gateway/nftables-analyzer/nftablesbuilder/relay-free-llm/stakpak already current; 3 evaluation/version-string errors from nix-update repaired by hand. omniroute deferred to its own issue (stale npmDepsHash).","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-5p5","title":"Update versions of all packages in repo","description":"Run nix-update for every package in packages/ to bump to latest upstream versions, then verify builds.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T11:18:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T11:18:16Z","started_at":"2026-10-06T11:18:16Z","lease_expires_at":"2026-10-06T11:23:16Z","heartbeat_at":"2026-10-06T11:18:16Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-8y9","title":"Package opencode plugin as open-code-review passthru","description":"Expose plugins/open-code-review/opencode from the open-code-review source as passthru.opencode-plugin: single TS plugin file + node_modules built from the repo lockfile, installed under share/open-code-review/opencode","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-26T07:41:49Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-26T08:35:15Z","started_at":"2026-09-26T07:43:56Z","closed_at":"2026-09-26T08:35:15Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ylf","title":"Add open-code-review package","description":"Package alibaba/open-code-review (AI code review CLI, npm @alibaba-group/open-code-review) into the overlay","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-26T07:18:05Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-26T07:24:49Z","started_at":"2026-09-26T07:18:48Z","closed_at":"2026-09-26T07:24:49Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ikz","title":"Add g3 package (dhanji/g3)","description":"Package g3 AI coding agent from https://github.com/dhanji/g3 as rustPlatform.buildRustPackage. Pin commit (no tags), ship g3 + g3-studio binaries, category AI Coding Agents.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-23T10:59:57Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-23T11:54:07Z","started_at":"2026-09-23T11:00:30Z","closed_at":"2026-09-23T11:54:07Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-q2m","title":"Add FreeToken package (FlashML-org/FreeToken)","description":"Package https://github.com/FlashML-org/FreeToken into the overlay following the standard packages/\u0026lt;name\u0026gt;/{default.nix,package.nix} pattern. Must build via nix build, README updated, category set.","notes":"Build in progress. Resolved: tvm-ffi 0.1.13.post3 builds (cython 3.3.0 vendored, dontUsePytestCheck due to xdist addopts), flashlib wheel + pythonRemoveDeps, freetoken pythonRelaxDeps gguf/modelscope. Remaining: torch-bin CUDA closure (nccl done; libnvshmem source build ~hours), then freetoken extensions. Note: torch-bin 2.11 = +cu128 PyPI wheel autoPatchelf'd to nixpkgs cuda12.9 libs.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-30T06:40:20Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-30T17:51:10Z","started_at":"2026-08-30T06:40:34Z","closed_at":"2026-08-30T17:51:10Z","close_reason":"freetoken 0.1.2 packaged: builds via nix build .#freetoken, ft CLI verified (ft --version), imports checked, RPATHs correct (cudart 12.9 + torch-bin libs). Docs in README + meta.longDescription.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-q00","title":"Add haivemind package","description":"Package https://github.com/dev-boz/haivemind in the Nix overlay, document it, validate the build, and complete repository workflow.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-08T16:32:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-08T16:36:41Z","started_at":"2026-08-08T16:33:00Z","closed_at":"2026-08-08T16:36:41Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-67e","title":"Add traycer package","description":"Add new package for traycer from https://github.com/traycerai/traycer. Steps: research repo build system, create packages/traycer/, stage with git add, test nix build, update README.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T08:59:25Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T09:22:07Z","started_at":"2026-08-07T09:00:29Z","closed_at":"2026-08-07T09:22:07Z","close_reason":"Traycer package added, built, pushed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-2gf","title":"Update all packages to latest versions","description":"## Why\\nUser request: update every package in the overlay to its latest upstream version.\\n\\n## What\\nBump version + src hash (and cargoHash for Rust) in each packages/\u003cname\u003e/package.nix, update README table if needed, verify builds.\\n\\n## Acceptance\\n- Every package builds with nix build .#\u003cname\u003e\\n- README reflects new versions\\n- Changes committed and pushed","notes":"All packages updated and built successfully. Commit 1f3f0f468bdd on local main. PUSH BLOCKED: git.millerson.name:22002 and DoltHub unreachable from this network (SSH connect timeout). Re-run git push + bd dolt push when network is back, then close.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T07:22:50Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T13:17:34Z","started_at":"2026-08-07T07:22:55Z","closed_at":"2026-08-07T13:17:34Z","close_reason":"All packages updated to latest versions, verified building, pushed to origin","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-9xs","title":"Update all packages to latest versions","description":"Update every package in packages/ to its latest upstream version, refresh source hashes and cargoHashes, verify builds, update README.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T05:45:16Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T05:45:22Z","started_at":"2026-08-07T05:45:22Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-f8c","title":"Add nftablesbuilder package","description":"Package NftablesBuilder (github.com/AiseBouma/NftablesBuilder) web interface to manage nftables. Upstream source is incomplete (missing settings crate, no GUI build tooling, no Cargo.lock) so: patch in authored settings crate (schema from release artifacts), build Rust workspace from pinned commit, reuse built GUI assets from hash-pinned release tarball.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:58:22Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T05:38:40Z","started_at":"2026-08-07T04:58:25Z","closed_at":"2026-08-07T05:38:40Z","close_reason":"Package added, builds green, committed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-bjd","title":"Add nftables-analyzer CLI package","description":"Add python3Packages.buildPythonApplication derivation for reinaldosaraiva/nftables-analyzer (CLI only). Pin to main commit 5fc78d0c9ce173e3baa80a5655bcadb1b2f78493 (no tags upstream). sourceRoot=source/backend, hatchling build system. Category: Networking. Frontend excluded - upstream repo missing frontend/src/lib modules.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:48:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T04:50:25Z","started_at":"2026-08-07T04:48:10Z","closed_at":"2026-08-07T04:50:25Z","close_reason":"Package added, built, smoke-tested, committed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-pnb","title":"marmel: drop landlock-nix-store.patch once upstream allows /nix/store (Na1w/marmel#14)","description":"packages/marmel/landlock-nix-store.patch adds \"/nix/store\" to the read-only+execute allow-list (ro_paths, src/harness/sandbox.rs:417). Upstream allow-lists FHS paths only, and every executable on a Nix host resolves below the store, so the Landlock re-entry cannot exec `sh` and each shell tool call returns \"Failed to exec shell in sandbox: Permission denied (os error 13)\" with exit 1. Filed upstream as https://github.com/Na1w/marmel/issues/14 (open, 2026-10-16).\n\nWhen upstream takes a store path: bump the package, delete the patch, and check the sandbox tests in the build log. test_internal_sandbox_cross_directory_rename must still run (no SKIP line from integration_host) and pass; test_internal_sandbox_exec_dev_null_and_dns stays filtered for its own reason, the no-network build sandbox has no /etc/resolv.conf. Local history: nix-overlay-5ml (closed), fix commit 51dd95c19c18.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-10-16T13:23:24Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:23:24Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-nn2","title":"marmel: drop session-boot-trust-store.patch once upstream stops panicking on a missing CA store","description":"packages/marmel/session-boot-trust-store.patch forwards SSL_CERT_FILE into\nthe env_clear()d child in tests/test_session_boot.rs. It is a workaround,\nnot the fix: src/llm/client.rs default_http_client() calls unwrap_or_default()\non Result\u003cClient, reqwest::Error\u003e, and reqwest's Client::default() is\nClient::new(), which repeats the same build and .expect()s it, so the fallback\nalways panics. Reproduced independently of Nix on a stock busybox image with no\n/etc/ssl.\n\nUpstream issue filed 2026-10-16, still open:\nhttps://github.com/Na1w/marmel/issues/13\n(\"marmel panics at startup instead of reporting a missing CA trust store\")\n\nBlocked on upstream. Once upstream propagates the error instead of discarding\nit, drop the patch, bump marmel to the fixing commit, and rebuild.\n","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-10-16T11:32:29Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:27:05Z","external_ref":"https://github.com/Na1w/marmel/issues/13","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-1ah","title":"omniroute: bump 3.8.50 -\u003e 3.8.51 once npmDepsHash is recomputed","description":"Upstream v3.8.51 changes both package.json and package-lock.json, so the version bump needs a new npmDepsHash (and the src + npmTarball hashes, which are already computed: src sha256-ZYRjwynEw3cziFp8tM483QN96mDH0ZuHCFuhcJDwelA=, npm tgz sha256-QhaZ/do0vYW88DUlfojjWe3AM8AbhdVLakkhwc2k0u8=). Left at 3.8.50 because computing the hash requires running the npm-deps prefetch (build) and the host was low on disk (24G free, 95% used) and swap. Run: nix-update --flake --version=3.8.51 omniroute, which will recompute all three hashes in one pass.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-10-06T13:46:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T13:46:38Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-2fk","title":"marmel: bump d6627d7 (1.0.0) -\u003e 3f238ff (main)","description":"Update packages/marmel to the latest upstream main commit 3f238ff217ee2e1033c937c840bd2d33ec57abc4 (feat: add per-role reasoning_effort configuration, #12). Verify src/hash, cargoHash, and whether the Landlock ro_paths fix landed (see nix-overlay-5ml) so the cargoTestFlags skips can be dropped or kept.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-16T09:30:54Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T10:25:09Z","started_at":"2026-10-16T09:30:59Z","closed_at":"2026-10-16T10:25:09Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-2gf","title":"Update all packages to latest versions","description":"## Why\\nUser request: update every package in the overlay to its latest upstream version.\\n\\n## What\\nBump version + src hash (and cargoHash for Rust) in each packages/\u003cname\u003e/package.nix, update README table if needed, verify builds.\\n\\n## Acceptance\\n- Every package builds with nix build .#\u003cname\u003e\\n- README reflects new versions\\n- Changes committed and pushed","notes":"All packages updated and built successfully. Commit 1f3f0f468bdd on local main. PUSH BLOCKED: git.millerson.name:22002 and DoltHub unreachable from this network (SSH connect timeout). Re-run git push + bd dolt push when network is back, then close.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T07:22:50Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T13:17:34Z","started_at":"2026-08-07T07:22:55Z","closed_at":"2026-08-07T13:17:34Z","close_reason":"All packages updated to latest versions, verified building, pushed to origin","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-51o","title":"marmel: bump 3f238ff -\u003e 981b35b (main)","description":"Update packages/marmel to latest upstream main commit 981b35b0d356e56de429ab4198e427ccfbe7d85f. Verify src hash, cargoHash, whether patches (landlock-nix-store.patch #14, session-boot-trust-store.patch) still apply / whether follow-ups nix-overlay-pnb / nix-overlay-nn2 can close, and whether the sandbox test skip is still needed.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-18T11:25:08Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-18T11:53:11Z","started_at":"2026-10-18T11:25:13Z","closed_at":"2026-10-18T11:53:11Z","close_reason":"Bumped packages/marmel to 981b35b (main), hash regenerated, full build+tests green (1030+ tests).","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-570","title":"radar: ensure package builds without error","description":"Verify nix build .#radar succeeds; fix any build failures.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T16:51:35Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T17:02:59Z","started_at":"2026-10-06T16:51:40Z","closed_at":"2026-10-06T17:02:59Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-5gg","title":"freetoken: optional accel extras and kernel-cache wheel","description":"Follow-ups for the freetoken package: (1) package flashinfer[cu12] and sglang-kernel 0.4.5 (accel extra) so the native fast path is available instead of the Triton fallback; (2) package the freetoken-kernel-cache companion wheel (prebuilt TVM FFI kernels, built via scripts/build-release-wheels.sh) so TVM JIT kernel compilation (nvcc at runtime) can be avoided. Both blocked on suitable PyPI/CUDA packaging work in nixpkgs (flashinfer exists in nixpkgs but needs cu12 variant). Priority: backlog.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-08-30T17:58:57Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-30T17:58:57Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-5ml","title":"marmel: Landlock sandbox blocks every shell tool call on NixOS","description":"apply_landlock_linux() in src/harness/sandbox.rs allow-lists FHS paths only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var) plus /tmp, /var/tmp and a few HOME dirs. Landlock rules match inodes, not symlinked views, and on NixOS every executable resolves into /nix/store (/bin/sh -\u003e /nix/store/\u003chash\u003e-bash-interactive-5.3p9/bin/bash). pty.rs wraps every tool command in 'marmel --internal-sandbox-exec \u003ccwd\u003e \u003ccmd\u003e', so on NixOS the re-exec of sh is denied.\n\nEvidence, built binary /nix/store/inxx5baqmndi1g1a45zms1lwy75jzv3b-marmel-1.0.0/bin/marmel on laptop-x13 (landlock stacked in /sys/kernel/security/lsm):\n marmel --internal-sandbox-exec $(mktemp -d) 'echo hello \u003e /dev/null'\n Failed to exec shell in sandbox: Permission denied (os error 13) exit=1\n marmel --internal-sandbox-exec / 'echo SANDBOX-EXEC-OK'\n SANDBOX-EXEC-OK exit=0\nSecond run proves the ruleset is applied and /nix/store is the only blocker.\n\nCandidate fix: add \"/nix/store\" to the read-only-plus-execute list (one line, upstream src/harness/sandbox.rs ro_paths). Store paths are world-readable already, so the guard on ~/.ssh and other project dirs still holds because Landlock denies everything not allow-listed. Untested; would also fix test_internal_sandbox_cross_directory_rename in the Nix build (test_internal_sandbox_exec_dev_null_and_dns still needs /etc/resolv.conf, absent with no-network).\n\nPackage side already handled: packages/marmel skips both sandbox-exec tests (nix-overlay-ez7).","notes":"Re-checked at 3f238ff (2026-10-16): apply_landlock_linux() ro_paths in src/harness/sandbox.rs is still FHS-only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var + /tmp family), no /nix/store. Unpatched upstream. Both sandbox-exec tests still skipped in packages/marmel (nix-overlay-ez7).\nVerified real at 3f238ff (= upstream main HEAD, 2026-10-16). Repro on laptop-x13 (NixOS 26.05, kernel 6.18.55, landlock stacked): 'marmel --internal-sandbox-exec $(mktemp -d) echo hello' -\u003e 'Failed to exec shell in sandbox: Permission denied (os error 13)', exit 1. Control: same binary with workspace root /nix/store prints OK and runs 'git --version', so /nix/store is the only missing rule; MARMEL_DISABLE_SANDBOX=1 is the only upstream workaround and it drops Landlock entirely. No NixOS awareness anywhere in src/ (grep -i nixos src/ = 0 hits). No duplicate upstream issue (#13 is the CA-store one).\n\nTemporary downstream patch added: packages/marmel/landlock-nix-store.patch adds \"/nix/store\" to ro_paths (sandbox.rs:417). Verified on ./result: sandboxed exec works, git runs, workspace writes work, ~/.ssh still blocked, /root still blocked. Test skips: cross_directory_rename now runs and passes (lib suite 966 passed, 1 filtered out); dev_null_and_dns stays skipped because /etc/resolv.conf is absent in the no-network build sandbox, not because of Landlock.\n\nUpstream issue text drafted at /tmp/marmel-nixos-landlock-issue.md (not filed yet). Change staged, not committed.\nFiled upstream: https://github.com/Na1w/marmel/issues/14 (open, 2026-10-16, 'Landlock allow-list is FHS-only, so every sandboxed shell command fails on NixOS'). Drop packages/marmel/landlock-nix-store.patch and restore nothing else once upstream ships a store path in ro_paths; the cross_directory_rename skip is already gone.","status":"closed","priority":1,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T19:31:13Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:22:17Z","started_at":"2026-10-16T12:07:21Z","closed_at":"2026-10-16T13:20:05Z","close_reason":"Confirmed real at 3f238ff and fixed downstream: packages/marmel/landlock-nix-store.patch adds /nix/store to the Landlock ro_paths, committed as 51dd95c19c18. Verified on the built binary (sandboxed exec works, ~/.ssh and /root still denied) and in the build (966 lib tests pass, cross_directory_rename skip removed). Upstream issue text drafted, not yet filed.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-5p5","title":"Update versions of all packages in repo","description":"Run nix-update for every package in packages/ to bump to latest upstream versions, then verify builds.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T11:18:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T11:18:16Z","started_at":"2026-10-06T11:18:16Z","lease_expires_at":"2026-10-06T11:23:16Z","heartbeat_at":"2026-10-06T11:18:16Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-67e","title":"Add traycer package","description":"Add new package for traycer from https://github.com/traycerai/traycer. Steps: research repo build system, create packages/traycer/, stage with git add, test nix build, update README.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T08:59:25Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T09:22:07Z","started_at":"2026-08-07T09:00:29Z","closed_at":"2026-08-07T09:22:07Z","close_reason":"Traycer package added, built, pushed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"id":"nix-overlay-6pp","title":"Migrate issue tracking from bd (beads) to br (beads_rust)","status":"closed","priority":2,"issue_type":"task","assignee":"minder","created_at":"2026-10-21T15:46:41.935573511Z","created_by":"minder","updated_at":"2026-10-21T15:46:47.717419622Z","closed_at":"2026-10-21T15:46:47.716915059Z","close_reason":"Migrated AGENTS.md, docs/agents/*, .serena memories, .claude hooks, and .beads config/ignore from bd to br; removed bd git hooks; br verified in sync with .beads/issues.jsonl","source_repo":".","compaction_level":0,"original_size":0}
{"_type":"issue","id":"nix-overlay-8wl","title":"marmel: bump to 1.0.0 (pin d6627d7c)","description":"Update packages/marmel to version 1.0.0, pinning upstream commit d6627d7cf3bf509d1e6db0d9d78736116e92e82a (the 1.0.0 release commit). Update src hash and cargoHash, verify build.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T15:44:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:34:44Z","started_at":"2026-10-06T15:45:40Z","closed_at":"2026-10-16T13:34:44Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-8y9","title":"Package opencode plugin as open-code-review passthru","description":"Expose plugins/open-code-review/opencode from the open-code-review source as passthru.opencode-plugin: single TS plugin file + node_modules built from the repo lockfile, installed under share/open-code-review/opencode","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-26T07:41:49Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-26T08:35:15Z","started_at":"2026-09-26T07:43:56Z","closed_at":"2026-09-26T08:35:15Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-9xs","title":"Update all packages to latest versions","description":"Update every package in packages/ to its latest upstream version, refresh source hashes and cargoHashes, verify builds, update README.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T05:45:16Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T05:45:22Z","started_at":"2026-08-07T05:45:22Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-a9m","title":"Fix haivemind startup after MainScreen mount","description":"Restore deferred engine startup while preserving MainScreen widget lookup fix.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:20:36Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:21:43Z","started_at":"2026-08-20T11:20:43Z","closed_at":"2026-08-20T11:21:43Z","close_reason":"Restored engine startup after MainScreen mount and verified package build.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-bjd","title":"Add nftables-analyzer CLI package","description":"Add python3Packages.buildPythonApplication derivation for reinaldosaraiva/nftables-analyzer (CLI only). Pin to main commit 5fc78d0c9ce173e3baa80a5655bcadb1b2f78493 (no tags upstream). sourceRoot=source/backend, hatchling build system. Category: Networking. Frontend excluded - upstream repo missing frontend/src/lib modules.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:48:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T04:50:25Z","started_at":"2026-08-07T04:48:10Z","closed_at":"2026-08-07T04:50:25Z","close_reason":"Package added, built, smoke-tested, committed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-bju","title":"codeaf: build furrow from source instead of embedding the upstream release binary","description":"The codeaf package embeds the upstream Agent-Field/furrow release asset (fetchurl -\u003e cmd/fetch -from -\u003e go:embed). Those bytes are glibc-dynamic and never patched, so the copy codeaf extracts to ~/.codeaf/bin/furrow-0.1.0 dies on NixOS with 'Could not start dynamically linked executable ... stub-ld'. Build furrow (Rust, Apache-2.0, same version as internal/furrowbin/pin.json) from source in this overlay and hand it to codeaf through CODEAF_FURROW, which internal/furrow lookBinary prefers over the embedded copy.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T07:44:58Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T08:33:54Z","started_at":"2026-10-07T07:45:20Z","closed_at":"2026-10-07T08:33:54Z","close_reason":"Shipped in ff1fecc0edc4: packages/codeaf/furrow.nix builds furrow 0.1.0 from source, codeaf wraps its binary with CODEAF_FURROW and no longer stages the upstream release asset.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-du9","title":"Add kyojin package (Yamz-Labs/kyojin, ExLlamaV3 fork for Strix Halo)","description":"Package https://github.com/Yamz-Labs/kyojin: Yamz inference engine, a fork of ExLlamaV3 targeting AMD Strix Halo (gfx1151) on ROCm 7. Build the python package with the ROCm build of torch from nixpkgs and compile the HIP extension for gfx1151.","notes":"re-pinned to release tag v1.3 (latest GitHub release; v1.1 was stale), version = \"1.3\", updateScript uses tags; rebuilt from v1.3 sources, wrappers --help verified","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T08:44:23Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T15:14:30Z","started_at":"2026-10-07T08:49:12Z","closed_at":"2026-10-07T15:14:30Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-dv3","title":"Fix Config screen crash on F2","description":"F2 opens ConfigScreen then Textual raises InvalidSelectValueError because _refresh_aggregator_dropdown assigns Select.BLANK, resolved as False, instead of clearing selection.\\n\\nAcceptance: Config screen opens with saved consensus configuration; regression covers no selected aggregator; targeted tests pass.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:34:03Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:37:47Z","started_at":"2026-08-20T11:34:07Z","closed_at":"2026-08-20T11:37:47Z","close_reason":"Replaced invalid Select.BLANK handling; built haivemind and verified ConfigScreen headlessly.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ez7","title":"marmel: Landlock sandbox-exec tests fail in the Nix build sandbox","description":"Both harness::sandbox::tests::test_internal_sandbox_* tests re-exec sh through marmel --internal-sandbox-exec. Upstream apply_landlock_linux() allow-lists FHS paths only (/usr /bin /lib /opt /etc /var ...), never /nix/store, and PathFd() silently skips paths missing in the sandbox. Inside the Nix sandbox PATH points at /nix/store/-bash/bin and /nix/store/-coreutils/bin, so exec is denied: 'Failed to exec shell in sandbox: Permission denied (os error 13)'. Not a code defect: on a real NixOS host sh resolves through /bin -\u003e system path which the /bin rule covers.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T18:58:44Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T19:31:56Z","started_at":"2026-10-06T18:59:02Z","closed_at":"2026-10-06T19:31:56Z","close_reason":"Skipped both sandbox-exec tests in packages/marmel; nix build .#marmel green (342/344 run). Runtime defect split out to nix-overlay-5ml.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-f8c","title":"Add nftablesbuilder package","description":"Package NftablesBuilder (github.com/AiseBouma/NftablesBuilder) web interface to manage nftables. Upstream source is incomplete (missing settings crate, no GUI build tooling, no Cargo.lock) so: patch in authored settings crate (schema from release artifacts), build Rust workspace from pinned commit, reuse built GUI assets from hash-pinned release tarball.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T04:58:22Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T05:38:40Z","started_at":"2026-08-07T04:58:25Z","closed_at":"2026-08-07T05:38:40Z","close_reason":"Package added, builds green, committed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-hcf","title":"Update all overlay packages to latest upstream versions","description":"Bump every package in packages/ to its latest upstream release/commit using nix-update, then verify each builds. Working tree already carries uncommitted bumps for 15 packages (awg-tool, ds4, freebuff, freetoken, g3, graphify, hipengine, kubernetes-mcp-server, llama-cpp, marmel, omniroute, open-code-review, radar, skillsmcp, traycer); remaining packages (aionui, container-use, desloppify, haivemind, loop, mcp-gateway, nftables-analyzer, nftablesbuilder, relay-free-llm, shardr, stakpak) still need checking.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T12:54:12Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T13:46:41Z","started_at":"2026-10-06T12:54:20Z","closed_at":"2026-10-06T13:46:41Z","close_reason":"All 26 packages checked: 16 committed in 6013b17aadbc; aionui/container-use/desloppify/loop/mcp-gateway/nftables-analyzer/nftablesbuilder/relay-free-llm/stakpak already current; 3 evaluation/version-string errors from nix-update repaired by hand. omniroute deferred to its own issue (stale npmDepsHash).","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ikz","title":"Add g3 package (dhanji/g3)","description":"Package g3 AI coding agent from https://github.com/dhanji/g3 as rustPlatform.buildRustPackage. Pin commit (no tags), ship g3 + g3-studio binaries, category AI Coding Agents.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-23T10:59:57Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-23T11:54:07Z","started_at":"2026-09-23T11:00:30Z","closed_at":"2026-09-23T11:54:07Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-m5y","title":"Add CodeAF package (Agent-Field/CodeAF)","description":"Add https://github.com/Agent-Field/CodeAF as a new package under packages/codeaf with default.nix + package.nix, staged for blueprint discovery, README table updated, nix build verified.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T18:07:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T18:46:34Z","started_at":"2026-10-06T18:08:19Z","closed_at":"2026-10-06T18:46:34Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-nn2","title":"marmel: drop session-boot-trust-store.patch once upstream stops panicking on a missing CA store","description":"packages/marmel/session-boot-trust-store.patch forwards SSL_CERT_FILE into\nthe env_clear()d child in tests/test_session_boot.rs. It is a workaround,\nnot the fix: src/llm/client.rs default_http_client() calls unwrap_or_default()\non Result\u003cClient, reqwest::Error\u003e, and reqwest's Client::default() is\nClient::new(), which repeats the same build and .expect()s it, so the fallback\nalways panics. Reproduced independently of Nix on a stock busybox image with no\n/etc/ssl.\n\nUpstream issue filed 2026-10-16, still open:\nhttps://github.com/Na1w/marmel/issues/13\n(\"marmel panics at startup instead of reporting a missing CA trust store\")\n\nBlocked on upstream. Once upstream propagates the error instead of discarding\nit, drop the patch, bump marmel to the fixing commit, and rebuild.\n","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-10-16T11:32:29Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:27:05Z","external_ref":"https://github.com/Na1w/marmel/issues/13","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-olq","title":"graphify: v1.0.0 tag is a stale fork branch - verify PyPI before bumping","description":"Bumping graphify 0.9.61 -\u003e 1.0.0 (commit 6013b17) was a false upgrade. nix-update picks the highest semver tag, and Graphify-Labs/graphify has a v1.0.0 tag that is NOT newer than v0.9.77:\n\n- v1.0.0 = 0a31c086, authored 2026-04-05, its pyproject still says graphifyy 0.1.10\n- v0.9.77 = 5c7b8479, authored 2026-10-05, commit message 'release: 0.9.77'\n- GitHub compare v0.9.77...v1.0.0: diverged, ahead_by 28, behind_by 2126\n- PyPI graphifyy latest is 0.9.77; no 1.0.0 was ever published\n\nv1.0.0 is a six-month-old branch that was never released. Pin is back to v0.9.77 (built + CLI smoke-tested). Two dependency corrections were needed: upstream vendored MinHash into graphify/_minhash.py (datasketch is gone, and with it the pybloomfilter3 metadata workaround in default.nix) and added a direct numpy import, so numpy is now an explicit dep.\n\nWhat made 1.0.0 look unbuildable: its pyproject hard-requires graspologic, which pulls python-future, disabled in nixpkgs for Python \u003e= 3.13 (this flake is on 3.14). Do not chase it - v1.0.0 has no Leiden fallback (cluster.py imports graspologic.partition.leiden unconditionally), so it is worse than 0.9.x even if it built.\n\nGuard: check https://pypi.org/pypi/graphifyy/json before accepting any nix-update bump here.","status":"closed","priority":2,"issue_type":"bug","owner":"alex@millerson.name","created_at":"2026-10-06T16:36:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T16:50:10Z","closed_at":"2026-10-06T16:50:10Z","close_reason":"Pinned back to v0.9.77 in dcbde330e4c3; v1.0.0 confirmed to be a stale branch (2126 behind, never on PyPI). Guard noted in package.nix and bd remember.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-pdo","title":"codeaf: carried furrow is unpatched ELF, cannot run on NixOS","description":"The Agent-Field/furrow v0.1.0 release asset that codeaf embeds is a CGO/dynamic binary (INTERP /lib64/ld-linux-x86-64.so.2, NEEDED libc/libm/libgcc_s). codeaf writes it out to CODEAF_HOME/bin/furrow-0.1.0 and execs it; NixOS refuses: 'Could not start dynamically linked executable'. cmd/fetch re-hashes against internal/furrowbin/pin.json, so the artifact cannot be patchelf'd before it is staged. Fix: fetch the asset, autoPatchelfHook it in its own derivation, and point CODEAF_FURROW at it in a wrapper (internal/furrow lookBinary order is CODEAF_FURROW, embedded, PATH).","status":"in_progress","priority":1,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T07:11:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T07:11:43Z","started_at":"2026-10-07T07:11:43Z","lease_expires_at":"2026-10-07T07:16:43Z","heartbeat_at":"2026-10-07T07:11:43Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-pnb","title":"marmel: drop landlock-nix-store.patch once upstream allows /nix/store (Na1w/marmel#14)","description":"packages/marmel/landlock-nix-store.patch adds \"/nix/store\" to the read-only+execute allow-list (ro_paths, src/harness/sandbox.rs:417). Upstream allow-lists FHS paths only, and every executable on a Nix host resolves below the store, so the Landlock re-entry cannot exec `sh` and each shell tool call returns \"Failed to exec shell in sandbox: Permission denied (os error 13)\" with exit 1. Filed upstream as https://github.com/Na1w/marmel/issues/14 (open, 2026-10-16).\n\nWhen upstream takes a store path: bump the package, delete the patch, and check the sandbox tests in the build log. test_internal_sandbox_cross_directory_rename must still run (no SKIP line from integration_host) and pass; test_internal_sandbox_exec_dev_null_and_dns stays filtered for its own reason, the no-network build sandbox has no /etc/resolv.conf. Local history: nix-overlay-5ml (closed), fix commit 51dd95c19c18.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-10-16T13:23:24Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:23:24Z","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-q00","title":"Add haivemind package","description":"Package https://github.com/dev-boz/haivemind in the Nix overlay, document it, validate the build, and complete repository workflow.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-08T16:32:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-08T16:36:41Z","started_at":"2026-08-08T16:33:00Z","closed_at":"2026-08-08T16:36:41Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-q2m","title":"Add FreeToken package (FlashML-org/FreeToken)","description":"Package https://github.com/FlashML-org/FreeToken into the overlay following the standard packages/\u0026lt;name\u0026gt;/{default.nix,package.nix} pattern. Must build via nix build, README updated, category set.","notes":"Build in progress. Resolved: tvm-ffi 0.1.13.post3 builds (cython 3.3.0 vendored, dontUsePytestCheck due to xdist addopts), flashlib wheel + pythonRemoveDeps, freetoken pythonRelaxDeps gguf/modelscope. Remaining: torch-bin CUDA closure (nccl done; libnvshmem source build ~hours), then freetoken extensions. Note: torch-bin 2.11 = +cu128 PyPI wheel autoPatchelf'd to nixpkgs cuda12.9 libs.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-30T06:40:20Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-30T17:51:10Z","started_at":"2026-08-30T06:40:34Z","closed_at":"2026-08-30T17:51:10Z","close_reason":"freetoken 0.1.2 packaged: builds via nix build .#freetoken, ft CLI verified (ft --version), imports checked, RPATHs correct (cudart 12.9 + torch-bin libs). Docs in README + meta.longDescription.","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-vhq","title":"Note missing Dolt remote in AGENTS.md","description":"## Why\\nAgents running bd dolt push see 'No remote is configured - skipping' and may mistake it for a failure (blocking session close). Document that this is expected: no Dolt remote is set up, beads state is versioned locally in .beads/ and committed via git.\\n\\n## What\\nAdd a short note in the Beads Issue Tracker / Session Completion section of AGENTS.md.\\n\\n## Acceptance\\n- AGENTS.md explains the expected bd dolt push output and that git push is the actual sync mechanism","status":"closed","priority":3,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-07T13:18:33Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-07T13:19:26Z","started_at":"2026-08-07T13:18:51Z","closed_at":"2026-08-07T13:19:26Z","close_reason":"AGENTS.md updated and pushed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"nix-overlay-ylf","title":"Add open-code-review package","description":"Package alibaba/open-code-review (AI code review CLI, npm @alibaba-group/open-code-review) into the overlay","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-26T07:18:05Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-26T07:24:49Z","started_at":"2026-09-26T07:18:48Z","closed_at":"2026-09-26T07:24:49Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
.beads/metadata.json
+2 -5
View File
@@ -1,7 +1,4 @@
{
"database": "dolt",
"backend": "dolt",
"dolt_mode": "embedded",
"dolt_database": "nix_overlay",
"project_id": "bf9206b6-9430-479c-bc02-786cff5dbffc"
}
"jsonl_export": "issues.jsonl"
}
.claude/settings.json
+2 -2
View File
@@ -4,7 +4,7 @@
{
"hooks": [
{
"command": "bd prime",
"command": "br robot-docs guide",
"type": "command"
}
],
@@ -15,7 +15,7 @@
{
"hooks": [
{
"command": "bd prime",
"command": "br robot-docs guide",
"type": "command"
}
],
.gitignore
+1 -1
View File
@@ -6,7 +6,7 @@ result-*
.direnv/
.tasks/
# Beads / Dolt files (added by bd init)
# Beads runtime files (local only, not versioned)
.dolt/
*.db
.beads-credential-key
.serena/memories/core.md
+3 -3
View File
@@ -23,8 +23,8 @@ Repo: `git+https://git.millerson.name/alex/millerson-overlay.nix.git`
Runnable commands (build/format/update/bd/push): `mem:suggested_commands`. Exact done-checklist: `mem:task_completion`.
- ALL task tracking via `bd` (beads): `bd ready`, `bd update <id> --claim`, `bd close <id>`. NEVER TodoWrite/markdown TODOs.
- `bd prime` before starting work; `bd remember` for persistent knowledge (no MEMORY.md files).
- Session not complete until `git push` succeeds (`bd dolt push` skipping with "No remote is configured" is expected, not a failure).
- ALL task tracking via `br` (beads): `br ready`, `br update <id> --claim`, `br close <id>`. NEVER TodoWrite/markdown TODOs.
- `br robot-docs guide` before starting work; persistent knowledge goes into issue notes (`br update <id> --append-notes "..."`) instead of MEMORY.md files.
- Session not complete until `git push` succeeds. `br` never runs git: run `br sync --flush-only`, then `git add .beads/ && git commit` before the push.
- Commits use conventional-commit format.
- For nixpkgs/option lookups use the `nix` skill; for flake/devShell ops the `nix-flakes` skill; comms in caveman mode.
.serena/memories/suggested_commands.md
+5 -5
View File
@@ -19,14 +19,14 @@ All run from repo root (`nix-overlay/`).
- `nix-update skillsmcp --version=branch=main` — for commit-pinned pkgs; or `--commit <sha>`.
## Beads (mandatory task tracking)
- `bd prime` — session context, run before any work.
- `bd ready` / `bd show <id>` / `bd update <id> --claim` / `bd close <id>`.
- `bd remember` — persistent knowledge instead of MEMORY.md.
- `bd dolt push` — prints "No remote is configured — skipping." (expected; exit 0).
- `br robot-docs guide` — session context, run before any work.
- `br ready` / `br show <id>` / `br update <id> --claim` / `br close <id>`.
- `br update <id> --append-notes "..."` — persistent knowledge instead of MEMORY.md.
- `br sync --flush-only` — export issue state to `.beads/issues.jsonl`; runs no git commands.
## Session completion push
```
git pull --rebase && bd dolt push && git push
git pull --rebase && br sync --flush-only && git add .beads/ && git commit -m "sync beads" && git push
git status # must show "up to date with origin"
```
.serena/memories/task_completion.md
+2 -2
View File
@@ -7,5 +7,5 @@ Done when ALL of these pass/hold:
3. New package is staged (`git add packages/<name>/`) before build — blueprint index requirement.
4. README.md Available Packages table updated if package added/changed visibly.
5. Commit: conventional commit format (use conventional-commit / caveman-commit skill). No work left uncommitted.
6. Beads: work claimed via `bd update <id> --claim` before, `bd close <id>` after.
7. Pushed: `git pull --rebase && bd dolt push && git push` then `git status` shows "up to date with origin". `bd dolt push` skip message is expected, not a failure. Do not stop before push succeeds.
6. Beads: work claimed via `br update <id> --claim` before, `br close <id>` after.
7. Pushed: `git pull --rebase && br sync --flush-only && git add .beads/ && git commit -m "sync beads" && git push` then `git status` shows "up to date with origin". Do not stop before push succeeds.
AGENTS.md
+93 -45
View File
@@ -19,12 +19,12 @@ This is a **Nix flake overlay** repository that provides additional packages for
**MANDATORY** — Before writing code, running builds, or making any changes:
1. **Run `bd prime`** — Get full workflow context and available commands
2. **Check for existing issues** — Run `bd ready` to find available work
3. **Claim the task** — Use `bd update <id> --claim` before starting
4. **Track via `bd` ONLY** — NEVER use TodoWrite, TaskCreate, or markdown TODO lists. All task tracking goes through `bd`.
1. **Run `br robot-docs guide`** — Get full workflow context and available commands
2. **Check for existing issues** — Run `br ready` to find available work
3. **Claim the task** — Use `br update <id> --claim` before starting
4. **Track via `br` ONLY** — NEVER use TodoWrite, TaskCreate, or markdown TODO lists. All task tracking goes through `br`.
Violating this rule means the agent is working outside the project's workflow. Stop and re-claim via `bd` first.
Violating this rule means the agent is working outside the project's workflow. Stop and re-claim via `br` first.
### Required Skills
@@ -342,9 +342,9 @@ This skill provides:
```bash
# 0. Claim the task via beads (MANDATORY before any work)
bd ready # Find available work
bd show <id> # Review task details
bd update <id> --claim # Claim the task
br ready # Find available work
br show <id> # Review task details
br update <id> --claim # Claim the task
# 1. Create package directory
mkdir -p packages/my-tool
@@ -372,46 +372,28 @@ git add packages/my-tool README.md
# Then invoke: skill: "conventional-commit"
# 8. Close the task via beads
bd close <id> # Mark task as complete
br close <id> # Mark task as complete
br sync --flush-only # Export issue state to .beads/issues.jsonl
git add .beads/ # Stage the exported state
git commit -m "sync beads"
```
## Agent skills
### Issue tracker
Issues live in the beads database (`.beads/`, driven by the `bd` CLI), synced through `git push`. The Gitea remote is not the issue tracker. See `docs/agents/issue-tracker.md`.
Issues live in the beads database (`.beads/`, driven by the `br` CLI), synced through `git push`. The Gitea remote is not the issue tracker. See `docs/agents/issue-tracker.md`.
**Note:** `br` is non-invasive and never executes git commands. After `br sync --flush-only`, you must manually run `git add .beads/ && git commit`.
### Triage labels
The five canonical triage roles keep their default names, applied as `bd` labels. See `docs/agents/triage-labels.md`.
The five canonical triage roles keep their default names, applied as `br` labels. See `docs/agents/triage-labels.md`.
### Domain docs
Single-context layout: `CONTEXT.md` plus `docs/adr/` at the repo root. See `docs/agents/domain.md`.
<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
## Beads Issue Tracker
This project uses **bd (beads)** for issue tracking. Run `bd prime` to see full workflow context and commands.
### Quick Reference
```bash
bd prime # ALWAYS run first — get full context and command reference
bd ready # Find available work
bd show <id> # View issue details
bd update <id> --claim # Claim work (do this BEFORE starting any task)
bd close <id> # Complete work (do this AFTER pushing changes)
bd remember # Save persistent knowledge (use instead of MEMORY.md files)
```
### Rules
- **Use `bd` for ALL task tracking** — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
- **Run `bd prime` BEFORE starting any work** — this provides session context and close protocol
- **Run `bd remember` for persistent knowledge** — do NOT use MEMORY.md files
- **If you forgot to claim** — stop working and claim via `bd` immediately
## Session Completion
**When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
@@ -421,25 +403,91 @@ bd remember # Save persistent knowledge (use instead of MEMORY.md file
1. **File issues for remaining work** - Create issues for anything that needs follow-up
2. **Run quality gates** (if code changed) - Tests, linters, builds
3. **Update issue status** - Close finished work, update in-progress items
4. **PUSH TO REMOTE** - This is MANDATORY:
4. **Export and commit issue state** - `br` never runs git commands:
```bash
br sync --flush-only
git add .beads/
git commit -m "sync beads"
```
5. **PUSH TO REMOTE** - This is MANDATORY:
```bash
git pull --rebase
bd dolt push
git push
git status # MUST show "up to date with origin"
```
Note: no Dolt remote is configured for this workspace, so `bd dolt push`
prints `No remote is configured — skipping.` and exits. That is expected,
NOT a failure. Beads state is versioned locally in `.beads/` and synced to
the shared repository via `git push` — the `git status` check above is the
real completion gate.
5. **Clean up** - Clear stashes, prune remote branches
6. **Verify** - All changes committed AND pushed
7. **Hand off** - Provide context for next session
6. **Clean up** - Clear stashes, prune remote branches
7. **Verify** - All changes committed AND pushed
8. **Hand off** - Provide context for next session
**CRITICAL RULES:**
- Work is NOT complete until `git push` succeeds
- NEVER stop before pushing - that leaves work stranded locally
- NEVER say "ready to push when you are" - YOU must push
- If push fails, resolve and retry until it succeeds
<!-- END BEADS INTEGRATION -->
<!-- br-agent-instructions-v1 -->
---
## Beads Workflow Integration
This project uses [beads_rust](https://github.com/Dicklesworthstone/beads_rust) (`br`) for issue tracking. Issues are stored in `.beads/` and tracked in git.
### Essential Commands
```bash
# View ready issues (open, unblocked, not deferred)
br ready # Unblocked, non-deferred work
# List and search
br list --status=open # All open issues
br show <id> # Full issue details with dependencies
br search "keyword" # Full-text search
# Create and update
br create --title="..." --description="..." --type=task --priority=2
br update <id> --status=in_progress
br close <id> --reason="Completed"
br close <id1> <id2> # Close multiple issues at once
# Sync with git
br sync --flush-only # Export DB to JSONL
br sync --status # Check sync status
```
### Workflow Pattern
1. **Start**: Run `br ready` to find actionable work
2. **Claim**: Use `br update <id> --status=in_progress`
3. **Work**: Implement the task
4. **Complete**: Use `br close <id>`
5. **Sync**: Always run `br sync --flush-only` at session end
### Key Concepts
- **Dependencies**: Issues can block other issues. `br ready` shows only open, unblocked work.
- **Priority**: P0=critical, P1=high, P2=medium, P3=low, P4=backlog (use numbers 0-4, not words)
- **Types**: task, bug, feature, epic, chore, docs, question
- **Blocking**: `br dep add <issue> <depends-on>` to add dependencies
### Session Protocol
**Before ending any session, run this checklist:**
```bash
git status # Check what changed
br sync --flush-only # Export beads changes to JSONL
git add <files> .beads/ # Stage code changes and exported issue state
git commit -m "..." # Commit everything
git push # Push to remote
```
### Best Practices
- Check `br ready` at session start to find available work
- Update status as you work (in_progress → closed)
- Create new issues with `br create` when you discover tasks
- Use descriptive titles and set appropriate priority/type
- Always sync before ending session
<!-- end-br-agent-instructions -->
docs/agents/issue-tracker.md
+33 -28
View File
@@ -1,55 +1,58 @@
# Issue tracker: bd (beads)
# Issue tracker: br (beads_rust)
Issues and specs for this repo live in the beads database at `.beads/`. The source of truth is `.beads/issues.jsonl`, managed through the `bd` CLI (v1.3.0). beads state is versioned in the repo and synced with `git push`; there is no separate Dolt remote.
Issues and specs for this repo live in the beads database at `.beads/`. The source of truth is `.beads/issues.jsonl`, managed through the `br` CLI (v0.7.6). beads state is versioned in the repo and synced with `git push`; there is no separate Dolt remote.
**Note:** `br` is non-invasive and never executes git commands. After `br sync --flush-only`, you must manually run `git add .beads/ && git commit`.
The forge remote (`git.millerson.name`, self-hosted Gitea) is not the issue tracker. Do not open Gitea, GitHub, or GitLab issues for work in this repo.
## Core commands
```bash
bd ready # open issues with no active blockers
bd show <id> # full issue detail
bd list # list issues
bd search "<text>" # text search
bd create "title" -d "description" -p 2 -l label1,label2
bd q "quick capture" # create and print only the id
bd update <id> --claim # claim before starting work
bd close <id> --reason "..."
bd reopen <id>
bd comment <id> "..." # conversation history
bd note <id> "..." # append a note
bd tag <id> <label> # shorthand for: bd update <id> --add-label <label>
bd label add <id> <label>
bd label remove <id> <label>
bd status # database overview
br robot-docs guide # session context and command reference (run first)
br ready # open issues with no active blockers
br show <id> # full issue detail
br list # list issues
br search "<text>" # text search
br create "title" -d "description" -p 2 -l label1,label2
br q "quick capture" # create and print only the id
br update <id> --claim # claim before starting work
br close <id> --reason "..."
br reopen <id>
br comments add <id> "..." # conversation history
br update <id> --append-notes "..." # append to the issue notes field
br label add <id> <label>
br label remove <id> <label>
br label list <id>
br status # database overview
```
Issue ids look like `nix-overlay-4g1`. New work must be claimed with `bd update <id> --claim` before it starts.
Issue ids look like `nix-overlay-4g1`. New work must be claimed with `br update <id> --claim` before it starts.
## When a skill says "publish to the issue tracker"
Run `bd create`. Use one issue per ticket. Put the full body in `--description` (markdown is fine). Add labels per `triage-labels.md`. For a multi-part spec, create a parent issue and link children with `--deps`.
Run `br create`. Use one issue per ticket. Put the full body in `--description` (markdown is fine). Add labels per `triage-labels.md`. For a multi-part spec, create a parent issue and link children with `--deps`.
## When a skill says "fetch the relevant ticket"
Run `bd show <id>` and read the description plus comments (`bd show <id> --include-comments --json` when full comment bodies are needed). The user normally passes the issue id directly.
Run `br show <id>` and read the description. Use `br show <id> --json` for machine-readable output, and `br comments list <id>` for the comment thread. The user normally passes the issue id directly.
## Dependencies
`bd create --deps 'blocked-by:nix-overlay-4g1,discovered-from:nix-overlay-2a3'`
`br create --deps 'blocked-by:nix-overlay-4g1,discovered-from:nix-overlay-2a3'`
Bare ids, `depends-on:` and `blocked-by:` all make the new issue depend on the target. `blocks:` reverses the direction. `bd link`, `bd dep`, and `bd children` manage the graph after creation. `bd ready` already excludes anything with an unresolved blocker, so a ticket is unblocked when every issue that blocks it is closed.
Bare ids, `blocked-by:` and `discovered-from:` all make the new issue depend on the target. `depends-on:` is not a valid br dependency type and is rejected. `br dep add <issue> <depends-on>` adds a dependency after creation, `br dep list <issue>` shows the graph, and `br dep tree <issue>` shows it as a tree. `br ready` already excludes anything with an unresolved blocker, so a ticket is unblocked when every issue that blocks it is closed.
## Wayfinding operations
Used by `/wayfinder`. The map is a parent bead; the children are its sub-issues.
- **Map**: a bead created for the effort. Its description holds the Notes / Decisions-so-far / Fog body.
- **Child ticket**: a bead linked to the map with `--deps depends-on:<map-id>`. The question goes in the description. Record the ticket type as a label (`research`, `prototype`, `grilling`, `task`).
- **Child ticket**: a bead created with `--parent <map-id>`, which links it to the map as a parent-child dependency (br ids the child `<map-id>.1`). The question goes in the description. Record the ticket type as a label (`research`, `prototype`, `grilling`, `task`).
- **Blocking**: a `blocked-by:<id>` dependency on the blocking bead.
- **Frontier**: `bd ready` output, restricted to children of the map (`bd children <map-id> --ready` or filter `bd ready` by parent). Lowest priority number, then oldest, wins.
- **Claim**: `bd update <id> --claim` before any work starts.
- **Resolve**: append the answer with `bd note <id> "..."` or `bd comment`, then `bd close <id> --reason "<answer gist>"`, then add a context pointer (gist plus issue id) to the map's Decisions-so-far with `bd note <map-id> "..."`.
- **Frontier**: `br ready` output, restricted to children of the map (`br list --tree` groups children under their parent, or filter `br ready` by label). Lowest priority number, then oldest, wins.
- **Claim**: `br update <id> --claim` before any work starts.
- **Resolve**: append the answer with `br update <id> --append-notes "..."` or `br comments add <id> "..."`, then `br close <id> --reason "<answer gist>"`, then add a context pointer (gist plus issue id) to the map's Decisions-so-far with `br comments add <map-id> "..."`.
## Session end
@@ -57,7 +60,9 @@ Work is not complete until pushed. The project workflow requires:
```bash
git pull --rebase
bd dolt push # prints "No remote is configured - skipping." here; expected, not a failure
br sync --flush-only # export issue state to .beads/issues.jsonl
git add .beads/
git commit -m "sync beads"
git push
git status # must show up to date with origin
git status # must show up to date with origin
```
docs/agents/triage-labels.md
+6 -7
View File
@@ -14,17 +14,16 @@ When a skill mentions a role (for example "apply the AFK-ready triage label"), u
Edit the right-hand column to match whatever vocabulary you actually use.
## Applying labels with bd
## Applying labels with br
Labels are bd labels, not forge labels:
Labels are br labels, not forge labels:
```bash
bd tag <issue-id> ready-for-agent
bd label add <issue-id> needs-triage
bd label remove <issue-id> needs-triage
bd label list <issue-id>
br label add <issue-id> ready-for-agent
br label remove <issue-id> needs-triage
br label list <issue-id>
```
On creation: `bd create "title" -l ready-for-agent`.
On creation: `br create "title" -l ready-for-agent`.
A ticket has at most one triage role label. When a ticket moves to a new role, remove the old label and add the new one in the same step rather than stacking role labels.