chore(beads): export marmel 981b35b bump task and stale 8wl state

Export carries the new nix-overlay-51o (closed) plus a stale
in_progress state for nix-overlay-8wl that the tracked JSONL never
picked up when the issue was actually closed.

.beads/issues.jsonl

@@ -2,6 +2,7 @@
 {"_type":"issue","id":"nix-overlay-5ml","title":"marmel: Landlock sandbox blocks every shell tool call on NixOS","description":"apply_landlock_linux() in src/harness/sandbox.rs allow-lists FHS paths only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var) plus /tmp, /var/tmp and a few HOME dirs. Landlock rules match inodes, not symlinked views, and on NixOS every executable resolves into /nix/store (/bin/sh -\u003e /nix/store/\u003chash\u003e-bash-interactive-5.3p9/bin/bash). pty.rs wraps every tool command in 'marmel --internal-sandbox-exec \u003ccwd\u003e \u003ccmd\u003e', so on NixOS the re-exec of sh is denied.\n\nEvidence, built binary /nix/store/inxx5baqmndi1g1a45zms1lwy75jzv3b-marmel-1.0.0/bin/marmel on laptop-x13 (landlock stacked in /sys/kernel/security/lsm):\n  marmel --internal-sandbox-exec $(mktemp -d) 'echo hello \u003e /dev/null'\n  Failed to exec shell in sandbox: Permission denied (os error 13)   exit=1\n  marmel --internal-sandbox-exec / 'echo SANDBOX-EXEC-OK'\n  SANDBOX-EXEC-OK                                                    exit=0\nSecond run proves the ruleset is applied and /nix/store is the only blocker.\n\nCandidate fix: add \"/nix/store\" to the read-only-plus-execute list (one line, upstream src/harness/sandbox.rs ro_paths). Store paths are world-readable already, so the guard on ~/.ssh and other project dirs still holds because Landlock denies everything not allow-listed. Untested; would also fix test_internal_sandbox_cross_directory_rename in the Nix build (test_internal_sandbox_exec_dev_null_and_dns still needs /etc/resolv.conf, absent with no-network).\n\nPackage side already handled: packages/marmel skips both sandbox-exec tests (nix-overlay-ez7).","notes":"Re-checked at 3f238ff (2026-10-16): apply_landlock_linux() ro_paths in src/harness/sandbox.rs is still FHS-only (/usr /bin /lib /lib64 /opt /etc /dev /proc /sys /run /var + /tmp family), no /nix/store. Unpatched upstream. Both sandbox-exec tests still skipped in packages/marmel (nix-overlay-ez7).\nVerified real at 3f238ff (= upstream main HEAD, 2026-10-16). Repro on laptop-x13 (NixOS 26.05, kernel 6.18.55, landlock stacked): 'marmel --internal-sandbox-exec $(mktemp -d) echo hello' -\u003e 'Failed to exec shell in sandbox: Permission denied (os error 13)', exit 1. Control: same binary with workspace root /nix/store prints OK and runs 'git --version', so /nix/store is the only missing rule; MARMEL_DISABLE_SANDBOX=1 is the only upstream workaround and it drops Landlock entirely. No NixOS awareness anywhere in src/ (grep -i nixos src/ = 0 hits). No duplicate upstream issue (#13 is the CA-store one).\n\nTemporary downstream patch added: packages/marmel/landlock-nix-store.patch adds \"/nix/store\" to ro_paths (sandbox.rs:417). Verified on ./result: sandboxed exec works, git runs, workspace writes work, ~/.ssh still blocked, /root still blocked. Test skips: cross_directory_rename now runs and passes (lib suite 966 passed, 1 filtered out); dev_null_and_dns stays skipped because /etc/resolv.conf is absent in the no-network build sandbox, not because of Landlock.\n\nUpstream issue text drafted at /tmp/marmel-nixos-landlock-issue.md (not filed yet). Change staged, not committed.\nFiled upstream: https://github.com/Na1w/marmel/issues/14 (open, 2026-10-16, 'Landlock allow-list is FHS-only, so every sandboxed shell command fails on NixOS'). Drop packages/marmel/landlock-nix-store.patch and restore nothing else once upstream ships a store path in ro_paths; the cross_directory_rename skip is already gone.","status":"closed","priority":1,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T19:31:13Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:22:17Z","started_at":"2026-10-16T12:07:21Z","closed_at":"2026-10-16T13:20:05Z","close_reason":"Confirmed real at 3f238ff and fixed downstream: packages/marmel/landlock-nix-store.patch adds /nix/store to the Landlock ro_paths, committed as 51dd95c19c18. Verified on the built binary (sandboxed exec works, ~/.ssh and /root still denied) and in the build (966 lib tests pass, cross_directory_rename skip removed). Upstream issue text drafted, not yet filed.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-dv3","title":"Fix Config screen crash on F2","description":"F2 opens ConfigScreen then Textual raises InvalidSelectValueError because _refresh_aggregator_dropdown assigns Select.BLANK, resolved as False, instead of clearing selection.\\n\\nAcceptance: Config screen opens with saved consensus configuration; regression covers no selected aggregator; targeted tests pass.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:34:03Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:37:47Z","started_at":"2026-08-20T11:34:07Z","closed_at":"2026-08-20T11:37:47Z","close_reason":"Replaced invalid Select.BLANK handling; built haivemind and verified ConfigScreen headlessly.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-a9m","title":"Fix haivemind startup after MainScreen mount","description":"Restore deferred engine startup while preserving MainScreen widget lookup fix.","status":"closed","priority":1,"issue_type":"bug","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-08-20T11:20:36Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-08-20T11:21:43Z","started_at":"2026-08-20T11:20:43Z","closed_at":"2026-08-20T11:21:43Z","close_reason":"Restored engine startup after MainScreen mount and verified package build.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-51o","title":"marmel: bump 3f238ff -\u003e 981b35b (main)","description":"Update packages/marmel to latest upstream main commit 981b35b0d356e56de429ab4198e427ccfbe7d85f. Verify src hash, cargoHash, whether patches (landlock-nix-store.patch #14, session-boot-trust-store.patch) still apply / whether follow-ups nix-overlay-pnb / nix-overlay-nn2 can close, and whether the sandbox test skip is still needed.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-18T11:25:08Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-18T11:53:11Z","started_at":"2026-10-18T11:25:13Z","closed_at":"2026-10-18T11:53:11Z","close_reason":"Bumped packages/marmel to 981b35b (main), hash regenerated, full build+tests green (1030+ tests).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-2fk","title":"marmel: bump d6627d7 (1.0.0) -\u003e 3f238ff (main)","description":"Update packages/marmel to the latest upstream main commit 3f238ff217ee2e1033c937c840bd2d33ec57abc4 (feat: add per-role reasoning_effort configuration, #12). Verify src/hash, cargoHash, and whether the Landlock ro_paths fix landed (see nix-overlay-5ml) so the cargoTestFlags skips can be dropped or kept.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-16T09:30:54Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T10:25:09Z","started_at":"2026-10-16T09:30:59Z","closed_at":"2026-10-16T10:25:09Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-du9","title":"Add kyojin package (Yamz-Labs/kyojin, ExLlamaV3 fork for Strix Halo)","description":"Package https://github.com/Yamz-Labs/kyojin: Yamz inference engine, a fork of ExLlamaV3 targeting AMD Strix Halo (gfx1151) on ROCm 7. Build the python package with the ROCm build of torch from nixpkgs and compile the HIP extension for gfx1151.","notes":"re-pinned to release tag v1.3 (latest GitHub release; v1.1 was stale), version = \"1.3\", updateScript uses tags; rebuilt from v1.3 sources, wrappers --help verified","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T08:44:23Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T15:14:30Z","started_at":"2026-10-07T08:49:12Z","closed_at":"2026-10-07T15:14:30Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-bju","title":"codeaf: build furrow from source instead of embedding the upstream release binary","description":"The codeaf package embeds the upstream Agent-Field/furrow release asset (fetchurl -\u003e cmd/fetch -from -\u003e go:embed). Those bytes are glibc-dynamic and never patched, so the copy codeaf extracts to ~/.codeaf/bin/furrow-0.1.0 dies on NixOS with 'Could not start dynamically linked executable ... stub-ld'. Build furrow (Rust, Apache-2.0, same version as internal/furrowbin/pin.json) from source in this overlay and hand it to codeaf through CODEAF_FURROW, which internal/furrow lookBinary prefers over the embedded copy.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-07T07:44:58Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-07T08:33:54Z","started_at":"2026-10-07T07:45:20Z","closed_at":"2026-10-07T08:33:54Z","close_reason":"Shipped in ff1fecc0edc4: packages/codeaf/furrow.nix builds furrow 0.1.0 from source, codeaf wraps its binary with CODEAF_FURROW and no longer stages the upstream release asset.","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -9,7 +10,7 @@
 {"_type":"issue","id":"nix-overlay-m5y","title":"Add CodeAF package (Agent-Field/CodeAF)","description":"Add https://github.com/Agent-Field/CodeAF as a new package under packages/codeaf with default.nix + package.nix, staged for blueprint discovery, README table updated, nix build verified.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T18:07:38Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T18:46:34Z","started_at":"2026-10-06T18:08:19Z","closed_at":"2026-10-06T18:46:34Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-570","title":"radar: ensure package builds without error","description":"Verify nix build .#radar succeeds; fix any build failures.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T16:51:35Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T17:02:59Z","started_at":"2026-10-06T16:51:40Z","closed_at":"2026-10-06T17:02:59Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-olq","title":"graphify: v1.0.0 tag is a stale fork branch - verify PyPI before bumping","description":"Bumping graphify 0.9.61 -\u003e 1.0.0 (commit 6013b17) was a false upgrade. nix-update picks the highest semver tag, and Graphify-Labs/graphify has a v1.0.0 tag that is NOT newer than v0.9.77:\n\n- v1.0.0 = 0a31c086, authored 2026-04-05, its pyproject still says graphifyy 0.1.10\n- v0.9.77 = 5c7b8479, authored 2026-10-05, commit message 'release: 0.9.77'\n- GitHub compare v0.9.77...v1.0.0: diverged, ahead_by 28, behind_by 2126\n- PyPI graphifyy latest is 0.9.77; no 1.0.0 was ever published\n\nv1.0.0 is a six-month-old branch that was never released. Pin is back to v0.9.77 (built + CLI smoke-tested). Two dependency corrections were needed: upstream vendored MinHash into graphify/_minhash.py (datasketch is gone, and with it the pybloomfilter3 metadata workaround in default.nix) and added a direct numpy import, so numpy is now an explicit dep.\n\nWhat made 1.0.0 look unbuildable: its pyproject hard-requires graspologic, which pulls python-future, disabled in nixpkgs for Python \u003e= 3.13 (this flake is on 3.14). Do not chase it - v1.0.0 has no Leiden fallback (cluster.py imports graspologic.partition.leiden unconditionally), so it is worse than 0.9.x even if it built.\n\nGuard: check https://pypi.org/pypi/graphifyy/json before accepting any nix-update bump here.","status":"closed","priority":2,"issue_type":"bug","owner":"alex@millerson.name","created_at":"2026-10-06T16:36:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T16:50:10Z","closed_at":"2026-10-06T16:50:10Z","close_reason":"Pinned back to v0.9.77 in dcbde330e4c3; v1.0.0 confirmed to be a stale branch (2126 behind, never on PyPI). Guard noted in package.nix and bd remember.","dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"nix-overlay-8wl","title":"marmel: bump to 1.0.0 (pin d6627d7c)","description":"Update packages/marmel to version 1.0.0, pinning upstream commit d6627d7cf3bf509d1e6db0d9d78736116e92e82a (the 1.0.0 release commit). Update src hash and cargoHash, verify build.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T15:44:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T15:45:40Z","started_at":"2026-10-06T15:45:40Z","lease_expires_at":"2026-10-06T15:50:40Z","heartbeat_at":"2026-10-06T15:45:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-8wl","title":"marmel: bump to 1.0.0 (pin d6627d7c)","description":"Update packages/marmel to version 1.0.0, pinning upstream commit d6627d7cf3bf509d1e6db0d9d78736116e92e82a (the 1.0.0 release commit). Update src hash and cargoHash, verify build.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T15:44:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-16T13:34:44Z","started_at":"2026-10-06T15:45:40Z","closed_at":"2026-10-16T13:34:44Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-hcf","title":"Update all overlay packages to latest upstream versions","description":"Bump every package in packages/ to its latest upstream release/commit using nix-update, then verify each builds. Working tree already carries uncommitted bumps for 15 packages (awg-tool, ds4, freebuff, freetoken, g3, graphify, hipengine, kubernetes-mcp-server, llama-cpp, marmel, omniroute, open-code-review, radar, skillsmcp, traycer); remaining packages (aionui, container-use, desloppify, haivemind, loop, mcp-gateway, nftables-analyzer, nftablesbuilder, relay-free-llm, shardr, stakpak) still need checking.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T12:54:12Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T13:46:41Z","started_at":"2026-10-06T12:54:20Z","closed_at":"2026-10-06T13:46:41Z","close_reason":"All 26 packages checked: 16 committed in 6013b17aadbc; aionui/container-use/desloppify/loop/mcp-gateway/nftables-analyzer/nftablesbuilder/relay-free-llm/stakpak already current; 3 evaluation/version-string errors from nix-update repaired by hand. omniroute deferred to its own issue (stale npmDepsHash).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-5p5","title":"Update versions of all packages in repo","description":"Run nix-update for every package in packages/ to bump to latest upstream versions, then verify builds.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-10-06T11:18:07Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-10-06T11:18:16Z","started_at":"2026-10-06T11:18:16Z","lease_expires_at":"2026-10-06T11:23:16Z","heartbeat_at":"2026-10-06T11:18:16Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-8y9","title":"Package opencode plugin as open-code-review passthru","description":"Expose plugins/open-code-review/opencode from the open-code-review source as passthru.opencode-plugin: single TS plugin file + node_modules built from the repo lockfile, installed under share/open-code-review/opencode","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-26T07:41:49Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-26T08:35:15Z","started_at":"2026-09-26T07:43:56Z","closed_at":"2026-09-26T08:35:15Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}