fix(kyojin): Isolate JIT and runtime toolchains

Allow a pinned JIT SDK without rebuilding PyTorch or the extension.
Keep runtime device bitcode unchanged: exporting TheRock bitcode into
the serving process crashes CLR 7.2 on a basic tensor operation.

Disable unsupported expandable segments and check all five HIP kernel
modules, with an optional GPU matmul and module-loading regression test.

.beads/config.yaml

@@ -52,3 +52,5 @@
 # - linear.api-key
 # - github.org
 # - github.repo
+
+sync.remote: "git+ssh://git@git.millerson.name:22002/alex/millerson-overlay.nix.git"

.beads/issues.jsonl

@@ -1,3 +1,6 @@
+{"_type":"issue","id":"nix-overlay-4g1","title":"Add marmel package","description":"Package Na1w/marmel (binary: marmel, cargo crate: marmennill), an autonomous agentic coding assistant.\n\nDecisions from grilling session:\n- attr/pname/mainProgram = marmel\n- version = unstable-2026-09-13 (tagless upstream; matches nix-update --version=branch=main output shape)\n- rev = fd551ae3198d427b0f0df3429f88764c49095b23, updateScript = nix-update --version=branch=main\n- license = mit (upstream README claims MIT; no LICENSE file, no Cargo.toml license field)\n- platforms = unix\n- category = AI Coding Agents\n- doCheck = true, triage sandbox-hostile PTY/Landlock tests by name; fall back to doCheck=false with comment only if suite is unsandboxable\n- install annotated example configs to share/doc/marmel/examples/\n- verification: nix build .#marmel, nix run .#marmel -- --help, nix eval version, nix flake check, nix build .#packages, README table row\n\nKnown build risk: aws-lc-sys (via rustls-platform-verifier) is a CMake/NASM C build; add only the build inputs the build actually demands.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-14T08:56:39Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-14T09:32:05Z","started_at":"2026-09-14T08:56:49Z","closed_at":"2026-09-14T09:32:05Z","close_reason":"marmel packaged and pushed: nix build green with 325 tests, --help smoke test passes, flake check passes with unfree allowed, launcher list includes marmel. Follow-ups filed as nix-overlay-d2r (racy upstream tests) and nix-overlay-05n (nix build .#packages broken).","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-89n","title":"Refresh flake.lock nixpkgs inputs","description":"Update nixpkgs and nixpkgs-latest flake inputs (pinned 2026-05 and 2026-08) to current nixos-unstable, then re-validate package builds.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-13T18:40:17Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T22:18:53Z","started_at":"2026-09-13T18:40:18Z","closed_at":"2026-09-13T22:18:53Z","close_reason":"nixpkgs/nixpkgs-latest bumped to 2026-09-11, freetoken pinned to nixpkgs-torch211, all 22 packages build and flake check passes.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-cfk","title":"Update all packages to latest upstream versions","description":"Bump every package in packages/ to its latest available upstream version, refresh hashes (src, cargoHash, vendorHash, npm deps, bun2nix, appimage, etc.), verify builds, and update README. Packages: aionui, awg-tool, container-use, desloppify, ds4, freebuff, freetoken, graphify, haivemind, hipengine, kubernetes-mcp-server, llama-cpp, loop, mcp-gateway, nftables-analyzer, nftablesbuilder, omniroute, radar, relay-free-llm, skillsmcp, stakpak, traycer.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-13T13:59:31Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T18:06:08Z","started_at":"2026-09-13T13:59:35Z","closed_at":"2026-09-13T18:06:08Z","close_reason":"All packages bumped to latest upstream; treefmt clean and nix flake check --no-build passes.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-05o","title":"Add llama-cpp package (build 9645) to overlay","description":"Port the pinned llama.cpp b9645 derivation from nixos-config/modules/llm-engine.nix into packages/llama-cpp/ (default.nix + package.nix). ROCm + Vulkan enabled, znver5 CPU flags, strix-halo gfx1151 orientation. Must build via nix build .#llama-cpp.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-13T09:22:26Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T10:33:35Z","started_at":"2026-09-13T09:22:28Z","closed_at":"2026-09-13T10:33:35Z","close_reason":"llama-cpp b9645 packaged in packages/llama-cpp, built and smoke-tested on gfx1151 (ROCm + Vulkan)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-6y6","title":"Add Loop corporate messenger package","description":"Add Loop - Corporate messenger for your team. Distributed as x86-64 binary from https://artifacts.wilix.dev/repository/loop-files/loop-6.0.3/loop-desktop-6.0.3-linux-x64.tar.gz","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-29T16:41:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-29T16:51:32Z","started_at":"2026-05-29T16:42:02Z","closed_at":"2026-05-29T16:51:32Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-cdt","title":"radar-1.6.1","description":"update package radar to v1.6.1","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-17T12:41:54Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-17T13:03:38Z","closed_at":"2026-05-17T13:03:38Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -7,8 +10,11 @@
 {"_type":"issue","id":"nix-overlay-qlc.3","title":"Handle go:embed frontend assets","description":"Ensure frontend assets are copied to internal/static/dist before Go build so go:embed works correctly","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-11T13:51:02Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T14:59:55Z","closed_at":"2026-05-11T14:59:55Z","close_reason":"Closed","dependencies":[{"issue_id":"nix-overlay-qlc.3","depends_on_id":"nix-overlay-qlc","type":"parent-child","created_at":"2026-05-11T16:51:02Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-qlc.2","title":"Configure npm dependencies for frontend build","description":"Set up npmDependencies hash for the Vite/React frontend build within buildGoModule","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-11T13:50:53Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T14:59:55Z","closed_at":"2026-05-11T14:59:55Z","close_reason":"Closed","dependencies":[{"issue_id":"nix-overlay-qlc.2","depends_on_id":"nix-overlay-qlc","type":"parent-child","created_at":"2026-05-11T16:50:52Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-qlc.1","title":"Update radar default.nix to use buildGoModule","description":"Change package.nix from stdenv.mkDerivation with fetchurl to buildGoModule pattern","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T13:50:42Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T14:59:55Z","started_at":"2026-05-11T13:51:49Z","closed_at":"2026-05-11T14:59:55Z","close_reason":"Closed","dependencies":[{"issue_id":"nix-overlay-qlc.1","depends_on_id":"nix-overlay-qlc","type":"parent-child","created_at":"2026-05-11T16:50:41Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"nix-overlay-qlc","title":"Rebuild radar package from source instead of prebuilt binary","description":"Current radar package uses prebuilt binary from GitHub releases. Need to rebuild from source using nix native tooling (buildGoModule + npm for frontend). Build pipeline: 1) npm run build for frontend, 2) copy assets to internal/static/dist, 3) CGO_ENABLED=0 go build with embedded assets.","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-11T13:50:27Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T15:01:06Z","closed_at":"2026-05-11T15:01:06Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-qlc","title":"Rebuild radar package from source instead of prebuilt binary","description":"Current radar package uses prebuilt binary from GitHub releases. Need to rebuild from source using nix native tooling (buildGoModule + npm for frontend). Build pipeline: 1) npm run build for frontend, 2) copy assets to internal/static/dist, 3) CGO_ENABLED=0 go build with embedded assets.","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-11T13:50:27Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-14T12:29:23Z","closed_at":"2026-05-11T15:01:06Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-y8r","title":"nix-overlay-2lr-3 · Approach 3: ручной npm cache + buildGoModule [parent:nix-overlay-2lr]","notes":"BLOCKED: fetchNpmDeps v2 не загружает workspace-scoped пакеты (@vitejs/plugin-react ENOTCACHED) даже с makeCacheWritable=true. Все 3 подхода заблокированы одним ограничением — fetchNpmDeps v2 не поддерживает npm workspaces корректно, вопреки release notes.","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T09:38:34Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T11:14:40Z","started_at":"2026-05-11T10:23:41Z","closed_at":"2026-05-11T11:14:40Z","dependencies":[{"issue_id":"nix-overlay-y8r","depends_on_id":"nix-overlay-2lr","type":"parent-child","created_at":"2026-05-11T12:42:18Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-dcx","title":"nix-overlay-2lr-2 · Approach 2: bun2nix генерация пакетов [parent:nix-overlay-2lr]","notes":"Skipping bun2nix — требует staging branch, неочевидная поддержка npm lockfiles. Проще перейти к Approach 3 (ручной stdenv.mkDerivation с nodejs/npm).","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T09:38:06Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T10:23:18Z","started_at":"2026-05-11T10:21:04Z","closed_at":"2026-05-11T10:23:18Z","dependencies":[{"issue_id":"nix-overlay-dcx","depends_on_id":"nix-overlay-2lr","type":"parent-child","created_at":"2026-05-11T12:42:12Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-3ik","title":"nix-overlay-2lr-1 · Approach 1: buildNpmPackage + buildGoModule с npmDepsFetcherVersion=2 [parent:nix-overlay-2lr]","notes":"fetchNpmDeps v2 не resolves workspace-scoped packages (@vitejs/plugin-react ENOTCACHED). Approach blocked — same issue as previous attempt. Moving to Approach 2 (bun2nix).","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T09:37:43Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T10:20:38Z","started_at":"2026-05-11T09:39:05Z","closed_at":"2026-05-11T10:20:38Z","dependencies":[{"issue_id":"nix-overlay-3ik","depends_on_id":"nix-overlay-2lr","type":"parent-child","created_at":"2026-05-11T12:41:54Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
-{"_type":"issue","id":"nix-overlay-2lr","title":"radar","description":"Используй karpathy-guidelines и Sequential Thinking для планирования шаг за шагом добавления нового пакета https://github.com/skyhook-io/radar.git в данный NIXOS overlay-репозиторий. Разбей задачу на подзадачи, используя beads. В написании кода используй mcp: nixos, refContext и context7.\n\n\n\n## Required Skills\ncaveman,karpathy-guidelines,nix,nix-flakes","notes":"Все 3 подхода провалены. fetchNpmDeps v2 НЕ работает с npm workspaces вопреки release notes - ENOTCACHED для workspace-scoped пакетов (@vitejs/plugin-react). Ручной сбор node_modules без npm ci слишком сложен (требует reimplement fetchNpmDeps). Текущее решение: pre-built binary из GitHub Releases. Нужно дождаться исправления fetchNpmDeps v2 в nixpkgs или upstream поддержки standalone lockfile для web/.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-10T19:28:56Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T11:24:40Z","started_at":"2026-05-10T19:30:31Z","closed_at":"2026-05-11T11:24:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-2lr","title":"radar","description":"Используй karpathy-guidelines и Sequential Thinking для планирования шаг за шагом добавления нового пакета https://github.com/skyhook-io/radar.git в данный NIXOS overlay-репозиторий. Разбей задачу на подзадачи, используя beads. В написании кода используй mcp: nixos, refContext и context7.\n\n\n\n## Required Skills\ncaveman,karpathy-guidelines,nix,nix-flakes","notes":"Все 3 подхода провалены. fetchNpmDeps v2 НЕ работает с npm workspaces вопреки release notes - ENOTCACHED для workspace-scoped пакетов (@vitejs/plugin-react). Ручной сбор node_modules без npm ci слишком сложен (требует reimplement fetchNpmDeps). Текущее решение: pre-built binary из GitHub Releases. Нужно дождаться исправления fetchNpmDeps v2 в nixpkgs или upstream поддержки standalone lockfile для web/.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-10T19:28:56Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-14T12:29:23Z","started_at":"2026-05-10T19:30:31Z","closed_at":"2026-05-11T11:24:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-05n","title":"nix build .#packages is broken (and CI dead-line masked by || true)","description":"nix build .#packages fails with: expected flake output attribute 'packages' to be a derivation or path but found a set (system-keyed set from blueprint).\n\n.github/workflows/ci.yml hides this with 'nix build .#packages || true', so the CI build step never actually builds anything.\n\nLikely fix: iterate packages.x86_64-linux.\u003cname\u003e, e.g. nix build .#packages.x86_64-linux.default plus per-package evaluation, or use 'nix build .#packages.x86_64-linux.*'-style invocation if supported.\n\nAlso: 'nix flake check' fails on HEAD because packages/desloppify is unfreeRedistributable (Refusing to evaluate package 'desloppify-1.0' ... unfree license). CI runs nix flake check, so that step is red unless NIXPKGS_ALLOW_UNFREE=1 is set.","status":"open","priority":3,"issue_type":"bug","owner":"alex@millerson.name","created_at":"2026-09-14T09:29:25Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-14T09:29:25Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-d2r","title":"Report racy test isolation upstream in Na1w/marmel","description":"The lib test suite of Na1w/marmel shares process-global state (src/orchestrator/workers.rs ACTIVE_WORKERS/WORKER_CONTEXT_TOKENS/RECENT_COMPLETED_WORKERS, src/orchestrator/bus.rs GLOBAL_CANCELLATION_TOKEN, src/orchestrator/preemption.rs ACTIVE_STREAMS) so manager-loop tests fail nondeterministically under the default parallel test harness.\n\nEvidence: one unchanged nix derivation produced 3 failures (102/101/201 results vs expected 3/2/3), then 1 failure, then 0 with --test-threads=1.\n\nImpact: packages/marmel works around it with cargoTestFlags = [\"--\" \"--test-threads=1\"] and a comment. Worth reporting upstream so the workaround can be dropped.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-09-14T09:29:25Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-14T09:29:25Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-k38","title":"Bump llama-cpp pin b9645 -\u003e b10944","description":"packages/llama-cpp pins ggml-org/llama.cpp to b9645 and intentionally removes passthru.updateScript. Upstream latest is b10944. The nixpkgs llama-cpp skeleton and custom HIP/cmake flags (gfx1151 Strix Halo) target b9645; a bump needs re-validating flags (e.g. hipBLASLt/rocWMMA/unified-memory) and a full ROCm rebuild. Do manually per the comment in package.nix.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-09-13T18:05:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T18:05:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}

.gitignore

@@ -11,3 +11,4 @@ result-*
 *.db
 .beads-credential-key
 logs/
+.beads.gate.lock

.serena/.gitignore

@@ -0,0 +1,2 @@
+/cache
+/project.local.yml

.serena/memories/conventions.md

@@ -0,0 +1,23 @@
+# nix-overlay — package conventions
+
+## Directory pattern (every package)
+`packages/<name>/default.nix` (wrapper, receives blueprint args) + `packages/<name>/package.nix` (the derivation, `pkgs.callPackage`-style argsets).
+
+Wrapper variants:
+- Plain: `{ pkgs, ... }: pkgs.callPackage ./package.nix { }`
+- Needs blueprint extras: pass `perSystem`, `inputs`, etc. through explicitly.
+- Alternate nixpkgs (freetoken): wrapper ignores `pkgs` for the derivation and calls `inputs.nixpkgs-torch211.legacyPackages.${pkgs.stdenv.hostPlatform.system}.callPackage ./package.nix { }`.
+
+## Derivedivation requirements
+- Use `stdenv.mkDerivation rec { pname; version; }` or `rustPlatform.buildRustPackage` (Rust: `cargoHash`; Go/Python equivalents as needed).
+- `meta.description` required (feeds the default meta-package listing).
+- `meta.mainProgram` set for CLI-providing packages.
+- Organizational attrs via `passthru`: `category` (e.g. "AI Coding Agents"), `hideFromDocs = true` to exclude from docs listing.
+- No `with pkgs;` at top level of Nix files (scope issues).
+- No hardcoded system paths/system assumptions.
+
+## Adding a package (sequence)
+mkdir → package.nix → default.nix wrapper → `git add packages/<name>/` (required for blueprint discovery) → `nix build .#<name>` → update README Available Packages table → commit (conventional-commit format).
+
+## Naming
+- Package dir name = flake output attr name (kebab-case).

.serena/memories/core.md

@@ -0,0 +1,30 @@
+# nix-overlay — core
+
+Nix flake overlay (numtide/blueprint-based) exposing extra packages for Nix/NixOS.
+Repo: `git+https://git.millerson.name/alex/millerson-overlay.nix.git`
+
+## Source map
+- `flake.nix` — inputs + outputs; blueprint drives perSystem outputs; overlays/modules added manually on top.
+- `overlays/default.nix` — binary-cache-friendly: maps blueprint's pre-built `packages` under namespace `millerson-nix-overlay`.
+- `overlays/shared-nixpkgs.nix` — builds `packages/` tree against consumer's `final` via `mkPackagesFor`; shares deps, cache only hits on matching nixpkgs rev.
+- `packages/<name>/default.nix` + `package.nix` — every package follows this wrapper/derivation split. See `mem:conventions` for patterns.
+- `packages/default/` — meta-package; generates name\tdesc list from `perSystem.self`, filtering `passthru.hideFromDocs`.
+- `packages/flake-inputs/` — dummy derivation referencing all flake inputs so they get cached. `hideFromDocs = true`.
+- `treefmt.toml` — nixfmt for `*.nix`, flake.lock excluded.
+- `AGENTS.md` — agent workflow rules (beads tracking, mandatory skills, caveman comms).
+
+## Project-wide invariants
+- All overlay packages live under the single attrset `millerson-nix-overlay` (not top-level attrs).
+- Blueprint discovers packages from the **git index**, not the working dir: new `packages/<name>/` must be `git add`-ed before `nix build .#<name>` sees it.
+- Three nixpkgs inputs; some packages deliberately build against non-default ones. See pins in `mem:tech_stack`.
+- Everything under `packages/` uses `pkgs.callPackage ./package.nix { }` wrapper pattern; `default.nix` receives blueprint args (pkgs, perSystem, inputs, ...).
+
+## Task workflow (from AGENTS.md, enforced)
+Runnable commands (build/format/update/bd/push): `mem:suggested_commands`. Exact done-checklist: `mem:task_completion`.
+
+
+- ALL task tracking via `bd` (beads): `bd ready`, `bd update <id> --claim`, `bd close <id>`. NEVER TodoWrite/markdown TODOs.
+- `bd prime` before starting work; `bd remember` for persistent knowledge (no MEMORY.md files).
+- Session not complete until `git push` succeeds (`bd dolt push` skipping with "No remote is configured" is expected, not a failure).
+- Commits use conventional-commit format.
+- For nixpkgs/option lookups use the `nix` skill; for flake/devShell ops the `nix-flakes` skill; comms in caveman mode.

.serena/memories/memory_maintenance.md

@@ -0,0 +1,33 @@
+# Memory Maintenance
+
+## Discovery Model
+
+- Core principle: progressive discovery through references, building a graph of memories.
+- Initially, agents are provided with the list of all memories (names only).
+- Agents should read `mem:core` as the top-level entry point (graph root).
+  This memory should contain references to other memories covering major project domains.
+  The referenced memories shall, in turn, shall contain references to even more specific memories, and so on.
+  The depth of the graph shall depend on the project complexity.
+- Use topics/folders to group related memories in order to make the content structure explicit.
+  Folders can mirror project structure (e.g. modules like frontend/backend) or topics like debugging, architecture, etc.
+- Memory references must use a mem: prefix inside backticks, e.g. `mem:frontend/core`.
+  The surrounding text should clearly indicate when to read the memory/which content to expect.
+  The text should provide more precise guidance than the memory name alone, 
+  i.e. avoid a reference like "frontend debugging: `mem:frontend/debugging` and instead make clear which aspects of frontend debugging are covered.
+- Memories themselves should not contain information about when to read them; this is the responsibility of the referring memory.
+
+## Style
+
+Dense agent notes, not prose docs. Prefer invariants, terse bullets. 
+Avoid obvious context, rationale, and examples unless they prevent likely mistakes. 
+Keep guidance durable and generalizable, not task-local.
+
+## Add/update threshold
+
+Add or update memories only with stable, non-obvious project conventions that avoid complex rediscovery in the future.
+Do not add: quick-read facts; generic language/framework knowledge; one-off task notes; volatile line-level details; behavior likely to change soon.
+
+## Maintenance Actions
+
+- Renaming memories: References are updated automatically if handled via Serena's memory rename tool.
+- Checking for stale memories (e.g. after deletion): Call `serena memories check` for a report.

.serena/memories/suggested_commands.md

@@ -0,0 +1,34 @@
+# nix-overlay — commands
+
+All run from repo root (`nix-overlay/`).
+
+## Build / run
+- `nix build .#<package>` — build one package (must be `git add`-ed first if new; blueprint reads git index).
+- `nix run .#<package>` — run a package CLI (needs `meta.mainProgram`).
+- `nix build .#default` — build the meta-package (package listing).
+- `nix flake show` — inspect flake outputs (also index-limited).
+- `nix flake check` — full check incl. formatting.
+- `nix develop` — dev shell from blueprint.
+
+## Format
+- `nix fmt` (treefmt → nixfmt on *.nix). Same as `nix flake check`'s format gate.
+
+## Package updates
+- `nix-update <package>` — bump version + hashes (cargoHash etc.).
+- `nix-update <package> --version <v>` — specific version.
+- `nix-update skillsmcp --version=branch=main` — for commit-pinned pkgs; or `--commit <sha>`.
+
+## Beads (mandatory task tracking)
+- `bd prime` — session context, run before any work.
+- `bd ready` / `bd show <id>` / `bd update <id> --claim` / `bd close <id>`.
+- `bd remember` — persistent knowledge instead of MEMORY.md.
+- `bd dolt push` — prints "No remote is configured — skipping." (expected; exit 0).
+
+## Session completion push
+```
+git pull --rebase && bd dolt push && git push
+git status  # must show "up to date with origin"
+```
+
+## Serena
+- `serena memories check` — verify memory references after edits/deletes.

.serena/memories/task_completion.md

@@ -0,0 +1,11 @@
+# nix-overlay — task completion
+
+Done when ALL of these pass/hold:
+
+1. Build passes: `nix build .#<package>` (or `nix flake check` for cross-cutting changes). Never leave a package committed that doesn't build.
+2. Formatting: `nix fmt` clean (nixfmt; `flake.lock` excluded).
+3. New package is staged (`git add packages/<name>/`) before build — blueprint index requirement.
+4. README.md Available Packages table updated if package added/changed visibly.
+5. Commit: conventional commit format (use conventional-commit / caveman-commit skill). No work left uncommitted.
+6. Beads: work claimed via `bd update <id> --claim` before, `bd close <id>` after.
+7. Pushed: `git pull --rebase && bd dolt push && git push` then `git status` shows "up to date with origin". `bd dolt push` skip message is expected, not a failure. Do not stop before push succeeds.

.serena/memories/tech_stack.md

@@ -0,0 +1,11 @@
+# nix-overlay — tech stack
+
+- Language: Nix. Build system: Nix flake via `numtide/blueprint` (with `flake-parts`, `systems` for multi-system).
+- Formatting: `treefmt-nix` → `nixfmt` on `*.nix` (`flake.lock` excluded in `treefmt.toml`).
+- Multi-input nixpkgs setup (flake.nix) — pins matter, do not "unify" them:
+  - `nixpkgs` = nixos-unstable (default; blueprint follows it).
+  - `nixpkgs-latest` = nixos-unstable — needed by packages requiring newer toolchains: rustc >= 1.95 (mcp-gateway >= 3.4.0), go >= 1.26.3 (kubernetes-mcp-server >= 0.0.66).
+  - `nixpkgs-torch211` = pinned rev `549bd84d6279f9852cae6225e372cc67fb91a4c1` — freetoken pins torch>=2.11,<2.12 / triton==3.6.0; nixos-unstable ships torch 2.13/triton 3.7, so freetoken builds via `inputs.nixpkgs-torch211.legacyPackages.${system}.callPackage` (see `packages/freetoken/default.nix`).
+  - `bun2nix` pinned to branch `staging-2.1.0` until catalog support (bun2nix#86) lands on default branch (TODO #4001).
+- Package kinds in `packages/`: mostly Rust (rustPlatform.buildRustPackage), Go, Python/torch, Node/bun; each self-contained in its own dir.
+- `flake.lock` managed only via `nix flake update` — never hand-edited.

.serena/project.yml

@@ -0,0 +1,169 @@
+# the name by which the project can be referenced within Serena/when chatting with the LLM.
+project_name: "nix-overlay"
+
+# list of language servers to start when using the LSP backend; choose from:
+#   ada                    al                     angular                ansible                bash
+#   bsl                    clojure                cpp                    cpp_ccls               crystal
+#   csharp                 csharp_omnisharp       cue                    dart                   deno
+#   elixir                 elm                    erlang                 fortran                fsharp
+#   gdscript               gleam                  go                     groovy                 haskell
+#   haxe                   hlsl                   html                   java                   json
+#   julia                  kotlin                 latex                  lean4                  lua
+#   luau                   markdown               matlab                 msl                    nextflow
+#   nix                    ocaml                  pascal                 perl                   php
+#   php_phpactor           php_phpantom           powershell             python                 python_basedpyright
+#   python_jedi            python_pyrefly         python_ty              qml                    r
+#   rego                   ruby                   ruby_solargraph        rust                   scala
+#   scss                   solidity               svelte                 swift                  systemverilog
+#   terraform              toml                   typescript             typescript_vts         vue
+#   wolfram                yaml                   zig
+#   (This list may be outdated; generated with scripts/print_language_list.py;
+#   For the current list, see values of the LanguageServerId enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py)
+# For some languages, there are several alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
+#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
+#   - For Deno projects, use deno (serves the same .ts/.js files as typescript; requires the deno CLI on PATH)
+#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some language servers require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple language servers, the first language server that supports a given file will be used for that file.
+# The first language server is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+language_servers:
+- nix
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# optional shell command to run before the language backend (LSP or JetBrains) is initialised.
+# the command runs in the project root directory and is only executed if the project is trusted
+# (see trusted_project_path_patterns in the global configuration).
+# serena waits for the command to exit: a non-zero exit code is logged as an error but does not
+# abort activation. a per-project timeout (activation_command_timeout, default 180s) is the safety
+# backstop for non-terminating commands; on expiry the process is killed and activation continues.
+# example: activation_command: "npx nx run-many -t build"
+activation_command:
+
+# maximum time in seconds to wait for activation_command to complete before killing it (default 180s).
+# must be a positive number.
+activation_command_timeout: 180.0
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# whether to use project's .gitignore files to ignore files
+ignore_all_files_in_gitignore: true
+
+# advanced configuration option allowing to configure language server-specific options.
+# Maps the language key to the options.
+# The settings are considered only if the project is trusted (see global configuration to define trusted projects).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#language-server-specific-settings
+ls_specific_settings: {}
+
+# list of workspace folder paths (LSP backend only).
+# These folders will be used to build up Serena's symbol index.
+# Paths must be within the project root and should thus be relative to the project root.
+# Furthermore, the paths should not be filtered by ignore settings.
+# Default setting: The entire project root folder (".") is considered.
+# In (large) monorepos, this can be used to index only subfolders of the project root, e.g.
+#   ls_workspace_folders:
+#     - "./subproject1"
+#     - "./subproject2"
+ls_workspace_folders:
+- "."
+
+# list of additional workspace folder paths for cross-package reference support.
+# Paths can be absolute or relative to the project root.
+# Each folder is registered as an LSP workspace folder, enabling language servers to discover
+# symbols and references across package boundaries, but these folders are not indexed by Serena,
+# i.e. the respective symbols will not be found using Serena's symbol search tools.
+# Example:
+#   additional_workspace_folders:
+#     - ../sibling-package
+#     - ../shared-lib
+ls_additional_workspace_folders: []
+
+# list of additional paths to ignore in this project.
+# Same syntax as gitignore, so you can use * and **.
+# Important: quote patterns that start with `*`, otherwise YAML treats them as aliases.
+# Example:
+#   ignored_paths:
+#     - "examples/**"
+#     - ".worktrees/**"
+#     - "**/bin/**"
+#     - "**/obj/**"
+# Note: global ignored_paths from serena_config.yml are also applied additively.
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude.
+# This extends the existing exclusions (e.g. from the global configuration)
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+excluded_tools: []
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+fixed_tools: []
+
+# list of mode names that are to be activated by default, overriding the setting in the global configuration.
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
+# for this project.
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+default_modes:
+
+# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+added_modes:
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# list of regex patterns for memories to completely ignore.
+# Matching memories will not appear in list_memories or activate_project output
+# and cannot be accessed via read_memory or write_memory.
+# To access ignored memory files, use the read_file tool on the raw file path.
+# Extends the list from the global configuration, merging the two lists.
+# Example: ["_archive/.*", "_episodes/.*"]
+ignored_memory_patterns: []

AGENTS.md

@@ -375,6 +375,20 @@ git add packages/my-tool README.md
 bd close <id>         # Mark task as complete
 ```
 
+## Agent skills
+
+### Issue tracker
+
+Issues live in the beads database (`.beads/`, driven by the `bd` CLI), synced through `git push`. The Gitea remote is not the issue tracker. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+The five canonical triage roles keep their default names, applied as `bd` labels. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context layout: `CONTEXT.md` plus `docs/adr/` at the repo root. See `docs/agents/domain.md`.
+
 <!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
 ## Beads Issue Tracker
 

CLAUDE.md

@@ -1,69 +0,0 @@
-# Project Instructions for AI Agents
-
-This file provides instructions and context for AI coding agents working on this project.
-
-<!-- BEGIN BEADS INTEGRATION v:1 profile:minimal hash:ca08a54f -->
-## Beads Issue Tracker
-
-This project uses **bd (beads)** for issue tracking. Run `bd prime` to see full workflow context and commands.
-
-### Quick Reference
-
-```bash
-bd ready              # Find available work
-bd show <id>          # View issue details
-bd update <id> --claim  # Claim work
-bd close <id>         # Complete work
-```
-
-### Rules
-
-- Use `bd` for ALL task tracking — do NOT use TodoWrite, TaskCreate, or markdown TODO lists
-- Run `bd prime` for detailed command reference and session close protocol
-- Use `bd remember` for persistent knowledge — do NOT use MEMORY.md files
-
-## Session Completion
-
-**When ending a work session**, you MUST complete ALL steps below. Work is NOT complete until `git push` succeeds.
-
-**MANDATORY WORKFLOW:**
-
-1. **File issues for remaining work** - Create issues for anything that needs follow-up
-2. **Run quality gates** (if code changed) - Tests, linters, builds
-3. **Update issue status** - Close finished work, update in-progress items
-4. **PUSH TO REMOTE** - This is MANDATORY:
-   ```bash
-   git pull --rebase
-   bd dolt push
-   git push
-   git status  # MUST show "up to date with origin"
-   ```
-5. **Clean up** - Clear stashes, prune remote branches
-6. **Verify** - All changes committed AND pushed
-7. **Hand off** - Provide context for next session
-
-**CRITICAL RULES:**
-- Work is NOT complete until `git push` succeeds
-- NEVER stop before pushing - that leaves work stranded locally
-- NEVER say "ready to push when you are" - YOU must push
-- If push fails, resolve and retry until it succeeds
-<!-- END BEADS INTEGRATION -->
-
-
-## Build & Test
-
-_Add your build and test commands here_
-
-```bash
-# Example:
-# npm install
-# npm test
-```
-
-## Architecture Overview
-
-_Add a brief overview of your project architecture_
-
-## Conventions & Patterns
-
-_Add your project-specific conventions here_

README.md

@@ -14,23 +14,29 @@ A custom Nix overlay and flake providing additional packages not found in upstre
 |---------|-------------|----------|
 | `awg-tool` | CLI for AmneziaWG self-hosting — generates 1.0/1.5/2.0/3.0 obfuscation parameters, exports .conf and vpn:// configs, installs servers over SSH | Networking |
 | `aionui` | Free, open-source, Cowork app with AI Agents | AI Coding Agents |
+| `codeaf` | Coding harness and software factory for open models: hand work off, then watch every project from one terminal | AI Coding Agents |
 | `container-use` | Containerized environments for coding agents | AI Coding Agents |
 | `desloppify` | Multi-language codebase health scanner and technical debt tracker for AI agents | AI Coding Agents |
 | `ds4` | DeepSeek 4 Flash and PRO local inference engine for ROCm (Strix Halo) | AI Inference |
 | `freebuff` | The world's strongest free coding agent | AI Coding Agents |
 | `freetoken` | Local MoE-offload LLM inference runtime with OpenAI- and Anthropic-compatible APIs | AI Inference |
 | `graphify` | Turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph | AI Coding Agents |
+| `g3` | AI coding agent that writes code and executes commands, with multi-provider LLM support, context compaction, and desktop automation | AI Coding Agents |
 | `haivemind` | Multi-model AI consensus, aggregation, and fusion runner for popular AI CLIs | AI Coding Agents |
 | `hipengine` | ROCm-native local LLM inference engine with torch-free runtime for AMD RDNA GPUs | AI Inference |
+| `marmel` | Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend | AI Coding Agents |
 | `mcp-gateway` | Universal Model Context Protocol gateway that sits between AI client and MCP tools/servers | MCP Servers |
 | `nftables-analyzer` | Analyze nftables firewall rules and evaluate traffic queries | Networking |
 | `nftablesbuilder` | Web interface to manage nftables rules with drag-and-drop rule creation | Networking |
+| `shardr` | Decentralized LLM repository: content-addressed model store, BitTorrent-based sync, OpenAI-compatible serving via llama-server | AI Inference |
 | `skillsmcp` | MCP server that exposes Agent Skills to AI agents via the Model Context Protocol | MCP Servers |
 | `kubernetes-mcp-server` | Model Context Protocol (MCP) server for Kubernetes and OpenShift | MCP Servers |
-| `llama-cpp` | llama.cpp pinned to build b9645, built for Strix Halo (gfx1151) with ROCm + Vulkan backends | AI Inference |
+| `kyojin` | ExLlamaV3-based inference engine with speculative decoding for 100 GB-class MoE packs on one 128 GB AMD Strix Halo (gfx1151, ROCm 7) | AI Inference |
+| `llama-cpp` | llama.cpp pinned to build b11439, built for Strix Halo (gfx1151) with ROCm + Vulkan backends | AI Inference |
 | `loop` | Corporate messenger for your team | Communication |
 | `radar` | Modern Kubernetes visibility — topology, event timeline, service traffic, resource browsing, Helm management, and GitOps support | Kubernetes |
 | `omniroute` | Unified AI router with 160+ providers, auto fallback, MCP/A2A, OpenAI-compatible APIs | AI LLM Gateway |
+| `open-code-review` | AI-powered code review CLI combining deterministic pipelines with an LLM agent for line-level review comments | AI Coding Agents |
 | `relay-free-llm` | RESTful API to route user prompts to various AI model providers with automatic failover and intent-based routing | AI LLM Gateway |
 | `stakpak` | DevOps AI agent that generates infrastructure code, debugs Kubernetes, configures CI/CD, and automates deployments | AI Agents |
 | `traycer` | Open-source AI orchestration app for agentic coding | AI Coding Agents |
@@ -89,6 +95,30 @@ nix run git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gatewa
 nix profile install git+https://git.millerson.name/alex/millerson-overlay.nix.git#mcp-gateway
 ```
 
+### Kyojin JIT Toolchain
+
+Kyojin's serving wrappers use the packaged ROCm compiler by default. Supply a
+pinned SDK to compile HIP JIT kernels with another compiler without rebuilding
+PyTorch or the HIP extension:
+
+```nix
+kyojin.override { jitRocmSdk = myJitSdk; }
+```
+
+The SDK must provide `bin/hipcc` and matching `amdgcn/bitcode`. Its compiler
+wrapper must set `HIP_DEVICE_LIB_PATH` to that bitcode **in the compiler
+subprocess only**, along with any required `ROCM_PATH` and Nix C++ toolchain
+flags. Keep the compiler wrapper's real path inside the SDK prefix so upstream's
+compiler provenance check recognizes it.
+
+The serving process keeps PyTorch's ROCm device libraries. Setting TheRock's
+Clang 23 bitcode globally makes the ROCm 7.2 runtime crash on a basic PyTorch
+matrix multiplication. The serving wrappers also disable unsupported expandable
+allocator segments. `nix build .#kyojin.tests.jit` checks compilation of five HIP
+kernel modules without requiring a GPU; `packages/kyojin/check-jit.py --gpu`, run
+with the package's Python environment and serving variables, additionally checks
+PyTorch matrix multiplication and module loading through its existing HIP runtime.
+
 ### nftablesbuilder Runtime Notes
 
 `nftablesbuilder` is a web interface for managing nftables. It consists of a
@@ -113,6 +143,41 @@ nftablesbuilder.eu (served with a self-signed certificate, hence the
 `curlOpts = "-k"` in the derivation); the source repository is missing the
 `settings` crate, which this overlay patches in.
 
+### OpenCodeReview OpenCode Plugin (Home Manager)
+
+The `open-code-review` package bundles its OpenCode plugin (the plugin file
+plus runtime `node_modules`) as `passthru.opencode-plugin`, built from the
+same source revision as the CLI. A Home Manager module symlinks it into
+`~/.config/opencode/plugins/` and puts the `ocr` CLI on PATH:
+
+```nix
+inputs.millerson-nix-overlay.url = "git+https://git.millerson.name/alex/millerson-overlay.nix.git";
+inputs.home-manager.url = "github:nix-community/home-manager";
+```
+
+```nix
+# in your home-manager configuration
+imports = [ millerson-nix-overlay.homeManagerModules.default ];
+
+programs.open-code-review = {
+  enable = true;
+  opencode.enable = true; # symlink plugin into ~/.config/opencode
+};
+```
+
+Without Home Manager, symlink manually:
+
+```bash
+plugin=$(nix build --print-out-paths \
+  git+https://git.millerson.name/alex/millerson-overlay.nix.git#open-code-review.passthru.opencode-plugin)
+mkdir -p ~/.config/opencode/plugins
+ln -sf $plugin/share/open-code-review/opencode/open-code-review.ts ~/.config/opencode/plugins/
+ln -sfn $plugin/share/open-code-review/opencode/node_modules ~/.config/opencode/plugins/node_modules
+```
+
+Note: the `node_modules` symlink is shared across everything in the plugins
+directory; other manually-installed plugins with conflicting npm dependencies
+cannot coexist with it.
 
 ## Development
 
@@ -146,6 +211,7 @@ nix-overlay/
 ├── packages/                    # Package definitions
 │   ├── awg-tool/               # AmneziaWG parameter generation and SSH deployment CLI
 │   ├── aionui/                 # AionUi - AI Cowork desktop app
+│   ├── codeaf/                 # Coding harness and software factory for open models
 │   ├── container-use/          # Containerized environments for coding agents
 │   ├── default/                # Meta-package listing all packages
 │   ├── desloppify/             # Codebase health scanner for AI agents
@@ -154,12 +220,15 @@ nix-overlay/
 │   ├── freebuff/               # Free coding agent (Codebuff)
 │   ├── freetoken/             # Local MoE inference runtime (NVIDIA CUDA)
 │   ├── graphify/               # Knowledge graph generator for code folders
+│   ├── g3/                     # AI coding agent (g3 + g3-studio)
 │   ├── haivemind/              # Multi-model AI consensus runner
 │   ├── hipengine/              # ROCm-native LLM inference engine for AMD GPUs
 │   ├── kubernetes-mcp-server/  # MCP server for Kubernetes and OpenShift
+│   ├── kyojin/                 # ExLlamaV3-based inference engine for Strix Halo (gfx1151)
 │   ├── loop/                   # Corporate messenger for your team
 │   ├── mcp-gateway/            # MCP protocol gateway
 │   ├── omniroute/              # Unified AI router with 160+ providers
+│   ├── open-code-review/       # AI code review CLI (deterministic + LLM agent)
 │   ├── radar/                  # Kubernetes UI (topology, timeline, Helm, GitOps)
 │   ├── relay-free-llm/        # AI model provider routing gateway
 │   ├── skillsmcp/              # MCP server for Agent Skills

docs/agents/domain.md

@@ -0,0 +1,55 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root, or
+- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-two-overlay-strategies.md
+│   └── 0002-package-discovery-via-git-index.md
+├── packages/
+├── overlays/
+└── modules/
+```
+
+This repo uses the single-context layout. There is no `CONTEXT-MAP.md` and no per-directory `CONTEXT.md` files; the whole overlay is one domain.
+
+Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/adr/                          ← system-wide decisions
+└── src/
+    ├── ordering/
+    │   ├── CONTEXT.md
+    │   └── docs/adr/                  ← context-specific decisions
+    └── billing/
+        ├── CONTEXT.md
+        └── docs/adr/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,63 @@
+# Issue tracker: bd (beads)
+
+Issues and specs for this repo live in the beads database at `.beads/`. The source of truth is `.beads/issues.jsonl`, managed through the `bd` CLI (v1.3.0). beads state is versioned in the repo and synced with `git push`; there is no separate Dolt remote.
+
+The forge remote (`git.millerson.name`, self-hosted Gitea) is not the issue tracker. Do not open Gitea, GitHub, or GitLab issues for work in this repo.
+
+## Core commands
+
+```bash
+bd ready                 # open issues with no active blockers
+bd show <id>             # full issue detail
+bd list                  # list issues
+bd search "<text>"       # text search
+bd create "title" -d "description" -p 2 -l label1,label2
+bd q "quick capture"     # create and print only the id
+bd update <id> --claim   # claim before starting work
+bd close <id> --reason "..."
+bd reopen <id>
+bd comment <id> "..."    # conversation history
+bd note <id> "..."       # append a note
+bd tag <id> <label>      # shorthand for: bd update <id> --add-label <label>
+bd label add <id> <label>
+bd label remove <id> <label>
+bd status                # database overview
+```
+
+Issue ids look like `nix-overlay-4g1`. New work must be claimed with `bd update <id> --claim` before it starts.
+
+## When a skill says "publish to the issue tracker"
+
+Run `bd create`. Use one issue per ticket. Put the full body in `--description` (markdown is fine). Add labels per `triage-labels.md`. For a multi-part spec, create a parent issue and link children with `--deps`.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `bd show <id>` and read the description plus comments (`bd show <id> --include-comments --json` when full comment bodies are needed). The user normally passes the issue id directly.
+
+## Dependencies
+
+`bd create --deps 'blocked-by:nix-overlay-4g1,discovered-from:nix-overlay-2a3'`
+
+Bare ids, `depends-on:` and `blocked-by:` all make the new issue depend on the target. `blocks:` reverses the direction. `bd link`, `bd dep`, and `bd children` manage the graph after creation. `bd ready` already excludes anything with an unresolved blocker, so a ticket is unblocked when every issue that blocks it is closed.
+
+## Wayfinding operations
+
+Used by `/wayfinder`. The map is a parent bead; the children are its sub-issues.
+
+- **Map**: a bead created for the effort. Its description holds the Notes / Decisions-so-far / Fog body.
+- **Child ticket**: a bead linked to the map with `--deps depends-on:<map-id>`. The question goes in the description. Record the ticket type as a label (`research`, `prototype`, `grilling`, `task`).
+- **Blocking**: a `blocked-by:<id>` dependency on the blocking bead.
+- **Frontier**: `bd ready` output, restricted to children of the map (`bd children <map-id> --ready` or filter `bd ready` by parent). Lowest priority number, then oldest, wins.
+- **Claim**: `bd update <id> --claim` before any work starts.
+- **Resolve**: append the answer with `bd note <id> "..."` or `bd comment`, then `bd close <id> --reason "<answer gist>"`, then add a context pointer (gist plus issue id) to the map's Decisions-so-far with `bd note <map-id> "..."`.
+
+## Session end
+
+Work is not complete until pushed. The project workflow requires:
+
+```bash
+git pull --rebase
+bd dolt push    # prints "No remote is configured - skipping." here; expected, not a failure
+git push
+git status      # must show up to date with origin
+```

docs/agents/triage-labels.md

@@ -0,0 +1,30 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (for example "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.
+
+## Applying labels with bd
+
+Labels are bd labels, not forge labels:
+
+```bash
+bd tag <issue-id> ready-for-agent
+bd label add <issue-id> needs-triage
+bd label remove <issue-id> needs-triage
+bd label list <issue-id>
+```
+
+On creation: `bd create "title" -l ready-for-agent`.
+
+A ticket has at most one triage role label. When a ticket moves to a new role, remove the old label and add the new one in the same step rather than stacking role labels.

flake.lock

@@ -75,11 +75,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777954456,
+        "lastModified": 1789149629,
-        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
     },
     "nixpkgs-latest": {
       "locked": {
-        "lastModified": 1785967620,
+        "lastModified": 1789149629,
-        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
+        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
+        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
         "type": "github"
       },
       "original": {
@@ -105,6 +105,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-torch211": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "blueprint": "blueprint",
@@ -112,6 +128,7 @@
         "flake-parts": "flake-parts",
         "nixpkgs": "nixpkgs",
         "nixpkgs-latest": "nixpkgs-latest",
+        "nixpkgs-torch211": "nixpkgs-torch211",
         "systems": "systems",
         "treefmt-nix": "treefmt-nix"
       }

flake.nix

@@ -6,6 +6,11 @@
     # Newer nixpkgs whose toolchains are required by some packages:
     # rustc >= 1.95 (mcp-gateway >= 3.4.0), go >= 1.26.3 (kubernetes-mcp-server >= 0.0.66).
     nixpkgs-latest.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # freetoken pins torch>=2.11,<2.12 and triton==3.6.0; current
+    # nixos-unstable only ships torch 2.13 / triton 3.7. Keep the previous
+    # nixpkgs revision for freetoken so its CUDA 12.9 / torch 2.11 stack is
+    # unchanged.
+    nixpkgs-torch211.url = "github:NixOS/nixpkgs/549bd84d6279f9852cae6225e372cc67fb91a4c1";
     systems.url = "github:nix-systems/default";
     blueprint = {
       url = "github:numtide/blueprint";
@@ -52,5 +57,9 @@
       nixosModules.default = {
         nixpkgs.overlays = [ self.overlays.default ];
       };
+
+      homeManagerModules.default = {
+        imports = [ ./modules/open-code-review-hm.nix ];
+      };
     };
 }

modules/open-code-review-hm.nix

@@ -0,0 +1,50 @@
+# Home Manager module: installs the OpenCode plugin for OpenCodeReview.
+#
+# Creates symlinks under ~/.config/opencode/plugins/ for the plugin file and
+# its runtime node_modules, and puts the matching `ocr` CLI on PATH.
+#
+# Note: the node_modules symlink is shared by everything in the plugins
+# directory. Plugins installed by other means that need conflicting npm
+# dependencies cannot coexist with this one.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.open-code-review;
+in
+{
+  options.programs.open-code-review = {
+    enable = lib.mkEnableOption "OpenCodeReview AI code review CLI and its OpenCode plugin";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.open-code-review;
+      defaultText = lib.literalExpression "pkgs.open-code-review";
+      description = "The open-code-review package to use.";
+    };
+
+    opencode = {
+      enable = lib.mkEnableOption "symlink the bundled OpenCode plugin into ~/.config/opencode";
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      home.packages = [ cfg.package ];
+    }
+    (lib.mkIf cfg.opencode.enable {
+      # The plugin resolves its imports Node-style: node_modules next to the
+      # plugin file, or in any parent directory (via the file's realpath).
+      # Linking both the file and node_modules covers either resolution.
+      xdg.configFile."opencode/plugins/open-code-review.ts".source =
+        "${cfg.package.passthru.opencode-plugin}/share/open-code-review/opencode/open-code-review.ts";
+
+      xdg.configFile."opencode/plugins/node_modules".source =
+        "${cfg.package.passthru.opencode-plugin}/share/open-code-review/opencode/node_modules";
+    })
+  ]);
+}

packages/aionui/package.nix

@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "2.1.50";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "iOfficeAI";
     repo = "AionUi";
     rev = "v${version}";
-    hash = "sha256-NsKygGMRN5pQXyKaehVW/sC2tyd4KmrYmiQrr5ZGeNY=";
+    hash = "sha256-HyDzlUOg0OAGNhNveG/5Ba2UbgoR4VTQsbUGUzGmKd4=";
   };
 
   # FOD 1: All dependencies (dev + prod) for the build phase.
@@ -34,7 +34,7 @@ let
     ];
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-EeDapBXeiU/70N92ka1dmrKUMEDN65FON8VPVPsBfro=";
+    outputHash = "sha256-+vLK5f1rhcXAhHz0v1LkMbcBjBLFCHVTWbdamZIjOwY=";
     dontPatchShebangs = true;
     dontFixup = true;
     SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -63,7 +63,7 @@ let
     ];
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-L2UV+OsHfoQTsc1s+tBrJZtnoiCcB2mlnsAHbplTggc=";
+    outputHash = "sha256-CzVH9zQsssdkCX/BpUxQw1wnJQKzLYWWXZt3sn7eBFI=";
     dontPatchShebangs = true;
     dontFixup = true;
     SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

packages/awg-tool/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awg-tool";
-  version = "0.2.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "Vadim-Khristenko";
     repo = "awg-containers-and-tools";
     rev = "v${version}";
-    hash = "sha256-z4LG+z60uqsfkRyt7Dc8Fc5GMfpiF7G0N9PXnzTUJms=";
+    hash = "sha256-ggQjlHxNY3uXdLkE3CsSjsijFQScaJyCMhaXwASARSg=";
   };
 
   # awg-core builds ssh2 with vendored-openssl, which compiles libssh2
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  cargoHash = "sha256-Nb5tmwvhzKAldHai7yxtYapjbZmai0ujBX9c6nRGZk0=";
+  cargoHash = "sha256-2Vh9DXn6qdUT6wiITDID09j1iqpTHkZt/mpjAlYFA60=";
 
   # Upstream tests exercise Docker/SSH targets; unit tests are already
   # covered by the upstream CI before a release is cut.

packages/codeaf/default.nix

@@ -0,0 +1,9 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix {
+  # Not a package of its own: codeaf is the only consumer, and codeaf is the one
+  # that knows which furrow version it pinned. See ./furrow.nix.
+  furrow = pkgs.callPackage ./furrow.nix { };
+}

packages/codeaf/furrow.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+# furrow is the copy-on-write workspace snapper codeaf drives. codeaf ships a
+# copy of it inside the go binary: the release asset from GitHub, glibc-dynamic
+# and untouched by anything in this build, so the file codeaf writes out to
+# ~/.codeaf/bin/furrow-<version> cannot start here — NixOS answers "Could not
+# start dynamically linked executable" and names stub-ld. Building furrow here
+# instead gives the same version as an ordinary Nix binary, and codeaf is told
+# to use it through CODEAF_FURROW, which internal/furrow reads before it ever
+# looks at the embedded copy. See ./package.nix.
+#
+# The version here has to be the one codeaf pinned in
+# internal/furrowbin/pin.json: the decoders in codeaf were written for that
+# furrow. Bump the two together.
+rustPlatform.buildRustPackage rec {
+  pname = "furrow";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Agent-Field";
+    repo = "furrow";
+    rev = "v${version}";
+    hash = "sha256-xknfvnBDFxDYeBE1yAjXl1Fx3VDHrNSUhXEWQO3PK6s=";
+  };
+
+  cargoHash = "sha256-FGtrKtWFPcT3R8nF5OQFlmIiKSuZ8aiHfj76bBvga5A=";
+
+  # Only the unit tests run here. Every cli integration test builds a fixture
+  # whose first step is `xattr::set(…, "user.furrow-test", …)`, and the sandbox
+  # /tmp is a tmpfs that answers EOPNOTSUPP for user.* xattrs, so all 54 of them
+  # die in setup — same reason forks_files_links_modes_and_xattrs is skipped, in
+  # the one lib test that touches an xattr. Upstream's CI runs the whole suite on
+  # a filesystem that supports them.
+  cargoTestFlags = [ "--lib" ];
+  checkFlags = [
+    "--skip"
+    "forks_files_links_modes_and_xattrs"
+  ];
+
+  meta = with lib; {
+    description = "Local-first working-state snapshots for agentic development";
+    homepage = "https://github.com/Agent-Field/furrow";
+    changelog = "https://github.com/Agent-Field/furrow/releases/tag/v${version}";
+    license = licenses.asl20;
+    # Thirteen source files use std::os::unix with no windows guards, so the
+    # upstream release has no windows asset either.
+    platforms = platforms.unix;
+    mainProgram = "furrow";
+  };
+}

packages/codeaf/package.nix

@@ -0,0 +1,94 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  furrow,
+}:
+
+# codeaf carries a furrow inside itself: internal/furrowbin embeds whatever is
+# staged in internal/furrowbin/cache and, on first use, writes it out to
+# ~/.codeaf/bin/furrow-<version>. Upstream stages the GitHub release asset there,
+# whose bytes are someone else's glibc-dynamic build that no Nix phase ever
+# touched, so the file that lands in the state root cannot start here. Staging a
+# rebuilt furrow is not an option either: upstream's fetcher re-checks the sha256
+# named in internal/furrowbin/pin.json and would refuse one. So this build stages
+# nothing, and hands over ./furrow.nix through CODEAF_FURROW instead, which
+# internal/furrow reads before it looks at the embedded copy at all. Nothing of
+# furrow's ends up in the codeaf binary; without that variable codeaf looks for
+# furrow on PATH, the way a plain `go build` does.
+#
+# A codeaf run without this wrapper is not the same program: it has no furrow
+# unless one is on PATH.
+buildGoModule rec {
+  pname = "codeaf";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "Agent-Field";
+    repo = "CodeAF";
+    rev = "v${version}";
+    hash = "sha256-F4rRDNrTCF8/cj6g0KM41+gNdzvTWw5Vj2N0OJp+vCc=";
+  };
+
+  vendorHash = "sha256-eIocnhp3uGk+wG0kprRie0Csms+Deqxy3K3HuI1vJyM=";
+
+  env.CGO_ENABLED = 0;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # The shipped binary carries the packed manual rather than the raw Markdown.
+  tags = [ "codeaf_packed_manual" ];
+
+  subPackages = [ "cmd/codeaf" ];
+
+  # Upstream's own suite is a CI matrix (make test / make check) with network
+  # and timing assumptions; it is not buildGoModule-shaped.
+  doCheck = false;
+
+  # `make build` runs a host-side step before compiling: packing the manual into
+  # what the codeaf_packed_manual tag embeds. It is built for the build machine
+  # even when codeaf targets another platform, hence the unset GOOS/GOARCH. The
+  # vendoring derivation runs preBuild too, before vendor/ exists, and this step
+  # needs the vendored dependencies, so it waits for it. Upstream's other step,
+  # staging the furrow release, is deliberately not run: see ./furrow.nix.
+  preBuild = ''
+    if [ -d vendor ]; then
+      env -u GOOS -u GOARCH go generate ./internal/manual
+    fi
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/codeaf --set CODEAF_FURROW ${furrow}/bin/furrow
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/Agent-Field/codeaf/internal/buildinfo.rev=${version}"
+    "-X github.com/Agent-Field/codeaf/internal/buildinfo.dirty=false"
+  ];
+
+  passthru = {
+    inherit furrow;
+    category = "AI Coding Agents";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#codeaf"
+      # furrow.nix is not a flake output, so nix-update never touches it: bump it
+      # by hand alongside the version codeaf pins in internal/furrowbin/pin.json.
+    ];
+  };
+
+  meta = with lib; {
+    description = "Coding harness and software factory for open models: hand off work and watch every project from one terminal";
+    homepage = "https://github.com/Agent-Field/CodeAF";
+    changelog = "https://github.com/Agent-Field/CodeAF/blob/v${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    # Runs the furrow built from source by ./furrow.nix, not the release asset
+    # upstream would have embedded.
+    mainProgram = "codeaf";
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

packages/ds4/default.nix

@@ -1,2 +1 @@
-{ pkgs, ... }:
+{ pkgs, ... }: pkgs.callPackage ./package.nix { }
-pkgs.callPackage ./package.nix { }

packages/ds4/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "ds4";
-  version = "0-unstable-2026-08-05";
+  version = "0-unstable-2026-09-20";
 
   src = fetchFromGitHub {
     owner = "antirez";
     repo = "ds4";
-    rev = "b0309611041655f4e45671cfd9c9886aff161406";
+    rev = "0aaea5a238fb41a35106a551e73c8409dfb751ac";
-    hash = "sha256-yBPQqX8oI9fElGiXfz72iWwIS8ZQpK4Bl9TWLZSa6JU=";
+    hash = "sha256-Bo/td1HwVjw6bwz3BDwTP+ZSudkVFCo2aIVK4axvmXg=";
   };
 
   nativeBuildInputs = [

packages/freebuff/package.nix

@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "0.0.142";
+  version = "0.2.19";
 
   freebuffSrc = fetchurl {
     url = "https://registry.npmjs.org/freebuff/-/freebuff-${version}.tgz";
-    hash = "sha256-8DSNy/wJqLzp7mu2xsPBlMv69aBMIBNVva3SAaV13Tw=";
+    hash = "sha256-vIypYxwCuA/PKpldhwuFVNqwtm4UXZM6xInKZ5A+u9w=";
   };
 
   pkgTar = fetchurl {
@@ -48,14 +48,14 @@ let
 
   binarySrc = fetchurl {
     url = "https://github.com/CodebuffAI/codebuff-community/releases/download/freebuff-v${version}/freebuff-linux-x64.tar.gz";
-    hash = "sha256-SuV5djfrvRZZ59p+dUyiux+OmEMOxscuIU5/YDGWHYI=";
+    hash = "sha256-8EfFlhc6k0fEDws3w4kw1rIPQr5RXZHtekjxwouWW7Q=";
   };
 
 in
 
 stdenv.mkDerivation rec {
   pname = "freebuff";
-  version = "0.0.142";
+  version = "0.2.19";
 
   src = freebuffSrc;
 

packages/freetoken/default.nix

@@ -1,5 +1,10 @@
 {
   pkgs,
+  inputs,
   ...
 }:
-pkgs.callPackage ./package.nix { }
+# freetoken pins torch>=2.11,<2.12 and triton==3.6.0, but current
+# nixos-unstable ships torch 2.13 + triton 3.7 and no older torch. Build it
+# with the pinned nixpkgs-torch211 revision (CUDA 12.9 / torch-bin 2.11).
+inputs.nixpkgs-torch211.legacyPackages.${pkgs.stdenv.hostPlatform.system}.callPackage ./package.nix
+  { }

packages/freetoken/package.nix

@@ -81,14 +81,14 @@ let
 in
 py.buildPythonApplication (finalAttrs: {
   pname = "freetoken";
-  version = "0.1.2";
+  version = "0.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "FlashML-org";
     repo = "FreeToken";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0MhuubuTjNvtQZxisC2cg1dJeR+A6wZ901H5FRv+l+c=";
+    hash = "sha256-59itjnwDr4P7I/ZLIbkNw9/8CCPvTP7yNWl9ogBnZ3o=";
   };
 
   # setup.py imports torch.utils.cpp_extension at build time and compiles two

packages/g3/default.nix

@@ -0,0 +1,5 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix { }

packages/g3/package.nix

@@ -0,0 +1,95 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  cmake,
+  libx11,
+  libxtst,
+  llvmPackages,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "g3";
+  # Upstream has no git tags or releases; pin main and let nix-update
+  # track the branch. Version shape matches nix-update --version=branch=main
+  # for a tagless repository (package version is 0.1.0 upstream).
+  version = "0-unstable-2026-09-06";
+
+  src = fetchFromGitHub {
+    owner = "dhanji";
+    repo = "g3";
+    rev = "9793144520d290a9ea621a06cf7d8322e6fa4a35";
+    hash = "sha256-s4QlOah7ffoFjiTw2nO/SbCbvIRxr4HB/3pOpQpGWRM=";
+  };
+
+  # Cargo.lock has a git dependency (tree-sitter-haskell); cargoHash /
+  # fetchCargoVendor covers registry + git sources.
+  cargoHash = "sha256-6dvN4//NNuo9s5QzTcrxYiNkxP0Ivysg6f1F9soFrL4=";
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    # llama-cpp-sys-2 runs bindgen, which needs libclang.
+    llvmPackages.libclang
+  ];
+
+  buildInputs = [
+    openssl
+    libx11
+    libxtst
+  ];
+
+  # bindgen (via llama-cpp-sys-2) needs libclang and the C library headers.
+  env = {
+    LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+    BINDGEN_EXTRA_CLANG_ARGS = "-isystem ${lib.getDev stdenv.cc.libc}/include";
+  };
+
+  # Root package only builds/installs its own bins; studio is a sibling
+  # workspace member. Match upstream install.sh: ship g3 and studio
+  # (renamed to g3-studio).
+  cargoBuildFlags = [
+    "-p"
+    "g3"
+    "-p"
+    "studio"
+  ];
+  cargoInstallFlags = [
+    "-p"
+    "g3"
+    "-p"
+    "studio"
+  ];
+
+  # Provider and computer-control tests need network, LLM credentials, and a
+  # display; not runnable in the Nix sandbox.
+  doCheck = false;
+
+  # Upstream install.sh names the companion workspace manager g3-studio.
+  postInstall = ''
+    mv "$out/bin/studio" "$out/bin/g3-studio"
+  '';
+
+  passthru = {
+    category = "AI Coding Agents";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#g3"
+      "--version=branch=main"
+    ];
+  };
+
+  meta = with lib; {
+    description = "AI coding agent that writes code and executes commands, with multi-provider LLM support, context compaction, and desktop automation";
+    homepage = "https://github.com/dhanji/g3";
+    # Cargo.toml declares MIT; the repository ships no LICENSE file.
+    license = licenses.mit;
+    sourceProvenance = with sourceTypes; [ fromSource ];
+    mainProgram = "g3";
+    platforms = platforms.unix;
+  };
+}

packages/graphify/package.nix

@@ -6,14 +6,18 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "graphify";
-  version = "0.9.35";
+  version = "0.9.77";
   pyproject = true;
 
+  # Do not bump to the v1.0.0 tag: it is a stale branch 2126 commits behind
+  # v0.9.77 (tagged 2026-04-05, pyproject still says graphifyy 0.1.10) and was
+  # never published to PyPI, where 0.9.77 is the latest release. nix-update
+  # picks v1.0.0 as the highest tag, so check PyPI before taking its result.
   src = fetchFromGitHub {
-    owner = "safishamsi";
+    owner = "Graphify-Labs";
     repo = "graphify";
     rev = "v${version}";
-    hash = "sha256-HESowqiR5c6WaeiNj1WDSYBzrrcpZQwqaKwQxroePD8=";
+    hash = "sha256-CvJ6GoV1nSzFGfLQbzKSHDUNOuOPQZaYOf/idcSHkPw=";
   };
 
   build-system = with python3Packages; [
@@ -24,7 +28,7 @@ python3Packages.buildPythonApplication rec {
   # Missing grammars will be downloaded by tree-sitter at runtime on demand.
   dependencies = with python3Packages; [
     networkx
-    datasketch
+    numpy
     rapidfuzz
     tree-sitter
     tree-sitter-python
@@ -40,6 +44,9 @@ python3Packages.buildPythonApplication rec {
   # either `>` (versioned) or `"` (bare) via alternation. This also avoids
   # prefix collisions (e.g. tree-sitter-c vs tree-sitter-c-sharp).
   postPatch = ''
+    # relax the build-backend pin: nixpkgs' setuptools is older than 83, but
+    # the PEP 639 license metadata graphify relies on needs only >=77.
+    sed -i 's/setuptools>=83\.[0-9.]*/setuptools/' pyproject.toml
     sed -i \
       -e '/tree-sitter-typescript>\|tree-sitter-typescript"/d' \
       -e '/tree-sitter-go>\|tree-sitter-go"/d' \
@@ -74,7 +81,6 @@ python3Packages.buildPythonApplication rec {
       "nix-update"
       "--flake"
       ".#graphify"
-      "--version=branch=main"
     ];
   };
 

packages/haivemind/package.nix

@@ -6,7 +6,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "haivemind";
-  version = "0.1.0";
+  version = "0-unstable-2026-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {

packages/hipengine/default.nix

@@ -1,2 +1,30 @@
-{ pkgs, ... }:
+{
-pkgs.callPackage ./package.nix { }
+  pkgs,
+  ...
+}:
+# hipEngine >= 0.5.0 requires llguidance >= 1.8,<2; nixpkgs only provides
+# 1.7.x. Override nixpkgs' llguidance to 1.8.0 and hand the resulting
+# interpreter/package set to the package.
+let
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      llguidance = super.llguidance.overridePythonAttrs (old: rec {
+        version = "1.8.0";
+        src = pkgs.fetchFromGitHub {
+          owner = "guidance-ai";
+          repo = "llguidance";
+          tag = "v${version}";
+          hash = "sha256-/rHTefKTq5ch38NqbcLYTXBJwkW+WzG5OFvignDIie4=";
+        };
+        cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+          pname = "llguidance";
+          inherit src version;
+          hash = "sha256-aa9R+6xgFVGAD3snHbkPRF5jMYwC3DFNjXcUtaOzDbU=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.callPackage ./package.nix {
+  python3Packages = python.pkgs;
+}

packages/hipengine/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hipengine";
-  version = "0.3.0";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "shisa-ai";
     repo = "hipEngine";
     rev = "v${version}";
-    hash = "sha256-lnYsXTxke5LLMbHOt6i2FM8IrnHCimC/va1fJL5G4PQ=";
+    hash = "sha256-7FQZuExTTqcMKZkCRzLC5nYLpGytswhEsBTUliQqoTI=";
   };
 
   build-system = with python3Packages; [
@@ -23,6 +23,7 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     fastapi
     jinja2
+    llguidance
     numpy
     safetensors
     tokenizers

packages/kubernetes-mcp-server/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubernetes-mcp-server";
-  version = "0.0.66";
+  version = "0.0.67";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "kubernetes-mcp-server";
     rev = "v${version}";
-    hash = "sha256-vnJxSCfnpvOZJXQpKrCAW4QKt5R2PJDYQevA7O1uXZg=";
+    hash = "sha256-rejF9JsszB3ZirZhoK1VDbCH/P0Xzmh4TJw5j+okj+M=";
   };
 
-  vendorHash = "sha256-gbqoT4X+wVOEktHm7jaAH9vHrUBrYgR8OjyFz1ljP6k=";
+  vendorHash = "sha256-TSB2jAWh2PlDHpvzA/rrBbjaR8sgyjivDO0vsbcuvgg=";
 
   env.CGO_ENABLED = 0;
 

packages/kyojin/check-jit.py

@@ -0,0 +1,46 @@
+"""Compile Kyojin's JIT kernels; --gpu also loads them through torch's HIP runtime."""
+import ctypes
+import importlib
+import os
+from pathlib import Path
+import sys
+
+from exllamav3.util import hip_compiler
+from exllamav3.util.hip_lib import load_hip_runtime
+
+sdk = Path(os.environ["EXL3_ROCM_SDK"])
+assert Path(hip_compiler.hipcc()) == sdk / "bin/hipcc"
+assert Path(os.environ["HIP_DEVICE_LIB_PATH"]).is_dir()
+assert (sdk / "amdgcn/bitcode").is_dir()
+if os.environ.get("KYOJIN_REQUIRE_SDK") == "1":
+    assert hip_compiler.warning() is None, hip_compiler.warning()
+print(hip_compiler.describe(), flush=True)
+
+lib = None
+if "--gpu" in sys.argv:
+    import torch
+
+    # Also exercise the runtime bitcode path: merely loading a HIP module
+    # does not catch incompatible device libraries in CLR/COMGR.
+    x = torch.ones((32, 32), device="cuda", dtype=torch.float32)
+    assert torch.equal(x @ x, torch.full_like(x, 32))
+    torch.cuda.synchronize()
+    lib = load_hip_runtime()
+    lib.hipModuleLoad.argtypes = [ctypes.POINTER(ctypes.c_void_p), ctypes.c_char_p]
+    lib.hipModuleUnload.argtypes = [ctypes.c_void_p]
+
+for module, function, args in [
+    ("gr_mix_hip", "compile_hsaco", ()),
+    ("exllamav3.modules.attention_fn.qsa_prefill_hip", "compile_hsaco", ()),
+    ("exllamav3.modules.ple_fn.ple_hip", "compile_hsaco", ()),
+    ("exllamav3.vendor.fla.hip.gdn_fused_h_hip", "_compile", ("", "gfx1151")),
+    ("exllamav3.vendor.fla.hip.kda_fused_h_hip", "_compile", ("", "gfx1151")),
+]:
+    path = Path(getattr(importlib.import_module(module), function)(*args))
+    # HIP accepts ELF, offload bundles, and compressed offload bundles (CCOB).
+    assert path.read_bytes().startswith((b"\x7fELF", b"__CLANG_OFFLOAD_BUNDLE__", b"CCOB")), path
+    if lib is not None:
+        handle = ctypes.c_void_p()
+        assert lib.hipModuleLoad(ctypes.byref(handle), os.fsencode(path)) == 0, path
+        assert lib.hipModuleUnload(handle) == 0, path
+    print(f"OK: {module}", flush=True)

packages/kyojin/default.nix

@@ -0,0 +1,13 @@
+{
+  pkgs,
+  inputs,
+  jitRocmSdk ? null,
+  ...
+}:
+# The HIP extension has to be compiled against a ROCm build of PyTorch, and the
+# only ROCm torch in this flake with a cached binary is the one from the pinned
+# nixpkgs-torch211 input (2.11 + ROCm 7.2, python 3.13). Current nixos-unstable
+# ships torch 2.13, whose ROCm build fails to configure in nixpkgs and is not
+# on cache.nixos.org.
+inputs.nixpkgs-torch211.legacyPackages.${pkgs.stdenv.hostPlatform.system}.callPackage ./package.nix
+  { inherit jitRocmSdk; }

packages/kyojin/package.nix

@@ -0,0 +1,251 @@
+{
+  lib,
+  stdenv,
+  pkgs,
+  python3,
+  fetchFromGitHub,
+  makeWrapper,
+  rocmPackages,
+  # Override only the serving toolchain; torch and the extension keep their ROCm.
+  jitRocmSdk ? null,
+}:
+
+let
+  py = python3.pkgs;
+
+  # Kyojin is the Yamz fork of ExLlamaV3: a Python package plus a C++ extension
+  # that torch's cpp_extension cross-compiles to HIP code objects. Upstream
+  # only supports AMD Strix Halo, so the kernels are built for gfx1151 alone.
+  rocmArch = "gfx1151";
+
+  version = "1.3";
+
+  src = fetchFromGitHub {
+    owner = "Yamz-Labs";
+    repo = "kyojin";
+    rev = "v${version}";
+    hash = "sha256-/DPoqW/iaLXRAH8XF5RdE+K5YS4jZT6Sic6QeCDQMlU=";
+  };
+
+  # setup.py passes EXL3_ROCM_DEV_INCLUDE as -I to every translation unit. The
+  # AMD wheels ship one devel tree holding hipsparse/ and thrust/; nixpkgs
+  # splits them per package, so join the include dirs. torch's public HIP
+  # headers also pull hipsolver/, and it no longer vendors pybind11.
+  rocmDevInclude = pkgs.symlinkJoin {
+    name = "kyojin-rocm-dev-include";
+    paths = map lib.getDev (
+      [ py.pybind11 ]
+      ++ [
+        rocmPackages.clr
+        rocmPackages.hipblas
+        rocmPackages.hipblaslt
+        rocmPackages.hipcub
+        rocmPackages.hipfft
+        rocmPackages.hiprand
+        rocmPackages.hipsparse
+        rocmPackages.hipsolver
+        rocmPackages.rocblas
+        rocmPackages.rocprim
+        rocmPackages.rocrand
+        rocmPackages.rocsolver
+        rocmPackages.rocsparse
+        rocmPackages.rocthrust
+      ]
+    );
+  };
+
+  # torch's HIP path in cpp_extension expects one ROCM_HOME holding bin/hipcc,
+  # the headers and the amdgcn bitcode; nixpkgs ships them separately.
+  rocmToolkit = pkgs.symlinkJoin {
+    name = "kyojin-rocm-toolkit";
+    paths = [
+      rocmPackages."rocm-core"
+      rocmPackages."rocm-runtime"
+      rocmPackages."rocm-device-libs"
+      rocmPackages."rocm-comgr"
+      rocmPackages.clr
+      (lib.getBin rocmPackages.hipcc)
+      rocmPackages.rocblas
+      rocmPackages.hipblas
+      rocmPackages.hipblas-common
+      rocmPackages.hipblaslt
+      rocmPackages.hipsparse
+      rocmPackages.hipsolver
+      rocmPackages.hiprand
+      rocmPackages.rocrand
+      rocmPackages.hipfft
+      rocmPackages.rocsparse
+      rocmPackages.rocsolver
+      rocmPackages.rocthrust
+      rocmPackages.rocprim
+      rocmPackages.hipcub
+    ];
+    # The setup hooks of the joined packages would rewrite build flags; the
+    # compiler only needs the files.
+    postBuild = ''
+      rm -rf $out/nix-support
+    '';
+  };
+
+  # The library: exllamav3 plus the compiled exllamav3_ext module.
+  library = py.buildPythonPackage {
+    inherit src version;
+    pname = "kyojin";
+
+    format = "pyproject";
+    build-system = with py; [
+      setuptools
+      wheel
+    ];
+
+    nativeBuildInputs = [
+      py.ninja
+      rocmPackages."rocm-runtime"
+    ];
+
+    buildInputs = [ (lib.getBin rocmPackages.hipcc) ];
+
+    propagatedBuildInputs = with py; [
+      aiohttp
+      huggingface-hub
+      jinja2
+      llguidance
+      marisa-trie
+      numpy
+      pillow
+      pydantic
+      pyyaml
+      rich
+      safetensors
+      tokenizers
+      torchWithRocm
+      typing-extensions
+    ];
+
+    env = {
+      PYTORCH_ROCM_ARCH = rocmArch;
+      ROCM_PATH = "${rocmToolkit}";
+      ROCM_HOME = "${rocmToolkit}";
+      HIP_PATH = "${rocmToolkit}";
+      HIPCC = "${rocmToolkit}/bin/hipcc";
+      HIP_DEVICE_LIB_PATH = "${rocmPackages."rocm-device-libs"}/amdgcn/bitcode";
+      # Upstream build scripts look these up to find the ROCm devel tree.
+      EXL3_ROCM_SDK = "${rocmToolkit}";
+      EXL3_ROCM_DEV_INCLUDE = "${rocmDevInclude}/include";
+      # Default defines of upstream build.sh (tools/strix_halo/rebuild.sh).
+      EXL3_HIP_DEFINES = "EXL3_HIP_STG_PAD";
+    };
+
+    # setup.py pulls the extension source list and the arch helper with
+    # `from exllamav3...import ...`, which runs the package __init__ and
+    # therefore exllamav3/ext.py. That module JIT-compiles the extension when no
+    # precompiled exllamav3_ext is importable, i.e. during every wheel build
+    # (and it wants a writable $HOME for it). Register an empty `exllamav3`
+    # package first so only the two leaf modules are imported, and load
+    # build_config without the package wrapper.
+    postPatch = ''
+      sed -i '1i import sys as _sys, types as _types; _exl3_pkg = _types.ModuleType("exllamav3"); _exl3_pkg.__path__ = ["exllamav3"]; _sys.modules.setdefault("exllamav3", _exl3_pkg)' setup.py
+      sed -i 's|^from exllamav3\.exllamav3_ext\.build_config import get_sources as _get_sources$|import sys as _exl3_sys; _exl3_sys.path.insert(0, "exllamav3/exllamav3_ext"); from build_config import get_sources as _get_sources; _exl3_sys.path.pop(0)|' setup.py
+      grep -q 'from build_config import' setup.py
+
+      # Upstream serves these from the checkout (pip install -e .); the wheel only
+      # packages what pyproject lists, and three things are read out of the
+      # installed package at run time: the .hip sources the JIT kernels compile,
+      # the qsa_proof marker gating the QSA prefill kernel, and the dense-GEMM
+      # tuning seed (without it every start re-tunes for ~7 minutes).
+      sed -i 's|^    "exllamav3_ext/\*\*/\*",$|&\n    "**/*.hip",\n    "**/*.ok",\n    "model/dense_gemm_tune_seed.txt",|' pyproject.toml
+      grep -q '"\*\*/\*.hip"' pyproject.toml
+    '';
+
+    # tests/ needs a real gfx1151 GPU and the published model packs.
+    doCheck = false;
+
+    meta = with lib; {
+      description = "Inference engine for 100 GB-class EXL3 MoE models on AMD Strix Halo (gfx1151, ROCm 7)";
+      homepage = "https://github.com/Yamz-Labs/kyojin";
+      changelog = "https://github.com/Yamz-Labs/kyojin/releases";
+      license = licenses.mit;
+      sourceProvenance = with sourceTypes; [ fromSource ];
+      # HIP code objects are gfx1151-only and ROCm is Linux-only.
+      platforms = platforms.linux;
+    };
+  };
+
+  python = py.python.withPackages (_: [ library ]);
+  jitSdk = if jitRocmSdk == null then rocmToolkit else jitRocmSdk;
+in
+stdenv.mkDerivation {
+  inherit src version;
+  pname = "kyojin";
+
+  # Only the wrappers are installed here: the serve scripts are plain scripts,
+  # they import their siblings by path, and the module itself is in `library`.
+  #
+  # Upstream `tools/strix_halo/env.sh` is sourced before serving, and on a
+  # distro box that brings a system `cc` (the AMD Triton backend compiles a
+  # CPython glue module at runtime, and again per kernel launcher) plus a hipcc
+  # for the JIT HIP kernels (qsa prefill, gdn, kda, ple). Nix gives the wrapper
+  # neither, so export them here instead: Triton takes the compiler from $CC,
+  # exllamav3 finds hipcc under $EXL3_ROCM_SDK, and hipclang only finds the
+  # amdgcn bitcode through $HIP_DEVICE_LIB_PATH (hipcc's own DEVICE_LIB_PATH is
+  # not enough for a --genco call). The ROCm paths stay out of LD_LIBRARY_PATH
+  # (upstream Trap 1/5: a second libhsa segfaults torch), and PYTHONPATH gets
+  # `gr/`: upstream env.sh puts the repo root there so `import gr_mix_hip` (the
+  # hand-written gated-residual WMMA kernel the server asks for with
+  # EXL3_GR_HIP=1) resolves, and it is not part of the wheel either.
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    for model in glm mimo qwen; do
+      makeWrapper ${python}/bin/python $out/bin/kyojin-serve-$model \
+        --set PYTORCH_ROCM_ARCH ${rocmArch} \
+        --set CC ${stdenv.cc}/bin/cc \
+        --set EXL3_ROCM_SDK ${jitSdk} \
+        --set HIP_DEVICE_LIB_PATH ${rocmPackages."rocm-device-libs"}/amdgcn/bitcode \
+        --set EXL3_EXPANDABLE_SEGMENTS 0 \
+        --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]} \
+        --prefix PYTHONPATH : ${src}/gr \
+        --add-flags "${src}/tools/$model/serve.py"
+    done
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit python rocmArch;
+    pythonPackage = library;
+    jitRocmSdk = jitSdk;
+    tests.jit =
+      pkgs.runCommand "kyojin-jit-check"
+        {
+          EXL3_ROCM_SDK = jitSdk;
+          # CLR/COMGR also reads this variable. Newer bitcode crashes torch
+          # matmul; a custom hipcc must select its own bitcode in its subprocess.
+          HIP_DEVICE_LIB_PATH = "${rocmPackages."rocm-device-libs"}/amdgcn/bitcode";
+          EXL3_EXPANDABLE_SEGMENTS = "0";
+          PYTHONPATH = "${src}/gr";
+          KYOJIN_REQUIRE_SDK = lib.boolToString (jitRocmSdk != null);
+        }
+        ''
+          export HOME="$TMPDIR"
+          ${python}/bin/python ${./check-jit.py}
+          touch "$out"
+        '';
+    category = "AI Inference";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#kyojin"
+    ];
+  };
+
+  meta = library.meta // {
+    mainProgram = "kyojin-serve-qwen";
+  };
+}

packages/llama-cpp/package.nix

@@ -18,7 +18,7 @@ let
   # Upstream release tag. Bump with:
   #   nix flake prefetch github:ggml-org/llama.cpp/b<NNNN>
   # then update buildNumber and the src hash.
-  buildNumber = "9645";
+  buildNumber = "11439";
 
   # HIP flags from the llm-engine.nix bring-up config. The -I paths for
   # hipBLASLt/rocWMMA are dropped because this tag's HIP backend links
@@ -51,7 +51,7 @@ in
       repo = "llama.cpp";
       tag = "b${buildNumber}";
       # Tarball hash (this tag has no submodules).
-      hash = "sha256-ntRwfI2/yVqi3QjQfO0ZajMFSD8r/6XPiuy0X2BhwVk=";
+      hash = "sha256-9KUkThRm+kvYOguP08JOPtjQjtDsDqgh1e50NdR0V5I=";
     };
 
     # The embedded web UI is disabled via cmakeFlags, so none of the npm

packages/loop/default.nix

@@ -1,2 +1 @@
-{ pkgs, ... }:
+{ pkgs, ... }: pkgs.callPackage ./package.nix { }
-pkgs.callPackage ./package.nix { }

packages/marmel/default.nix

@@ -0,0 +1,5 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix { }

packages/marmel/package.nix

@@ -0,0 +1,93 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  cacert,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "marmel";
+  # Upstream publishes no git tags, so this is pinned to the 1.0.0 release
+  # commit ("1.0.0 (#6)").
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Na1w";
+    repo = "marmel";
+    rev = "d6627d7cf3bf509d1e6db0d9d78736116e92e82a";
+    hash = "sha256-UlrSp/n3og0GAQXzISsB24OfK3qOUPE7jYOkEbZ2neI=";
+  };
+
+  cargoHash = "sha256-etqW3xcxkiNfkiPxl/Emt5pQCkNnoIhHFkX0Zqfs4rc=";
+
+  nativeCheckInputs = [ cacert ];
+
+  # The test suite builds `reqwest::Client`s, and rustls rejects construction
+  # outright when no system trust store is found ("No CA certificates were
+  # loaded from the system"). The sandbox has no /etc/ssl, so point the tests
+  # at nixpkgs' bundle. Build-time only; the installed binary still uses the
+  # host's trust store at runtime.
+  preCheck = ''
+    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+  '';
+
+  # Serialise the test harness. The lib suite shares process-global worker
+  # registries and steer/abort buses (src/orchestrator/workers.rs,
+  # src/orchestrator/bus.rs, src/orchestrator/preemption.rs), so the
+  # manager-loop tests fail nondeterministically when the harness runs them on
+  # parallel threads: rebuilding one unchanged derivation yielded 3 failures,
+  # then 1 failure, then 0 with serial threads. Drop this flag once upstream
+  # makes that state per-instance.
+  #
+  # The two sandbox-exec tests are skipped. They re-exec `sh` through
+  # `marmel --internal-sandbox-exec`, and apply_landlock_linux() allow-lists
+  # FHS paths only (/usr, /bin, /lib, /opt, /etc, /var) plus /tmp. Landlock
+  # matches inodes rather than symlinked views, and every binary on NixOS
+  # resolves into the store (`/bin/sh` is
+  # /nix/store/<hash>-bash-interactive-5.3p9/bin/bash), so the exec is denied:
+  # "Failed to exec shell in sandbox: Permission denied (os error 13)". Checked
+  # against this build on a NixOS host, where the same command succeeds once
+  # the workspace root is `/` and therefore covers /nix/store. Inside the build
+  # sandbox the tests are doubly impossible: /usr, /lib, /run and /var do not
+  # exist, so the `if let Ok(fd)` guards silently drop those rules, and
+  # /etc/resolv.conf is absent because the sandbox has no network. 342 of 344
+  # tests still run. Upstream main still carries the FHS-only list; drop these
+  # skips if that ever gains /nix/store.
+  cargoTestFlags = [
+    "--"
+    "--test-threads=1"
+    "--skip"
+    "harness::sandbox::tests::test_internal_sandbox_exec_dev_null_and_dns"
+    "--skip"
+    "harness::sandbox::tests::test_internal_sandbox_cross_directory_rename"
+  ];
+
+  # Role prompts are embedded with `include_str!`, so the binary needs no
+  # runtime data files. The annotated example configs are the de-facto
+  # first-run documentation, since a backend URL and model are mandatory.
+  postInstall = ''
+    install -Dm644 marmel.toml.example $out/share/doc/${pname}/examples/marmel.toml.example
+    install -Dm644 marmel.toml.cloud $out/share/doc/${pname}/examples/marmel.toml.cloud
+  '';
+
+  passthru = {
+    category = "AI Coding Agents";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#marmel"
+      "--version=branch=main"
+    ];
+  };
+
+  meta = {
+    description = "Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend";
+    homepage = "https://github.com/Na1w/marmel";
+    # Upstream README states MIT, but the repository ships no LICENSE file and
+    # Cargo.toml has no license field.
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    mainProgram = "marmel";
+    platforms = lib.platforms.unix;
+  };
+}

packages/mcp-gateway/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcp-gateway";
-  version = "3.4.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "MikkoParkkola";
     repo = "mcp-gateway";
     rev = "v${version}";
-    hash = "sha256-shn2cv463SnegamsMu6NmfylnNaFzGJLoL2H7QhETY8=";
+    hash = "sha256-fcH2einyG9bNNLKZPomAlfGonNw0rw+TuwlYw38531E=";
   };
 
-  cargoHash = "sha256-XuOYuYapb2l7RHQIgLDfcDPtSdMDpEgti8Ud5ssuGC8=";
+  cargoHash = "sha256-3QI7s5IpxbW9nvnk3X3xuUopNQJZftANN5BtbQNhKrY=";
 
   nativeBuildInputs = [ pkg-config ];
 

packages/omniroute/package.nix

@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "3.8.49";
+  version = "3.8.50";
   npmTarball = fetchurl {
     url = "https://registry.npmjs.org/omniroute/-/omniroute-${version}.tgz";
-    hash = "sha256-fcGsAxOdv1ZSwt24eHJu97lyRATKBw8rYeFvGTRhxYs=";
+    hash = "sha256-c4xYrx+q6MV+tkOpOdEZH41+CD2Sle9haH0r/wSHjCk=";
   };
 in
 
@@ -23,12 +23,16 @@ buildNpmPackage (finalAttrs: {
     owner = "diegosouzapw";
     repo = "OmniRoute";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nRLziV4NWPoa0ev57DV7jmAvLpL/1MP1EMZO2/drrTU=";
+    hash = "sha256-+2FMc9wrvPtQS3+mGsBVvKrd5RprYe/r/GJvjAVMBpc=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-R0u93MLUUWC8xFgq4S0Aj/7wg4pygTKwxP/eWkWMgCw=";
+  # Upstream's package-lock omits `resolved` URLs for some entries, which the
+  # v1 fetcher drops from the cache (npm then fails with ENOTCACHED).
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-wa5vQMYugA8E7lXOh4lgNH7JNbKOinNaW6Zk8Mw2e8k=";
 
   # Skip Next.js build (requires network for Google Fonts).
   # Pre-built dist/ is copied from the npm tarball in preConfigure.

packages/open-code-review/default.nix

@@ -0,0 +1,5 @@
+{
+  pkgs,
+  ...
+}:
+pkgs.callPackage ./package.nix { }

packages/open-code-review/opencode-plugin.nix

@@ -0,0 +1,92 @@
+# OpenCode plugin for OpenCodeReview, built from the same source revision as
+# the CLI (see package.nix). Ships the plugin TypeScript file plus the runtime
+# node_modules resolved from the plugin's package-lock.json, so OpenCode can
+# import `@opencode-ai/plugin` (v1.x) and `@opencode/plugin` (v2.x) without a
+# network install.
+{
+  lib,
+  stdenv,
+  nodejs,
+  fetchNpmDeps,
+  src,
+  version,
+}:
+
+let
+  pluginDir = "plugins/open-code-review/opencode";
+
+  lockfileCopy = ''
+    cp ${pluginDir}/package-lock.json ./package-lock.json
+    chmod +w package-lock.json
+  '';
+
+  npmDeps = fetchNpmDeps {
+    name = "open-code-review-opencode-plugin-npm-deps";
+    inherit src;
+    postPatch = lockfileCopy;
+    hash = "sha256-s5BO+JJJ9qZkKRTDmWyfBFVKB9GEeqObzyJ1lkORQo0=";
+  };
+in
+stdenv.mkDerivation {
+  pname = "open-code-review-opencode-plugin";
+  inherit version src;
+
+  # The lockfile lives in plugins/open-code-review/opencode/, but fetchNpmDeps
+  # and npm ci expect it at the package root.
+  postPatch = lockfileCopy;
+
+  # Exposed as an env var; used as the offline npm cache in installPhase.
+  inherit npmDeps;
+
+  # No build steps needed: the plugin is a single .ts file that OpenCode's
+  # runtime transpiles on the fly; only node_modules is materialized.
+  dontBuild = true;
+  dontConfigure = true;
+
+  nativeBuildInputs = [ nodejs ];
+
+  # OpenCode resolves plugin imports Node-style: node_modules next to the
+  # plugin file, or in any parent directory (resolved via the file's realpath).
+  # Install both the plugin file and node_modules so the plugin works whether
+  # users symlink the file only, the plugin dir, or point OpenCode at the
+  # store path directly.
+  installPhase = ''
+    runHook preInstall
+
+    pushd ${pluginDir}
+
+    # NOTE: upstream's package.json declares the plugin SDKs as
+    # devDependencies, so --omit=dev must NOT be used — it would install
+    # nothing. The full lockfile install is required.
+    npm ci \
+      --ignore-scripts \
+      --no-audit \
+      --no-fund \
+      --no-progress \
+      --loglevel=error \
+      --offline \
+      --cache "$npmDeps"
+
+    pluginOut=$out/share/open-code-review/opencode
+    mkdir -p "$pluginOut"
+    cp open-code-review.ts "$pluginOut/"
+    cp -r node_modules "$pluginOut/"
+
+    popd
+    runHook postInstall
+  '';
+
+  passthru = {
+    # The plugin speaks the CLI's JSON protocol; use it with a matching CLI
+    # version (both are built from the same source revision here).
+    forCli = "open-code-review";
+  };
+
+  meta = with lib; {
+    description = "OpenCode plugin exposing OpenCodeReview as native tools and slash commands";
+    homepage = "https://github.com/alibaba/open-code-review";
+    changelog = "https://github.com/alibaba/open-code-review/releases/tag/v${version}";
+    license = licenses.asl20;
+    platforms = platforms.all;
+  };
+}

packages/open-code-review/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  callPackage,
+}:
+
+buildGoModule rec {
+  pname = "open-code-review";
+  version = "1.12.12";
+
+  src = fetchFromGitHub {
+    owner = "alibaba";
+    repo = "open-code-review";
+    rev = "v${version}";
+    hash = "sha256-U8C1LdO+6QQKDStitCDVypdNq5IkRgBlPbH4udpXLRM=";
+  };
+
+  vendorHash = "sha256-f5Ty22wicf1J8+RKnHYcEO7flWn9gkWQODlfunn23EA=";
+
+  env.CGO_ENABLED = 0;
+
+  subPackages = [ "cmd/opencodereview" ];
+
+  doCheck = false;
+
+  # Upstream (and the bundled OpenCode plugin) invokes the CLI as `ocr`, but the
+  # Go build names the binary after its cmd/ directory.
+  postInstall = ''
+    ln -s $out/bin/opencodereview $out/bin/ocr
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=v${version}"
+    "-X main.GitCommit=v${version}"
+    "-X main.BuildDate=1970-01-01T00:00:00Z"
+  ];
+
+  passthru = {
+    category = "Code Review";
+    # OpenCode plugin built from the same source revision as the CLI.
+    opencode-plugin = callPackage ./opencode-plugin.nix {
+      inherit src version;
+    };
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#open-code-review"
+    ];
+  };
+
+  meta = with lib; {
+    description = "AI-powered code review CLI combining deterministic pipelines with an LLM agent";
+    homepage = "https://github.com/alibaba/open-code-review";
+    changelog = "https://github.com/alibaba/open-code-review/releases/tag/v${version}";
+    license = licenses.asl20;
+    sourceProvenance = with sourceTypes; [ fromSource ];
+    mainProgram = "opencodereview";
+    platforms = platforms.all;
+  };
+}

packages/radar/package.nix

@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.9.1";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "skyhook-io";
     repo = "radar";
-    rev = "v${version}";
+    rev = "k8s-ui-v${version}";
-    hash = "sha256-VZLzmxW86yMtYILhmKswkj57KD4Z+8ILwHKiO53YMWE=";
+    hash = "sha256-OrG628fEXVRwH3W4EBUBeqzFUyp12m3Xt4qTC5r5kVE=";
   };
 
   # Build the frontend as a separate derivation.
@@ -26,7 +26,7 @@ let
     # Upstream lockfile ships complete resolved/integrity fields for all
     # packages since v1.9.x, so no lockfile patching is needed anymore.
 
-    npmDepsHash = "sha256-9xS5ChQ1xBix/n9N8vyBsHlHYmYXsibTK5J+X6mRgM4=";
+    npmDepsHash = "sha256-1wznZuUbDKQlqJZpuNU+s7l24OY9981ak66HroXUtLk=";
     npmDepsFetcherVersion = 2;
     makeCacheWritable = true;
 
@@ -54,7 +54,7 @@ buildGoModule {
   pname = "radar";
   inherit version src;
 
-  vendorHash = "sha256-d26tlh+Twv9GFX6NmR25Q9OpP/pUL2T4grdncQHYSg4=";
+  vendorHash = "sha256-4xkFqa0hWN57bjfA0bgO8mcCsk3iVW45F8RJQnS2nm0=";
 
   # Copy pre-built frontend assets before Go compilation for go:embed
   preBuild = ''
@@ -91,7 +91,7 @@ buildGoModule {
   meta = with lib; {
     description = "Modern Kubernetes visibility — topology, event timeline, service traffic, resource browsing, Helm management, and GitOps support";
     homepage = "https://github.com/skyhook-io/radar";
-    changelog = "https://github.com/skyhook-io/radar/releases/tag/v${version}";
+    changelog = "https://github.com/skyhook-io/radar/releases/tag/k8s-ui-v${version}";
     license = licenses.asl20;
     mainProgram = "radar";
     platforms = platforms.linux;

packages/relay-free-llm/package.nix

@@ -59,14 +59,14 @@ let
 in
 python3Packages.buildPythonApplication {
   pname = "relay-free-llm";
-  version = "0.1.0+unstable";
+  version = "0-unstable-2026-08-31";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "msmarkgu";
     repo = "RelayFreeLLM";
-    rev = "96e6c48a552755bf250c3155b14176916c69d8d8";
+    rev = "9a1aabe1905ac1d6b3d48ac492089a0ea9668388";
-    hash = "sha256-SNux6hVOij+2kYFH/gUQQj8QLfxGzjcdakkZ48AIWPU=";
+    hash = "sha256-DjHaskOW28g9BEI1TbMwuDgcEH4++VEMmXUzpqZ9KMc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

packages/shardr/default.nix

@@ -0,0 +1,2 @@
+{ pkgs, ... }:
+pkgs.callPackage ./package.nix { }

packages/shardr/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "shardr";
+  # Pinned to a commit: upstream has no tagged source releases, only
+  # prebuilt "shardr-runner" bundles.
+  version = "0-unstable-2026-10-02";
+
+  src = fetchFromGitHub {
+    owner = "Cyb3rDudu";
+    repo = "shardr";
+    rev = "fab7fa89bc8164181c5bcebd1f23a74825d11de1";
+    hash = "sha256-bbNvTU3rSlKD7Wr+Q+WGKKtIVUq6uzmv93uZq0gzO2U=";
+  };
+
+  vendorHash = "sha256-wI7oVOFEKDK2hr7MmJ/QY9Mqwgk6t24cBe8HSM/zpVo=";
+
+  subPackages = [
+    "cmd/shardr"
+    "cmd/shardhive"
+  ];
+
+  # Upstream tests assume a llama-server binary and a live shardhive socket.
+  doCheck = false;
+
+  passthru = {
+    category = "AI Inference";
+    updateScript = [
+      "nix-update"
+      "--flake"
+      ".#shardr"
+      "--version=branch=main"
+    ];
+  };
+
+  meta = {
+    description = "Decentralized LLM repository with sync-based distribution over a BitTorrent peer network";
+    homepage = "https://github.com/Cyb3rDudu/shardr";
+    changelog = "https://github.com/Cyb3rDudu/shardr/releases";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+    mainProgram = "shardr";
+  };
+}

packages/skillsmcp/package.nix

@@ -8,7 +8,7 @@ python3Packages.buildPythonApplication {
   pname = "skillsmcp";
   # Pinned to a commit rather than a release tag because upstream
   # has not yet published a tagged release containing all features.
-  version = "0.2.0+unstable";
+  version = "0-unstable-2026-04-08";
   pyproject = true;
 
   src = fetchFromGitHub {

packages/traycer/package.nix

@@ -5,10 +5,10 @@
 }:
 
 let
-  version = "1.1.10";
+  version = "1.4.2";
   src = fetchurl {
     url = "https://github.com/traycerai/traycer/releases/download/desktop-v${version}/traycer-desktop-linux-x86_64.AppImage";
-    hash = "sha256-+aSlqX1RCpbKuV0j7xEBMQDAq/IzpvCC5XZ/psQJcjY=";
+    hash = "sha256-OIJ2e+BAomg3Fq7zaxlVi5o8hpDECaVUYsPpLiYib1I=";
   };
   appimageContents = appimageTools.extractType2 {
     pname = "traycer";