{
  lib,
  rustPlatform,
  fetchFromGitHub,
  cacert,
}:

rustPlatform.buildRustPackage rec {
  pname = "marmel";
  # Upstream publishes no git tags or releases, so this is pinned to a commit.
  # The version shape matches what `nix-update --version=branch=main` generates
  # for a tagless repository.
  version = "unstable-2026-09-13";

  src = fetchFromGitHub {
    owner = "Na1w";
    repo = "marmel";
    rev = "fd551ae3198d427b0f0df3429f88764c49095b23";
    hash = "sha256-nghvUF0EdqTGWT6GMG5oW1iK76r9vgvYeUj98hNraIo=";
  };

  cargoHash = "sha256-sUSsxcj4m4uJ28RKdJWKsb+MlVW6GkWjZdhKPFKlE/Y=";

  nativeCheckInputs = [ cacert ];

  # The test suite builds `reqwest::Client`s, and rustls rejects construction
  # outright when no system trust store is found ("No CA certificates were
  # loaded from the system"). The sandbox has no /etc/ssl, so point the tests
  # at nixpkgs' bundle. Build-time only; the installed binary still uses the
  # host's trust store at runtime.
  preCheck = ''
    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
  '';

  # Serialise the test harness. The lib suite shares process-global worker
  # registries and steer/abort buses (src/orchestrator/workers.rs,
  # src/orchestrator/bus.rs, src/orchestrator/preemption.rs), so the
  # manager-loop tests fail nondeterministically when the harness runs them on
  # parallel threads: rebuilding one unchanged derivation yielded 3 failures,
  # then 1 failure, then 0 with serial threads. All 325 tests still run — none
  # are skipped or filtered. Drop this flag once upstream makes that state
  # per-instance.
  cargoTestFlags = [
    "--"
    "--test-threads=1"
  ];

  # Role prompts are embedded with `include_str!`, so the binary needs no
  # runtime data files. The annotated example configs are the de-facto
  # first-run documentation, since a backend URL and model are mandatory.
  postInstall = ''
    install -Dm644 marmel.toml.example $out/share/doc/${pname}/examples/marmel.toml.example
    install -Dm644 marmel.toml.cloud $out/share/doc/${pname}/examples/marmel.toml.cloud
  '';

  passthru = {
    category = "AI Coding Agents";
    updateScript = [
      "nix-update"
      "--flake"
      ".#marmel"
      "--version=branch=main"
    ];
  };

  meta = {
    description = "Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend";
    homepage = "https://github.com/Na1w/marmel";
    # Upstream README states MIT, but the repository ships no LICENSE file and
    # Cargo.toml has no license field.
    license = lib.licenses.mit;
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    mainProgram = "marmel";
    platforms = lib.platforms.unix;
  };
}