From 662d38c4fc01e54347c86f528fae036382f3c204 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 20:31:43 +0100 Subject: [PATCH] =?UTF-8?q?docs(policy):=20state=20the=20hardened=20Nix=20?= =?UTF-8?q?ruling=20=E2=80=94=20flakes=20are=20removed,=20not=20tolerated?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OWNER RULING 2026-07-28: "nix flakes are deprecated and to be thrown from the estate, we are only doing guix now... you can get rid of them and references to them now or opportunistically as you think is best." The canon said "Guix primary; NO Nix mirror" (2026-05-18) but three places in this repo still read as though a flake were merely discouraged. A consumer following them would keep the flake and allowlist it. Fixed. spec/LANGUAGE-POLICY.adoc §Package Management Adds the HARDENED 2026-07-28 paragraph: Nix is REMOVED, not deprecated-but-tolerated, and removal is a STANDING OPPORTUNISTIC instruction — strip it whenever you are in a repo for any reason, including the references (direnv `use flake`, `nix-shell` recipes, Dependabot's `nix` ecosystem, package-manager detection, .gitignore/.gitattributes, docs), not just the file. Also records the measured caveat: ~25% of the estate's guix.scm files are scaffold stubs, wrong-project, or {{PROJECT_NAME}} placeholders, so the PRESENCE of guix.scm is not evidence of packaging. Retire the mirror AND make the Guix side real, or fill the sealed container. scripts/check-package-policy.sh The failure guidance said "Do NOT simply delete the flake", which now reads as permission to keep it. Rewritten to lead with removal while KEEPING the real engineering point that motivated it: do not leave the repo unpackaged — make Guix real (or the Containerfile, which is Podman-verifiable where Guix is not installable) IN THE SAME CHANGE. Explicitly rules out allowlisting the flake. .github/workflows/governance-reusable.yml Job renamed "Guix primary / Nix fallback policy" -> "Guix packaging policy (Nix retired)"; step renamed to match. There is no Nix fallback tier any more and the name was teaching the opposite of the rule. RENAME SAFETY CHECKED, NOT ASSUMED: a job rename changes the check-run name, and a ruleset requiring the old context would become a phantom required check that never reports — blocking every merge (the known --admin trap). Queried the rulesets on standards, trope-checker, hermeneia and hypatia: the only required governance context is "governance / Validate Hypatia Baseline". Nothing requires the Guix job. Safe. VERIFIED by running the script both ways: Nix-only repo, past the retirement date -> exit 1, new guidance printed repo with guix.scm -> exit 0, "Guix ... detected (primary)" `bash -n` clean; governance-reusable.yml still parses as YAML. No behavioural change to the policy logic itself — the decision procedure, grace-window variables and sealed-container detection are untouched. This changes what the estate is TOLD, and one job label. --- .github/workflows/governance-reusable.yml | 4 ++-- .../spec/LANGUAGE-POLICY.adoc | 18 ++++++++++++++++++ scripts/check-package-policy.sh | 10 ++++++++-- 3 files changed, 28 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index ea764e24..ed91053c 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -559,7 +559,7 @@ jobs: echo "WASM, Rust, OCaml, Haskell, Guile/Scheme." package-policy: - name: Guix primary / Nix fallback policy + name: Guix packaging policy (Nix retired) runs-on: ${{ inputs.runs-on }} timeout-minutes: 10 permissions: @@ -591,7 +591,7 @@ jobs: scripts sparse-checkout-cone-mode: false - - name: Enforce Guix primary / Nix fallback + - name: Enforce Guix-only packaging policy run: | # Move the checker OUT of the scanned tree and delete the standards # checkout before scanning: the gate walks the whole caller tree, so diff --git a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc index 5faaf46d..1cf73ce8 100644 --- a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc +++ b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc @@ -332,6 +332,24 @@ only where it is the *sole* source of a *specific named* dependency, and that dependency is documented as the reason. Supersedes the prior "Nix fallback everywhere" rule. +HARDENED 2026-07-28 (owner ruling): **Nix is not deprecated-but-tolerated. It is +removed.** Nix flakes are to be thrown out of the estate; Guix is the only +packager. This is a standing instruction to act *opportunistically*: when you +are working in a repo for any reason, strip Nix from it — `flake.nix`, +`flake.lock`, and the *references* (direnv `use flake`, `nix-shell` recipes, +Dependabot's `nix` ecosystem, package-manager detection branches, `.gitignore` +and `.gitattributes` rules, docs). Do not wait for a dedicated sweep, and do not +merely add the file to a root allowlist. + +WARNING — removal is not the whole job. A repo whose `guix.scm` is a scaffold +stub (empty `inputs`, `TODO` markers, a `{{PROJECT_NAME}}` placeholder, or a +name belonging to another project) has *no working packaging* once the flake is +gone. As measured on 2026-07-27, roughly a quarter of the estate's `guix.scm` +files are in that state, so **the presence of `guix.scm` is not evidence of +packaging**. Retire the Nix mirror *and* make the Guix side real — or fill the +sealed container, which is the sanctioned escape hatch and is verifiable with +Podman where Guix is not installable. + [cols="1,2"] |=== | Priority | Tool diff --git a/scripts/check-package-policy.sh b/scripts/check-package-policy.sh index da109c91..499b2919 100755 --- a/scripts/check-package-policy.sh +++ b/scripts/check-package-policy.sh @@ -183,9 +183,15 @@ if [ -n "$NIX" ]; then echo " guix.scm | manifest.scm | channels.scm | .guix-channel (primary)" echo " Containerfile (escape hatch)" echo - echo "Do NOT simply delete the flake: a repo whose guix.scm is a scaffold stub" + echo "HARDENED 2026-07-28 (owner ruling): Nix is REMOVED from the estate, not" + echo "tolerated. Retire the flake opportunistically whenever you touch a repo." + echo + echo "But removal is not the whole job: a repo whose guix.scm is a scaffold stub" echo "has no working packaging once the flake is gone. Make the Guix side real" - echo "first, then retire the mirror (spec/scaffold-stub-debt.adoc, step 3)." + echo "(or fill the Containerfile, which is Podman-verifiable where Guix is not" + echo "installable) IN THE SAME CHANGE as retiring the mirror. Do not leave the" + echo "repo unpackaged, and do not allowlist the flake instead" + echo "(spec/scaffold-stub-debt.adoc, step 3)." exit 1 fi