fix: align flake event-sorcery output hash with the 0.1.2 lock pin

[0xgleb]

Motivation

Cargo.lock pins event-sorcery to tag=0.1.2 (bumped in #178), but the flake's outputHashes still pinned the old tag=0.1.1 rev. That left the 0.1.1 entry dead and the live 0.1.2 git dep without a hash, so crane's vendorCargoDeps fell back to builtins.fetchGit (IFD) — the exact cross-repo footgun AGENTS.md warns about. nix flake check emitted No output hash provided for git+…event-sorcery.git?tag=0.1.2#8f5c… and only succeeded because 0.1.2 happens to be a reachable tag; the fetch is non-hermetic and fragile.

Implements RAI-1126.

Solution

Point the outputHashes key at the 0.1.2 tag/rev now in the lockfile and pin its sha256 (read from the hash-mismatch error). nix flake check now builds the vendored dep hermetically with no missing-hash warning.

Checks

By submitting this for review, I'm confirming I've done the following:

• added comprehensive test coverage for any changes in logic (N/A — flake hash pin; validated via nix flake check, which now passes without the missing-hash warning)
• made this PR as small as possible
• linked any relevant issues or PRs (RAI-1126; references fix: poll Alpaca journal status via keyed per-request GET endpoint #178, which bumped the lockfile)

Summary by CodeRabbit

• Chores
  • Updated a pinned build dependency to a newer release and refreshed its associated checksum.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0a4b5f8c-4ac0-4b0d-b23f-9800da306864

📥 Commits

Reviewing files that changed from the base of the PR and between 339d0fb and 2588b51.

📒 Files selected for processing (1)

• flake.nix

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: test
• GitHub Check: static
• GitHub Check: build

🧰 Additional context used

📓 Path-based instructions (1)

*

⚙️ CodeRabbit configuration file

Focus on providing constructive criticism. Whenever you see a suboptimal approach, suggest more idiomatic or robust alternative(s). Flag potential footguns. Suggest FP alternatives to mutable/imperative code. Point out architectural flaws like leaky abstractions, tight coupling, wrong level of abstraction, poor type modeling, over-abstraction, unclear domain boundaries. Code should generally be organized based on business concerns rather than technical aspects - suggest improvements if you find violations. Point out gaps in test coverage but suggest tests that are not too coupled to the implementation and actually test domain invariants and business logic

Files:

• flake.nix

🧠 Learnings (1)

📚 Learning: 2026-06-23T00:31:58.686Z

Learnt from: 0xgleb
Repo: ST0x-Technology/st0x.issuance PR: 197
File: flake.nix:28-31
Timestamp: 2026-06-23T00:31:58.686Z
Learning: When using the crane Nix library’s `craneLib.vendorCargoDeps` in Nix files, don’t pass a `cargoExtraArgs` parameter—`vendorCargoDeps` doesn’t support it. Also don’t expect crate scoping (e.g., `-p`) to affect vendoring: vendoring reads the full workspace `Cargo.lock`. If you need `-p` scoping, apply it only to build/check derivations (e.g., `buildPackage`, `buildDepsOnly`), not to the vendoring step.

Applied to files:

• flake.nix

🔇 Additional comments (1)

flake.nix (1)

32-33: LGTM!

---

Walkthrough

Updates the flake.nix vendored Cargo dependency hash for event-sorcery, switching the pinned git reference from tag 0.1.1 to 0.1.2 and replacing the associated sha256 value.

Changes

Vendored dependency hash refresh

Layer / File(s)	Summary
Pinned hash update flake.nix	craneLib.vendorCargoDeps.outputHashes updates the event-sorcery git dependency from tag 0.1.1 to 0.1.2 with a new sha256 value.

Possibly related PRs

• ST0x-Technology/st0x.issuance#151: Updates the event-sorcery git-sourced dependency that this PR re-pins in flake.nix.

Suggested reviewers

• hardyjosh
• findolor

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating the flake event-sorcery hash to match the 0.1.2 lock pin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/es-output-hash

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[0xgleb]

• feat: move mint recovery onto durable jobs #208
• feat: run the mint flow's side effects in durable jobs #207
• refactor: extract a reusable durable-job runner #206
• feat: dynamic asset monitoring without a restart #123
• feat: durable mint recovery via apalis job queue #118
• refactor: drop the unused st0x-issuance-client flake derivation #197
• fix: align flake event-sorcery output hash with the 0.1.2 lock pin #199 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add the label add-to-gt-merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has required the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[linear-code]

RAI-1126

[graphite-app]

Merge activity

• Jun 25, 6:22 PM UTC: JuaniRios added this pull request to the Graphite merge queue.
• Jun 25, 6:23 PM UTC: CI is running for this pull request on a draft pull request (#205) due to your merge queue CI optimization settings.
• Jun 25, 6:24 PM UTC: Merged by the Graphite merge queue via draft PR: #205.