modernize the scaffold around crane, rust-overlay, and but.nix

.coderabbit.yaml

@@ -33,10 +33,9 @@ reviews:
     - path: "**/*.md"
       instructions: >-
         Focus on the contents of the docs and not on cosmetic things like markdown formatting. We
-        use markdown files for various docs including but not limited to the north star system
-        specification, SPEC.md, the plan for how to get there, ROADMAP.md, guidelines for AI
-        contributors, AGENTS.md, project overview and instructions for human contributors,
-        README.md. Think about the target audience of a document when deciding what comment to
+        use markdown files for various docs including specifications, roadmaps, guidelines for AI
+        contributors (AGENTS.md), and the project overview for human contributors (README.md).
+        Think about the target audience of a document when deciding what comment to
         leave. For specifications and designs, suggest potential product, architectural, and UI/UX
         improvements. For plans, suggest changes that would make things more parallelizable and
         deliverable-focused. For instructions, suggest better rules and guidelines and point out

.envrc

@@ -1,12 +1,11 @@
-if ! has nix_direnv_version || ! nix_direnv_version 3.0.4; then
-  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.4/direnvrc" "sha256-DzlYZ33mWF/Gs8DDeyjr8mnVmQGx7ASYqA5WlxwvBG4="
+if ! has nix_direnv_version || ! nix_direnv_version 3.0.5; then
+  URL=https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.5/direnvrc
+  HASH=sha256-RuwIS+QKFj/T9M2TFXScjBsLR6V3A17YVoEW/Q6AZ1w=
+  source_url "$URL" "$HASH"
 fi
 
-watch_file .env
+watch_file *.nix
+watch_file nix/*.nix
 watch_file flake.lock
-watch_file flake.nix
 
-if ! use flake . --impure --show-trace
-then
-  echo "devenv could not be built. The devenv environment was not loaded. Make the necessary changes to devenv.nix and hit enter to try again." >&2
-fi
+use flake . --impure --show-trace --accept-flake-config

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## Motivation
+
+<!-- Why is this change needed? Link the issue/ADR it advances. State the problem
+     and the desired end state, not the diff. -->
+
+## Solution
+
+<!-- How does this PR solve it? Approach and key design decisions. One line per
+     bullet; detail belongs in the code or the linked issue. Note stack
+     relationships and any trade-offs or follow-ups. -->

.github/workflows/ci.yaml

@@ -1,41 +1,115 @@
-name: "CI"
+name: CI
 
 on:
-  workflow_dispatch:
   pull_request:
-  push:
-    branches:
-    - master
+  merge_group:
+  workflow_dispatch:
+
+# A new push to the same ref supersedes any run still in flight; master runs
+# are never cancelled so the cache-warming pushes always complete.
+concurrency:
+  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+permissions:
+  contents: read
+
+# Nix is installed via nix-quick-install-action; the shared `data-cartel-public`
+# Cachix (cachix-action) and the per-runner nix store (cache-nix-action) are
+# warmed before any `nix` build, and built paths are pushed back to the Cachix.
+# This replaces the DeterminateSystems installer + magic-nix-cache, whose hosted
+# cache throttled CI with HTTP 418 responses. cachix-action is continue-on-error
+# so a fork PR (no CACHIX_AUTH_TOKEN) skips the cache and still builds against
+# cache.nixos.org without failing the job.
 
 jobs:
-  checks:
-    permissions:
-      checks: write
-      contents: read
-      id-token: write
-      packages: write
-      pull-requests: write
-      repository-projects: write
-
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
+  hooks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+        with:
+          nix_version: "2.31.2"
+          nix_conf: |
+            accept-flake-config = true
+            fallback = true
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            keep-env-derivations = true
+            keep-outputs = true
+
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        continue-on-error: true
+        with:
+          name: data-cartel-public
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
+        with:
+          primary-key: nix-${{ runner.os }}-hooks-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-hooks-
+          gc-max-store-size-linux: 5G
+
+      - name: Pre-commit hooks
+        # Pure flake check -- runs the same hooks without the heavy devShell
+        run: nix build -L --log-format raw .#checks.x86_64-linux.git-hooks
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+        with:
+          nix_version: "2.31.2"
+          nix_conf: |
+            accept-flake-config = true
+            fallback = true
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            keep-env-derivations = true
+            keep-outputs = true
+
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        continue-on-error: true
+        with:
+          name: data-cartel-public
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+      - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
+        with:
+          primary-key: nix-${{ runner.os }}-rust-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-rust-
+          gc-max-store-size-linux: 5G
+
+      - name: Test
+        run: nix build -L --log-format raw .#checks.x86_64-linux.cargo-test
 
+  clippy:
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - uses: DeterminateSystems/nix-installer-action@main
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - uses: DeterminateSystems/flake-checker-action@main
+      - uses: actions/checkout@v4
 
-    - name: Run Flake checks
-      run: nix -v flake check --show-trace --impure --accept-flake-config
+      - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+        with:
+          nix_version: "2.31.2"
+          nix_conf: |
+            accept-flake-config = true
+            fallback = true
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+            keep-env-derivations = true
+            keep-outputs = true
 
-    - name: cargo build
-      run: nix develop --impure --accept-flake-config -c cargo build --all-targets --locked
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        continue-on-error: true
+        with:
+          name: data-cartel-public
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
-    - name: cargo test
-      run: nix develop --impure --accept-flake-config -c cargo test --all-targets --locked
+      - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
+        with:
+          primary-key: nix-${{ runner.os }}-rust-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-rust-
+          gc-max-store-size-linux: 5G
 
-    - name: cargo clippy
-      run: nix develop --impure --accept-flake-config -c cargo clippy --all-targets --locked -- -D warnings
+      - name: Clippy
+        run: nix build -L --log-format raw .#checks.x86_64-linux.cargo-clippy

.github/workflows/templates.yaml

@@ -7,23 +7,41 @@ on:
     branches:
     - master
 
+concurrency:
+  group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
 jobs:
   templates:
     permissions:
-      checks: write
       contents: read
-      id-token: write
 
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
+    runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5
-    - uses: DeterminateSystems/nix-installer-action@main
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - uses: DeterminateSystems/flake-checker-action@main
+    - uses: actions/checkout@v4
+
+    - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+      with:
+        nix_version: "2.31.2"
+        nix_conf: |
+          accept-flake-config = true
+          fallback = true
+          access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+          keep-env-derivations = true
+          keep-outputs = true
+
+    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      continue-on-error: true
+      with:
+        name: data-cartel-public
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+    - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7
+      with:
+        primary-key: nix-${{ runner.os }}-templates-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+        restore-prefixes-first-match: nix-${{ runner.os }}-templates-
+        gc-max-store-size-linux: 5G
 
     - name: Test rust template
       run: |
@@ -32,7 +50,11 @@ jobs:
         nix flake init -t "${GITHUB_WORKSPACE}#rust" --accept-flake-config
         test -f Cargo.toml
         test -f flake.nix
+        test -f rust.nix
         test -f src/main.rs
+        test -f AGENTS.md
+        test -f clippy.toml
+        test -L CLAUDE.md
         nix develop --impure --accept-flake-config -c rustc --version
 
     - name: Test ci template

.gitignore

@@ -2,10 +2,22 @@
 .devenv
 .direnv
 .pre-commit-config.yaml
+result
+result-*
 
 # Rust
 /target
 
+# Generated agent skills (installed as symlinks on dev shell entry)
+/.claude/skills/gitbutler
+/.cursor/skills/gitbutler
+
 # Misc
 .env
 *.local
+*~
+.DS_Store
+*.log
+.worktrees/
+.tmp/
+.claude/skills/gitbutler