feat(nix): package the CLI as a flake and add a nix lane

Distribution is the flake only — there is no crates.io release — so this is how
the CLI is consumed. `nix build .#intent` packages it; `nix flake check` gates
fmt, clippy, the crate's test suite, a `--help` smoke test, and a proof that the
packaged binary reads a real corpus.

Two attributes are needed to package a crate that is not at the repository root,
and they are not the same knob. `buildAndTestSubdir` moves only the build and
test phases; `cargoSetupPostPatchHook` still reconciles the vendored lockfile
against the repository root and fails with "Missing Cargo.lock from src".
`cargoRoot` is what points that reconciliation at the crate. `src` stays the
whole repository on purpose, so the corpus at `intent/` remains visible to a
check aimed at it from the same source tree.

The nix lane is a separate workflow rather than a job inside `ci.yml`. Folding a
multi-minute Nix build in beside the fast corpus gates would couple them, and
running the corpus gates through `nix flake check` would collapse `corpus-strict`
and `semantic-review-fixtures` into a single check named `check` — a run would
no longer show which gate concluded and how. This lane packages the CLI and
re-gates nothing.

Adopting the formatter and the lint required two changes to the lifted source:

- The block comments carried hand-aligned continuation lines that rustfmt
  de-indents to column 0, which reads worse than what it replaced. Converted to
  line comments, which rustfmt leaves alone, so the wording is unchanged and the
  gate is real rather than permanently red or absent.
- `automated_context_indicator` becomes the `Iterator::find` it was written as by
  hand. `require_section` keeps its eight arguments under an explicit `allow`
  with the reason inline: this crate is a lift whose acceptance bar is behaving
  identically, and grouping those arguments is a refactor motivated only by a
  style lint, better done on its own where a regression would be attributable.

Verified locally: `nix flake check` passes all five checks, the packaged binary
reports 246 graph nodes against the real corpus, and after these source edits the
strict check still reports 0 diagnostics with the graph unchanged at 246/215.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
agent-tool: Claude Code
agent-tool-version: 2.1.220
agent-runtime: Claude Code 2.1.220
agent-session-lookup: unavailable
tooling-profile: dotfiles@unknown-dirty

Author: schickling-assistant

.github/workflows/nix.yml

@@ -0,0 +1,33 @@
+name: nix
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: nix-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Deliberately its OWN workflow rather than a job inside `ci.yml`. The corpus
+  # gates there are fast and must stay separately named and independently
+  # readable; folding a multi-minute Nix build in beside them would couple the
+  # two, and collapsing them behind `nix flake check` would leave a run showing
+  # a single check named `check` instead of which corpus gate concluded and how.
+  # This lane is additive: it proves the CLI packages and that the packaged
+  # binary works, and it re-gates nothing.
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/determinate-nix-action@v3
+      # Builds the package — which runs the crate's test suite via doCheck — and
+      # evaluates every `checks.*`: fmt, clippy, the `--help` smoke test, and the
+      # proof that the packaged binary reads a real corpus.
+      - run: nix flake check --print-build-logs

.gitignore

@@ -6,3 +6,7 @@ target/
 # Artifacts the CI steps write into the checkout root while running.
 /report.json
 /graph.json
+
+# `nix build` output symlinks.
+/result
+/result-*

crates/intent/README.md

@@ -62,3 +62,13 @@ than assume either location; `.github/workflows/ci.yml` does exactly that.
 cargo build --locked --manifest-path crates/intent/Cargo.toml
 cargo test  --locked --manifest-path crates/intent/Cargo.toml
 ```
+
+The repository is also a flake, which is the only supported distribution — there
+is no crates.io release. `nix build .#intent` packages the CLI, `nix flake check`
+runs fmt, clippy, the test suite and a proof that the packaged binary reads a
+real corpus, and `nix develop` gives you the toolchain plus `jq` and
+`check-jsonschema` that the corpus gates use.
+
+Note that `rust-toolchain.toml` pins the channel for rustup users only. A Nix
+build uses whichever toolchain nixpkgs pins and does not read that file; the two
+are not expected to agree on a patch version.

crates/intent/src/lib.rs

@@ -8,10 +8,10 @@ use std::io::{self, Write};
 use std::path::{Path, PathBuf};
 use std::process::{Command, ExitCode};
 
-/* Positions INSIDE a corpus, so they hold for any repository that adopts the
-   layout. Resolving the review assets relative to the corpus root rather than the
-   repository root is what keeps tool and corpus co-located: `review` reads both
-   from the filesystem at runtime, so a corpus that moves takes them with it. */
+// Positions INSIDE a corpus, so they hold for any repository that adopts the
+// layout. Resolving the review assets relative to the corpus root rather than the
+// repository root is what keeps tool and corpus co-located: `review` reads both
+// from the filesystem at runtime, so a corpus that moves takes them with it.
 const SEMANTIC_REVIEW_SUBDIR: &str = "15-evaluation/semantic-review";
 const REVIEW_PROMPT_ASSET: &str = "16-enforcement/review-prompt.md";
 const REVIEW_SCHEMA_ASSET: &str = "16-enforcement/review-result.schema.json";
@@ -208,8 +208,8 @@ impl Defaults {
         arg.unwrap_or_else(|| self.corpus_root.clone())
     }
 
-    /* Fixtures live at a fixed position INSIDE the corpus, so one caller-supplied
-       corpus root determines both defaults and they cannot drift apart. */
+    // Fixtures live at a fixed position INSIDE the corpus, so one caller-supplied
+    // corpus root determines both defaults and they cannot drift apart.
     fn fixtures_or_default(&self, arg: Option<PathBuf>) -> PathBuf {
         arg.unwrap_or_else(|| self.corpus_root.join(SEMANTIC_REVIEW_SUBDIR))
     }
@@ -1200,10 +1200,10 @@ pub fn graph_root(root: &Path) -> Result<GraphReport, Box<dyn std::error::Error>
     })
 }
 
-/* Corpus-relative only. The old second branch guessed `context/vrs/.decisions` to
-   cover being handed a repository root instead of a corpus root — a guess that was
-   silently wrong for any repository laid out differently, and that let a misaimed
-   invocation look like a clean one. Pointing this at a corpus is the caller's job. */
+// Corpus-relative only. The old second branch guessed `context/vrs/.decisions` to
+// cover being handed a repository root instead of a corpus root — a guess that was
+// silently wrong for any repository laid out differently, and that let a misaimed
+// invocation look like a clean one. Pointing this at a corpus is the caller's job.
 fn meta_vrs_decision_dir(root: &Path) -> PathBuf {
     root.join(".decisions")
 }
@@ -1537,6 +1537,11 @@ fn check_reference_shape(
     Ok(())
 }
 
+// Eight arguments, one over clippy's threshold. Left as-is deliberately: this crate
+// is a lift of `axe vrs`, whose acceptance bar is that it behaves identically, and
+// grouping these into a struct is a refactor whose only motivation is a style lint.
+// Worth doing later, on its own, where a regression would be attributable.
+#[allow(clippy::too_many_arguments)]
 fn require_section(
     root: &Path,
     path: &Path,
@@ -1646,7 +1651,7 @@ fn corpus_asset(root: &Path, relative: &str) -> Result<PathBuf, String> {
 }
 
 fn automated_context_indicator() -> Option<&'static str> {
-    for name in [
+    [
         "CI",
         "GITHUB_ACTIONS",
         "BUILDKITE",
@@ -1659,12 +1664,9 @@ fn automated_context_indicator() -> Option<&'static str> {
         "CODEBUILD_BUILD_ID",
         "DRONE",
         "PRE_COMMIT",
-    ] {
-        if std::env::var(name).is_ok_and(|value| !value.is_empty() && value != "false") {
-            return Some(name);
-        }
-    }
-    None
+    ]
+    .into_iter()
+    .find(|&name| std::env::var(name).is_ok_and(|value| !value.is_empty() && value != "false"))
 }
 
 fn visit_markdown(
@@ -2228,9 +2230,9 @@ mod tests {
             .any(|d| { d.rule == "VRS.ENF.meta-decision-shape" && d.severity == Severity::Error }));
     }
 
-    /* The extraction's acceptance bar is that `axe vrs` behaves identically, and the
-       only thing holding that up is the caller keeping its own default. Locked here
-       because a regression is silent: the wrong root still exits 0. */
+    // The extraction's acceptance bar is that `axe vrs` behaves identically, and the
+    // only thing holding that up is the caller keeping its own default. Locked here
+    // because a regression is silent: the wrong root still exits 0.
     #[test]
     fn an_absent_argument_falls_back_to_the_callers_layout() {
         let axe = Defaults::corpus_root("context/vrs");
@@ -2254,12 +2256,15 @@ mod tests {
         let defaults = Defaults::corpus_root("context/vrs");
         let explicit = PathBuf::from("/somewhere/else");
         assert_eq!(defaults.root_or_default(Some(explicit.clone())), explicit);
-        assert_eq!(defaults.fixtures_or_default(Some(explicit.clone())), explicit);
+        assert_eq!(
+            defaults.fixtures_or_default(Some(explicit.clone())),
+            explicit
+        );
     }
 
-    /* Covers the branch that replaced the `context/vrs` sentinel. It is only ever
-       reached where there is no `.git` — a Nix build sandbox or a vendored source
-       tree — so it is invisible to any interactive run. */
+    // Covers the branch that replaced the `context/vrs` sentinel. It is only ever
+    // reached where there is no `.git` — a Nix build sandbox or a vendored source
+    // tree — so it is invisible to any interactive run.
     #[test]
     fn review_workspace_falls_back_to_the_corpus_when_there_is_no_git() {
         let tempdir = tempfile::tempdir().unwrap();
@@ -2280,8 +2285,8 @@ mod tests {
         assert_eq!(review_workspace(&corpus), repo);
     }
 
-    /* The assets travel with the corpus rather than the repository: that co-location
-       is the reason the tool was moved next to the corpus in the first place. */
+    // The assets travel with the corpus rather than the repository: that co-location
+    // is the reason the tool was moved next to the corpus in the first place.
     #[test]
     fn enforcement_assets_resolve_under_the_corpus_not_the_repository() {
         let tempdir = tempfile::tempdir().unwrap();

crates/intent/src/main.rs

@@ -1,9 +1,9 @@
 use clap::Parser;
 use std::process::ExitCode;
 
-/* The binary is a thin shell over the library entry point on purpose: `axe vrs`
-   calls `intent::run` directly, so anything that lived here would be behavior the
-   embedded caller silently does not get. */
+// The binary is a thin shell over the library entry point on purpose: `axe vrs`
+// calls `intent::run` directly, so anything that lived here would be behavior the
+// embedded caller silently does not get.
 fn main() -> ExitCode {
     intent::run(intent::VrsCli::parse())
 }