fix(nix): use gms_pure_go, fix vendorHash, drop ICU dependency

.buildflags

@@ -1,9 +1,24 @@
-# This file is sourced by scripts to provide standard build flags.
-# Mirrors Makefile CGO configuration for consistency.
+# Canonical build flags for beads. Source this in any script that invokes
+# `go` to get the project-wide build settings. Scripts that intentionally
+# exercise the ICU path (e.g. scripts/test-cgo.sh) do NOT source this.
 #
-# NOTE: ICU flags are NOT set here. The gms_pure_go build tag (used by
-# goreleaser and `make build`) tells go-mysql-server to use Go's stdlib
-# regex, eliminating the ICU runtime dependency. Only test scripts that
-# explicitly need ICU (test-cgo.sh) should set ICU flags.
+# Rationale: go-mysql-server links ICU by default under cgo. beads never
+# uses SQL REGEXP, so we always build with -tags=gms_pure_go. See
+# docs/ICU-POLICY.md for the full policy.
 
-export CGO_ENABLED=1
+# Embedded Dolt requires CGO; server mode and nocgo builds do not. Default
+# to 1 for the embedded-capable build paths that sourced this, but respect
+# a caller who explicitly set CGO_ENABLED=0 (e.g. a static/nocgo build).
+: "${CGO_ENABLED:=1}"
+export CGO_ENABLED
+
+# Build tag that tells go-mysql-server to use Go's stdlib regex instead of
+# the ICU-backed go-icu-regex. Exported so callers can compose with extra
+# tags: `go test -tags=regression,$BEADS_BUILD_TAGS ...`
+export BEADS_BUILD_TAGS="gms_pure_go"
+
+# Propagate the tag via GOFLAGS so every subsequent bare `go` invocation
+# picks it up automatically. Idempotent: re-sourcing is a no-op.
+if [[ "${GOFLAGS:-}" != *gms_pure_go* ]]; then
+    export GOFLAGS="${GOFLAGS:+$GOFLAGS }-tags=${BEADS_BUILD_TAGS}"
+fi

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "beads",
       "source": "./claude-plugin",
       "description": "AI-supervised issue tracker for coding workflows",
-      "version": "1.0.0"
+      "version": "1.0.2"
     }
   ]
 }

.claude/hooks/block-gh-watch.sh

@@ -17,30 +17,4 @@ if echo "$COMMAND" | grep -qE 'gh run watch|gh run list.*--watch'; then
   exit 0
 fi
 
-# Block PR creation for crew/maintainers. Crew workers push directly to main.
-# External contributors (beads.role=contributor or fork origin) need PRs.
-if echo "$COMMAND" | grep -qE 'gh pr create'; then
-  ROLE=$(git config --get beads.role 2>/dev/null || echo "")
-  ORIGIN=$(git config --get remote.origin.url 2>/dev/null || echo "")
-
-  # Allow if role is explicitly contributor
-  if [ "$ROLE" = "contributor" ]; then
-    exit 0
-  fi
-
-  # Allow if origin points to a fork (not the upstream repo)
-  if [ -n "$ORIGIN" ] && echo "$ORIGIN" | grep -qvE 'steveyegge/beads'; then
-    exit 0
-  fi
-
-  jq -n '{
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason: "BLOCKED: Crew workers do NOT create PRs. Push directly to main with `git push`. PRs are for external contributors only. If you are reviewing an external PR, use fix-merge: checkout the PR, fix/rebase, merge to main, push, then close the PR."
-    }
-  }'
-  exit 0
-fi
-
 exit 0

.devcontainer/setup.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+# Canonical build flags (GOFLAGS=-tags=gms_pure_go, CGO_ENABLED=1).
+# shellcheck source=../.buildflags
+source "$(dirname "$0")/../.buildflags"
+
 echo "🔧 Building bd from source..."
 go build -o bd ./cmd/bd
 

.github/scripts/embedded-test-shard.sh

@@ -61,7 +61,7 @@ if [ -x "$CMD_BINARY" ]; then
     "$@"
 else
   echo "Warning: pre-built test binary not found at $CMD_BINARY, falling back to go test"
-  exec go test -v -race -count=1 -timeout 20m \
+  exec go test -tags=gms_pure_go -v -race -count=1 -timeout 20m \
     -run "$RUN_REGEX" \
     "$@" \
     ./cmd/bd/

.github/workflows/ci.yml

@@ -12,6 +12,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Fast check: every `go build|test|run|generate|install` invocation in
+  # tracked scripts/hooks/CI carries -tags=gms_pure_go. Prevents ICU-linkage
+  # regressions from re-entering the build (see docs/ICU-POLICY.md).
+  check-build-tags:
+    name: Check build-tag policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: ./scripts/check-build-tags.sh
+
   # Fast check to ensure all version files are in sync
   check-version-consistency:
     name: Check version consistency

.github/workflows/cross-version-smoke.yml

@@ -32,7 +32,7 @@ jobs:
     needs: versions
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/deploy-docs.yml

@@ -84,7 +84,7 @@ jobs:
             website/build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: website/build
 

.github/workflows/nix-build.yml

@@ -0,0 +1,31 @@
+name: nix build
+
+on:
+  pull_request:
+    paths:
+      - 'go.mod'
+      - 'go.sum'
+      - 'default.nix'
+      - 'flake.nix'
+      - 'flake.lock'
+  push:
+    branches: [main]
+    paths:
+      - 'go.mod'
+      - 'go.sum'
+      - 'default.nix'
+      - 'flake.nix'
+      - 'flake.lock'
+  workflow_dispatch:
+
+jobs:
+  nix-build:
+    name: nix build .#default
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@v3
+      - name: Build
+        run: nix build .#default --print-build-logs

.github/workflows/regression.yml

@@ -32,4 +32,4 @@ jobs:
           key: regression-baseline-${{ hashFiles('tests/regression/BASELINE_VERSION') }}
 
       - name: Run regression tests
-        run: go test -tags=regression -timeout=10m -v ./tests/regression/...
+        run: go test -tags=regression,gms_pure_go -timeout=10m -v ./tests/regression/...

.gitignore

@@ -31,6 +31,10 @@ pkg/
 .claude/settings.local.json
 .claude/worktrees/
 .claude/*.log
+.claude/*.lock
+
+# Codex CLI - local marker
+.codex
 
 
 # OS

AGENTS.md

@@ -41,12 +41,12 @@ echo 'Updated text' | bd update <id> --description=-
 ## Testing Commands (No Ambiguity)
 
 - Default local test command: `make test` (or `./scripts/test.sh`).
-- Full CGO-enabled suite: `make test-full-cgo` (or `./scripts/test-cgo.sh ./...`).
-- On macOS, do **not** run raw `CGO_ENABLED=1 go test ./...` unless ICU flags are set; use the script/Make target above.
-- If you need package- or test-scoped CGO runs:
+- Opt-in ICU regex path: `make test-icu-path` (or `./scripts/test-icu-path.sh ./...`).
+- This ICU path is maintainer-only and not part of normal validation; `make test-full-cgo` and `./scripts/test-cgo.sh` are deprecated aliases.
+- For package- or test-scoped shipped-config CGO runs, prefer:
 ```bash
-./scripts/test-cgo.sh ./cmd/bd/...
-./scripts/test-cgo.sh -run '^TestName$' ./cmd/bd/...
+CGO_ENABLED=1 go test -tags gms_pure_go ./cmd/bd/...
+CGO_ENABLED=1 go test -tags gms_pure_go -run '^TestName$' ./cmd/bd/...
 ```
 
 ## Non-Interactive Shell Commands

AGENT_INSTRUCTIONS.md

@@ -10,7 +10,7 @@ This document contains detailed operational instructions for AI agents working o
 
 - **Go version**: 1.24+
 - **Linting**: `golangci-lint run ./...` (baseline warnings documented in [docs/LINTING.md](docs/LINTING.md))
-- **Testing**: All new features need tests (`make test` for local baseline, `make test-full-cgo` when validating full CGO paths)
+- **Testing**: All new features need tests (`make test` for the normal local/CI path, `make test-icu-path` only when intentionally exercising the opt-in ICU regex path)
 - **Documentation**: Update relevant .md files
 
 ### File Organization
@@ -66,7 +66,7 @@ into temp repos and produce flaky test behavior.
 ### Before Committing
 
 1. **Run tests**: `make test` (or `./scripts/test.sh`)
-   - For full CGO validation: `make test-full-cgo`
+   - Only if intentionally exercising the ICU regex path: `make test-icu-path`
 2. **Run linter**: `golangci-lint run ./...` (ignore baseline warnings)
 3. **Update docs**: If you changed behavior, update README.md or other docs
 4. **Commit**: With git hooks installed (`bd hooks install`), Dolt changes are auto-committed
@@ -101,15 +101,17 @@ bd hooks install
 
 **Merge conflicts**: Rare with hash IDs. Dolt uses cell-level 3-way merge for conflict resolution.
 
-## Git Workflow: Push to Main, Never PR
+## Git Workflow: PR by Default
 
-Crew workers push directly to main. **Never create pull requests.**
+Crew workers use a PR-based workflow. Beads is a dependency of Gas City, so we
+defer to the standard PR flow to keep changes reviewable.
 
-- `git push` to main is the only way to land work
-- `gh pr create` is forbidden — PRs are for external contributors, not crew
-- Do not create feature branches for your own work — commit and push to main
-- When handling external PRs, use fix-merge: checkout the PR branch locally,
-  fix/rebase onto main, merge locally, `git push`, then close the PR
+- Work on a feature branch, push the branch, open a PR against `main`
+- `gh pr create` is the normal path to land work
+- Direct push to main is reserved for releases (tag + release commit) and
+  narrow operational fixes; prefer a PR when unsure
+- When handling external contributor PRs, use fix-merge: checkout the PR
+  branch locally, fix/rebase onto main, merge via PR, then close the PR
 
 ### External Contributor PRs: Check Before You Build
 
@@ -141,7 +143,7 @@ This is enforced by pre-use hooks. If you try `gh pr create`, it will be blocked
 1. **File beads issues for any remaining work** that needs follow-up
 2. **Ensure all quality gates pass** (only if code changes were made):
    - Run `make lint` or `golangci-lint run ./...` (if pre-commit installed: `pre-commit run --all-files`)
-   - Run `make test` (and `make test-full-cgo` when CGO-relevant code changed)
+   - Run `make test` (and `make test-icu-path` only if you intentionally need the ICU regex path)
    - File P0 issues if quality gates are broken
 3. **Update beads issues** - close finished work, update status
 4. **PUSH TO REMOTE - NON-NEGOTIABLE** - This step is MANDATORY. Execute ALL commands below:
@@ -311,8 +313,8 @@ make install
 # Test (local baseline)
 make test
 
-# Test with full CGO-enabled suite (local/CI parity)
-make test-full-cgo
+# Optional ICU regex path smoke (maintainer-only, not normal validation)
+make test-icu-path
 
 # Coverage run
 go test -coverprofile=coverage.out ./...
@@ -393,7 +395,7 @@ This handles the entire release workflow automatically, including waiting ~5 min
 
 1. Bump version: `./scripts/bump-version.sh <version> --commit`
 2. Update CHANGELOG.md with release notes
-3. Run tests: `make test` (and `make test-full-cgo` for CGO-related changes)
+3. Run tests: `make test` (and `make test-icu-path` only if you intentionally need the ICU regex path)
 4. Push version bump: `git push origin main`
 5. Tag release: `git tag v<version> && git push origin v<version>`
 6. Update Homebrew: `./scripts/update-homebrew.sh <version>` (waits for GitHub Actions)