flake.nix

{
  description = "tau";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";

    flake-utils.url = "github:numtide/flake-utils";
    flakebox = {
      url = "github:dpc/flakebox?rev=105902c66930a9e6a874d27ea8430e8f8db864d7";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    dpc-public-skills = {
      url = "git+https://radicle.dpc.pw/z2HR882B4c4mTdAgdt4SozpdeTuMf.git";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    tau-ext-rostra.url = "git+https://radicle.dpc.pw/z4LrrRivcgNjJii5wzbjTvA8ttt6o.git?ref=main";
    tau-ext-slack.url = "git+https://radicle.dpc.pw/z3NJhEtKWCbHPa28wDQSYJ8eEfBjg.git?ref=master";
    tau-ext-telegram.url = "git+https://radicle.dpc.pw/z3sPdSePnxtBvP9pTLwUwVgpMU68r.git?ref=main";
    tau-ext-zulip.url = "git+https://radicle.dpc.pw/z2LFTBWK7VpAwC3Bpxohkh91aqXd.git?ref=main";
    tau-ext-pim.url = "git+https://radicle.dpc.pw/z4FCuiVzFns5iTquhsYCntZyVWCqi.git?ref=main";
    tau-ext-swarm.url = "git+https://radicle.dpc.pw/z38my9x3Rmn6VYtDMiLKgjK3tRv8o.git?ref=master";
    tau-ext-xmpp.url = "git+https://radicle.dpc.pw/zpN6uwkd6ok9qRAX5yZaF7w8xzDd.git?ref=master";
    selfci = {
      url = "git+https://radicle.dpc.pw/z2tDzYbAXxTQEKTGFVwiJPajkbeDU.git";
      inputs.nixpkgs.follows = "nixpkgs";
      inputs.flake-utils.follows = "flake-utils";
      # TODO: temporarily broken because of wild 0.9.0 hackery
      # inputs.flakebox.follows = "flakebox";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
      flakebox,
      dpc-public-skills,
      tau-ext-pim,
      tau-ext-rostra,
      tau-ext-slack,
      tau-ext-swarm,
      tau-ext-telegram,
      tau-ext-xmpp,
      tau-ext-zulip,
      selfci,
      ...
    }@inputs:
    flake-utils.lib.eachDefaultSystem (
      system:
      let
        nixpkgsPkgs = nixpkgs.legacyPackages.${system};
        # TODO: get rid of custom stuff
        # pkgs = nixpkgs.legacyPackages.${system};
        pkgs = import nixpkgs {
          inherit system;
          overlays = [
            flakebox.overlays.default
          ];
        };

        projectName = "tau";
        cargoCrap = pkgs.callPackage ./nix/pkgs/cargo-crap.nix { };
        selfciPkg = selfci.packages.${system}.default;
        selfciMq = selfci.packages.${system}.mq;

        flakeboxLib = flakebox.lib.mkLib pkgs {
          config = {
            # Tau's cargo-crap derivations use a locally pinned package and
            # project-specific CI gates rather than Flakebox's integration.
            cargo-crap.enable = false;
            github.ci.buildOutputs = [
              ".#ci.workspace"
              ".#ci.workspaceDocs"
            ];
            just.importPaths = [ "justfile.custom.just" ];
            just.rules.watch.enable = false;
            rootDir.".envrc".text = pkgs.lib.mkForce ''
              use flake

              source_env_if_exists .envrc.local
            '';
            toolchain.components = [
              "rustc"
              "cargo"
              "clippy"
              "rust-analyzer"
              "rust-src"
              "llvm-tools"
            ];
          };
        };

        buildPaths = [
          ".cargo-crap.toml"
          "Cargo.toml"
          "Cargo.lock"
          ".config/nextest.toml"
          ".agents/skills"
          "config"
          "crates"
        ];

        cargoManifest = builtins.fromTOML (builtins.readFile ./Cargo.toml);
        releaseProfile = cargoManifest.profile.release;
        # Selfci captures and replays Nix build logs verbatim. Keep every nextest
        # lane plain and non-interactive so terminal detection cannot add progress
        # frames or ANSI escapes to those persistent logs.
        nextestReporterArgs = "--color never --show-progress none --status-level none --no-input-handler";
        # Nextest otherwise detects host CPUs independently of the Nix build
        # budget. Zero/unset budgets retain its normal CPU-count selection.
        nextestBuildBudget = ''
          export NEXTEST_TEST_THREADS="''${NIX_BUILD_CORES:-num-cpus}"
          if [ "$NEXTEST_TEST_THREADS" = 0 ]; then
            export NEXTEST_TEST_THREADS=num-cpus
          fi
          echo "Nextest test concurrency: $NEXTEST_TEST_THREADS"
        '';
        buildSrc =
          # The universal release binary needs parallel LLVM optimization. This
          # evaluation guard prevents normal release builds from silently
          # returning to the multi-minute fat-LTO/one-CGU configuration.
          assert releaseProfile.lto == "thin";
          assert releaseProfile.codegen-units == 16;
          flakeboxLib.source.fromPaths {
            root = ./.;
            paths = buildPaths;
            filter = flakeboxLib.source.filters.excludeDirectoriesNamed [ "specs" ];
          };

        # Placeholders are 40 / 16 raw bytes that the binary embeds via
        # a `static [u8; N]` in `crates/tau-harness/src/version.rs`.
        # The strings below MUST byte-for-byte match those statics, and
        # the substituted values MUST be the same length so `bbe` can
        # patch them in place without shifting any file offsets.
        #
        # Why the unique `__TAU_BUILD…` prefix: short, "ASCII-table-ish"
        # placeholders (e.g. `0123456`) collide with natural byte runs
        # in the binary (base64 alphabets, hex digit tables) and bbe
        # would silently corrupt them.
        tauBuildRevisionPlaceholder = "__TAU_BUILD_GIT_REVISION_PLACEHOLDER____";
        tauBuildDatePlaceholder = "__TAU_BUILD_DATE";
        tauBuildRevision =
          if (self ? rev) && (builtins.stringLength self.rev == 40) then
            self.rev
          else if (self ? dirtyRev) && (builtins.stringLength self.dirtyRev == 46) then
            builtins.substring 0 40 self.dirtyRev
          else if (self ? dirtyRev) && (builtins.stringLength self.dirtyRev == 40) then
            self.dirtyRev
          else
            tauBuildRevisionPlaceholder;
        tauBuildDirty = self ? dirtyRev;
        tauBuildRevisionDisplay =
          if tauBuildRevision == tauBuildRevisionPlaceholder then
            "unknown"
          else
            "${builtins.substring 0 7 tauBuildRevision}${pkgs.lib.optionalString tauBuildDirty "-modified"}";
        tauBuildDate =
          if self ? lastModifiedDate then
            "${builtins.substring 0 4 self.lastModifiedDate}-${builtins.substring 4 2 self.lastModifiedDate}-${
              builtins.substring 6 2 self.lastModifiedDate
            } ${builtins.substring 8 2 self.lastModifiedDate}:${builtins.substring 10 2 self.lastModifiedDate}"
          else
            tauBuildDatePlaceholder;

        tauPackage = nixpkgsPkgs.callPackage ./nix/pkgs/tau.nix {
          buildRevision = tauBuildRevision;
          buildDate = tauBuildDate;
          buildDirty = tauBuildDirty;
        };
        tauDirtyPackage = nixpkgsPkgs.callPackage ./nix/pkgs/tau.nix {
          buildRevision = "0123456789abcdef0123456789abcdef01234567";
          buildDate = "1970-01-01 00:00";
          buildDirty = true;
        };
        replaceTauBuildInfo =
          package:
          pkgs.stdenv.mkDerivation {
            pname = projectName;
            version = package.version;

            dontUnpack = true;
            dontStrip = true;

            nativeBuildInputs = [ pkgs.bbe ];

            # `bbe` itself silently no-ops when its pattern isn't found,
            # which is exactly how the previous LTO-eats-the-placeholder
            # bug shipped. Track per-placeholder hit counts and require
            # at least one substitution across all executables; also
            # assert no placeholder bytes remain after patching.
            installPhase = ''
              cp -a ${package} $out
              chmod -R u+w $out
              revision_hits=0
              date_hits=0
              for path in $(${pkgs.findutils}/bin/find $out -type f -executable); do
                had_revision=0
                had_date=0
                if grep -aqF '${tauBuildRevisionPlaceholder}' "$path"; then
                  had_revision=1
                fi
                if grep -aqF '${tauBuildDatePlaceholder}' "$path"; then
                  had_date=1
                fi
                ${pkgs.bbe}/bin/bbe \
                  -e 's/${tauBuildRevisionPlaceholder}/${tauBuildRevision}/' \
                  -e 's/${tauBuildDatePlaceholder}/${tauBuildDate}/' \
                  "$path" -o ./tmp
                cat ./tmp > "$path"
                if [ "$had_revision" = 1 ]; then
                  if grep -aqF '${tauBuildRevisionPlaceholder}' "$path"; then
                    echo "error: revision placeholder still present in $path after bbe" >&2
                    exit 1
                  fi
                  revision_hits=$((revision_hits + 1))
                fi
                if [ "$had_date" = 1 ]; then
                  if grep -aqF '${tauBuildDatePlaceholder}' "$path"; then
                    echo "error: date placeholder still present in $path after bbe" >&2
                    exit 1
                  fi
                  date_hits=$((date_hits + 1))
                fi
              done
              if [ "$revision_hits" = 0 ]; then
                echo "error: revision placeholder '${tauBuildRevisionPlaceholder}' not found in any executable under $out" >&2
                echo "       (likely the compiler optimized it out — check crates/tau-harness/src/version.rs)" >&2
                exit 1
              fi
              if [ "$date_hits" = 0 ]; then
                echo "error: date placeholder '${tauBuildDatePlaceholder}' not found in any executable under $out" >&2
                echo "       (likely the compiler optimized it out — check crates/tau-harness/src/version.rs)" >&2
                exit 1
              fi
              ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
                # Wild keeps x86_64 Linux links for this large binary fast. Fail
                # rather than allowing a shared build override to disable it again.
                if ${pkgs.binutils}/bin/readelf --file-header "$out/bin/tau" |
                  grep -qF 'Advanced Micro Devices X86-64'
                then
                  if ! ${pkgs.binutils}/bin/readelf --string-dump .comment "$out/bin/tau" |
                    grep -qF 'Linker: Wild '
                  then
                    echo "error: x86_64 Linux $out/bin/tau was not linked with Wild" >&2
                    exit 1
                  fi
                fi
              ''}
            '';
          };

        multiBuild = (flakeboxLib.craneMultiBuild { }) (
          craneLib':
          let
            craneLib = craneLib'.overrideArgs {
              pname = projectName;
              src = buildSrc;
              nativeBuildInputs = [ ];
              env.RUSTDOCFLAGS = "-D warnings";
              env.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
            };
            workspaceBuildCommand = "cargo build --profile $CARGO_PROFILE --locked --workspace --all-targets";
            workspaceDocsCommand = "cargo doc --profile $CARGO_PROFILE --workspace --locked --no-deps";
          in
          rec {
            # Docs compute ordinary dependencies in check mode, so retain both
            # normal-build and check-mode dependency artifacts.
            workspaceDeps = craneLib.buildDepsOnly {
              pname = "${projectName}-workspace";
              buildPhaseCargoCommand = ''
                ${workspaceBuildCommand}
                cargo check --profile $CARGO_PROFILE --workspace --locked
              '';
              cargoBuildCommand = "dontuse";
              cargoCheckCommand = "dontuse";
              doCheck = false;
            };

            # This artifact-producing build is the only workspace gate that
            # tests consume. Docs and Clippy remain required terminal gates.
            workspace = craneLib.mkCargoDerivation {
              pname = "${projectName}-workspace";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = workspaceBuildCommand;
              doCheck = false;
            };

            workspaceDocs = craneLib.mkCargoDerivation {
              pname = "${projectName}-workspace-docs";
              cargoArtifacts = workspaceDeps;
              buildPhaseCargoCommand = workspaceDocsCommand;
              doCheck = false;
              doInstallCargoArtifacts = false;
            };

            tests = craneLib.cargoNextest {
              cargoArtifacts = workspace;
              cargoNextestExtraArgs = "--workspace ${nextestReporterArgs}";
              # PTY E2E fixtures execute the candidate universal binary for
              # their UI and component subprocesses. Nextest does not require
              # that executable, so fail if the workspace artifact omitted it
              # rather than accidentally running a PATH binary.
              preCheck = ''
                ${nextestBuildBudget}
                test -x "$PWD/target/$CARGO_PROFILE/tau"
              '';
              # This terminal gate has no downstream Cargo consumer. Exporting
              # its target directory would recompress about 3 GiB after every run.
              doInstallCargoArtifacts = false;
              nativeBuildInputs = [
                pkgs.ripgrep
                pkgs.util-linux
              ];
              postCheck = ''
                # Public provider cassettes are a wire-compatibility gate.
                export TAU_VCR=replay-only
                export TAU_VCR_DIR="$PWD/crates/tau-provider-codex/fixtures/provider-vcr"
                export TAU_CURATED_VCR_LANE=1
                cargo nextest run --locked \
                   --workspace \
                   --cargo-profile $CARGO_PROFILE \
                   --no-tests=fail \
                   ${nextestReporterArgs} \
                   -E 'package(dpc-tau-provider-codex) & test(/curated_provider_vcr_replay_only_lane/)'
                unset TAU_VCR TAU_VCR_DIR TAU_CURATED_VCR_LANE

                # Poison every ambient startup transport. The fixture must ignore
                # them (including runtime settings reloads and secret discovery)
                # and still prove its exact extension allowlist.
                export TAU_ENABLE_EXTENSIONS=core-shell
                export TAU_EXTENSION_CLI_OVERRIDES='["EnableAll"]'
                export TAU_ROLE_CLI_OVERRIDES='["DisableAll"]'
                  export TAU_HARNESS_CONFIG_OVERRIDES='[{"key":"agents.default_role","raw_value":"missing"}]'
                  export TAU_STARTUP_ROLE=missing
                   env 'TAU_SECRET_BAD@=poison' cargo nextest run --locked \
                     --workspace \
                     --cargo-profile $CARGO_PROFILE \
                     --no-tests=fail \
                     ${nextestReporterArgs} \
                     -E 'package(dpc-tau-e2e-tests) & (binary(deterministic_provider) | binary(cancellation_liveness))'
                 if test "$(uname -s)" = Linux; then
                    # Run the exact workspace-built candidate against a
                    # fixture-owned loopback HTTP/SSE server. Check before
                    # exporting: without the path, the E2E tests skip.
                    test -x "$PWD/target/$CARGO_PROFILE/tau-ext-provider-builtin"
                    export TAU_E2E_PROVIDER_BUILTIN_BIN="$PWD/target/$CARGO_PROFILE/tau-ext-provider-builtin"
                   # The provider's documented additive-CA input accepts only
                   # certificate PEM blocks. Nix's source bundle also carries
                   # NSS trust labels, so derive the narrow fixture input here.
                   export TAU_E2E_PROVIDER_CA_BUNDLE="$TMPDIR/provider-builtin-e2e-ca.pem"
                   sed -n '/^-----BEGIN CERTIFICATE-----$/,/^-----END CERTIFICATE-----$/p' \
                     "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" \
                     > "$TAU_E2E_PROVIDER_CA_BUNDLE"
                   test -s "$TAU_E2E_PROVIDER_CA_BUNDLE"
                   env 'TAU_SECRET_BAD@=poison' cargo nextest run --locked \
                      --workspace \
                      --cargo-profile $CARGO_PROFILE \
                      --no-tests=fail \
                      ${nextestReporterArgs} \
                      -E 'package(dpc-tau-e2e-tests) & binary(provider_builtin_retry)'
                   unset TAU_E2E_PROVIDER_BUILTIN_BIN TAU_E2E_PROVIDER_CA_BUNDLE
                 fi
                  # The PTY gate must spawn the exact workspace-built universal
                  # binary from this Cargo profile, not a user PATH entry.
                 export TAU_E2E_TAU_BIN="$PWD/target/$CARGO_PROFILE/tau"
                  test -x "$TAU_E2E_TAU_BIN"
                  env 'TAU_SECRET_BAD@=poison' cargo nextest run --locked \
                    --workspace \
                    --cargo-profile $CARGO_PROFILE \
                    --no-tests=fail \
                    ${nextestReporterArgs} \
                    -E 'package(dpc-tau-e2e-tests) & (binary(core_resume) | binary(core_shell_resume))'
              '';
            };

            clippy = craneLib.cargoClippy {
              cargoArtifacts = workspaceDeps;
              cargoClippyExtraArgs = "-- -D warnings -D clippy::debug_assert_with_mut_call";
              # Clippy consumes prebuilt dependencies but is a terminal gate;
              # do not export its post-check target directory.
              doInstallCargoArtifacts = false;
            };

            workspaceDepsCcov = craneLib.buildDepsOnly {
              pname = "${projectName}-workspace-ccov";
              buildPhaseCargoCommand = ''
                source <(cargo llvm-cov show-env --export-prefix)
                cargo build --locked --workspace --all-targets --profile $CARGO_PROFILE
              '';
              cargoBuildCommand = "dontuse";
              cargoCheckCommand = "dontuse";
              nativeBuildInputs = [ pkgs.cargo-llvm-cov ];
              doCheck = false;
            };

            workspaceCcov = craneLib.buildWorkspace {
              pname = "${projectName}-workspace-ccov";
              cargoArtifacts = workspaceDepsCcov;
              buildPhaseCargoCommand = ''
                source <(cargo llvm-cov show-env --export-prefix)
                cargo build --locked --workspace --all-targets --profile $CARGO_PROFILE
              '';
              nativeBuildInputs = [ pkgs.cargo-llvm-cov ];
              doCheck = false;
            };

            testsCcov = craneLib.mkCargoDerivation {
              pname = "${projectName}-tests-ccov";
              cargoArtifacts = workspaceCcov;
              buildPhaseCargoCommand = ''
                ${nextestBuildBudget}
                source <(cargo llvm-cov show-env --export-prefix)
                cargo nextest run --locked --workspace --all-targets --profile coverage --cargo-profile $CARGO_PROFILE ${nextestReporterArgs}
                mkdir -p $out
                cargo llvm-cov report --profile $CARGO_PROFILE --lcov --output-path $out/lcov.info
                test -s $out/lcov.info
              '';
              doInstallCargoArtifacts = false;
              nativeBuildInputs = [
                pkgs.cargo-llvm-cov
                pkgs.cargo-nextest
                pkgs.ripgrep
                pkgs.util-linux
              ];
              doCheck = false;
            };

            # cargo-crap reads source and explicit LCOV only. Keep cargoArtifacts
            # explicitly null below: enhanced Crane may otherwise infer and unpack
            # compiled artifacts which none of these derivations consume.
            crapReport = craneLib.mkCargoDerivation {
              pname = "${projectName}-cargo-crap-ccov-report";
              cargoArtifacts = null;
              buildPhaseCargoCommand = ''
                test -s ${testsCcov}/lcov.info
                mkdir -p $out
                ${cargoCrap}/bin/cargo-crap \
                  --workspace \
                  --lcov ${testsCcov}/lcov.info \
                  --threshold 30 \
                  --top 100 \
                  --min 50 \
                  --format markdown \
                  --output $out/cargo-crap.md
                cp ${testsCcov}/lcov.info $out/lcov.info
              '';
              doInstallCargoArtifacts = false;
              nativeBuildInputs = [ cargoCrap ];
              doCheck = false;
            };

            # Duplicate detection is a separate, coverage-free inventory. Exclude
            # test-only source files under src/ in addition to Cargo's top-level
            # tests/ exclusion; neither invocation changes the blocking CRAP gate.
            crapDuplicates = craneLib.mkCargoDerivation {
              pname = "${projectName}-cargo-crap-duplicates";
              cargoArtifacts = null;
              buildPhaseCargoCommand = ''
                mkdir -p $out
                args=(
                  --workspace
                  --duplicates
                  --exclude '**/tests/**'
                  --exclude '**/tests.rs'
                  --exclude '**/*_tests.rs'
                  --top 0
                )
                ${cargoCrap}/bin/cargo-crap "''${args[@]}" \
                  --format human --output $out/duplicates.txt
                ${cargoCrap}/bin/cargo-crap "''${args[@]}" \
                  --format json --output $out/duplicates.json
                # Workspace locations are absolute; /build/source disappears
                # after Nix finishes. Make both reports navigable from repo root.
                sed -i "s|$PWD/||g" $out/duplicates.txt $out/duplicates.json
              '';
              doInstallCargoArtifacts = false;
              nativeBuildInputs = [ cargoCrap ];
              doCheck = false;
            };

            crapAbsolute = craneLib.mkCargoDerivation {
              pname = "${projectName}-cargo-crap-ccov-absolute";
              cargoArtifacts = null;
              buildPhaseCargoCommand = ''
                test -s ${testsCcov}/lcov.info
                ${cargoCrap}/bin/cargo-crap \
                  --workspace \
                  --lcov ${testsCcov}/lcov.info \
                  --min 100 \
                  --format github \
                  --fail-above
                mkdir -p $out
                cp ${testsCcov}/lcov.info $out/lcov.info
              '';
              doInstallCargoArtifacts = false;
              nativeBuildInputs = [ cargoCrap ];
              doCheck = false;
            };

            crap = pkgs.runCommand "${projectName}-cargo-crap-ccov" { } ''
              mkdir -p $out
              ln -s ${crapAbsolute} $out/absolute
              cp ${crapAbsolute}/lcov.info $out/lcov.info
            '';

            tauDeps = craneLib.buildDepsOnly {
              cargoExtraArgs = "-p dpc-tau";
            };

            tau = replaceTauBuildInfo (
              craneLib.buildPackage (
                {
                  cargoArtifacts = tauDeps;
                  cargoExtraArgs = "-p dpc-tau";
                }
                // pkgs.lib.optionalAttrs (craneLib.cargoProfile == "release") {
                  # Keep the final command, wall time, and peak RSS visible in
                  # release logs without changing dev/CI profile semantics.
                  cargoBuildCommand = "${pkgs.time}/bin/time -v cargo build --release --locked";
                  nativeBuildInputs = [ pkgs.time ];
                }
              )
            );
          }
        );

        site = pkgs.runCommand "tau-agent-site" { } ''
          mkdir -p $out/share/tau-agent-site
          cp -r ${./site}/* $out/share/tau-agent-site/
        '';

        release-archives =
          pkgs.runCommand "${projectName}-release-archives"
            {
              nativeBuildInputs = [
                pkgs.gnutar
                pkgs.gzip
              ];
            }
            ''
              mkdir -p $out

              archive_dir=${projectName}-${multiBuild.x86_64-linux.release.tau.version}-x86_64-unknown-linux-gnu
              mkdir -p "$archive_dir"
              cp ${multiBuild.x86_64-linux.release.tau}/bin/tau "$archive_dir/tau"
              chmod 755 "$archive_dir/tau"
              tar --sort=name \
                --mtime='@1' \
                --owner=0 \
                --group=0 \
                --numeric-owner \
                -czf $out/$archive_dir.tar.gz \
                "$archive_dir"

              archive_dir=${projectName}-${multiBuild.aarch64-linux.release.tau.version}-aarch64-unknown-linux-gnu
              mkdir -p "$archive_dir"
              cp ${multiBuild.aarch64-linux.release.tau}/bin/tau "$archive_dir/tau"
              chmod 755 "$archive_dir/tau"
              tar --sort=name \
                --mtime='@1' \
                --owner=0 \
                --group=0 \
                --numeric-owner \
                -czf $out/$archive_dir.tar.gz \
                "$archive_dir"
            '';
      in
      {
        packages = {
          default = tauPackage;
          tau = tauPackage;
          site = site;
          "cargo-crap" = cargoCrap;
          inherit (tau-ext-pim.packages.${system}) tau-ext-pim;
          inherit (tau-ext-rostra.packages.${system}) tau-ext-rostra;
          inherit (tau-ext-slack.packages.${system}) tau-ext-slack;
          inherit (tau-ext-swarm.packages.${system}) tau-ext-swarm;
          inherit (tau-ext-telegram.packages.${system})
            tau-ext-telegram
            tau-telegram-gateway
            ;
          inherit (tau-ext-xmpp.packages.${system}) tau-ext-xmpp;
          inherit (tau-ext-zulip.packages.${system}) tau-ext-zulip;
        }
        // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
          inherit release-archives;
        };

        ci = {
          inherit (multiBuild.ci)
            workspace
            workspaceDocs
            clippy
            tests
            workspaceCcov
            testsCcov
            crapReport
            crapDuplicates
            crapAbsolute
            crap
            ;
        };

        checks = {
          tau-version = tauPackage.passthru.tests.version;
          tau-provenance = pkgs.runCommand "tau-package-provenance" { nativeBuildInputs = [ tauPackage ]; } ''
            tau --version | grep -qF '(${tauBuildRevisionDisplay},'
            touch "$out"
          '';
          tau-dirty-provenance =
            pkgs.runCommand "tau-package-dirty-provenance" { nativeBuildInputs = [ tauDirtyPackage ]; }
              ''
                tau --version | grep -qF 'tau ${tauDirtyPackage.version} (0123456-modified, 1970-01-01 00:00)'
                touch "$out"
              '';
        };

        legacyPackages = multiBuild;

        devShells = flakeboxLib.mkShells {
          channel = "stable";
          NEXTEST_SHOW_PROGRESS = "none";
          NEXTEST_STATUS_LEVEL = "none";
          packages = [
            cargoCrap
            selfciMq
            pkgs.cargo-nextest
            pkgs.taplo
            selfciPkg
          ];
          shellHook = ''
            ${dpc-public-skills.packages.${system}.install}/bin/install-dpc-public-skills
          '';
        };
      }
    );
}