nixos

Use ONLY when working in the fred/nixos flake repository (the NixOS configuration at ~/GitHub/nixos with hosts/linux/, modules/, profiles/, features/, home-profiles/, flake.nix, flake.lock) and a change has been made that needs verification before push. This NixOS repo has no `cargo test` equivalent -- verification is `nix eval` on the impacted hosts' system.build.toplevel.drvPath. This skill computes which hosts are impacted from the git diff (mirroring the CI's path-based filter and flake.lock input-aware parser) and runs the evals locally so push-time CI failures are caught beforehand.

Use ONLY in the fred/nixos flake repo when adding, reverting, or reasoning about a TEMPORARY workaround that exists solely because of an unfixed upstream bug -- a package overlay (`overrideAttrs`, `doCheck = false`, `postPatch`, CFLAGS pins), a `permittedInsecurePackages` entry, a polkit/module workaround, a disabled feature (`*.enable = false`), or a gh-dash/app keybind hack. Covers the `.github/tracked-upstream-fixes.json` manifest, the `check-upstream-fixes.sh` checker, the `track-upstream-fixes.yaml` workflow, choosing the right check type (issue-closed vs release-contains-commit vs pkgs-min-version vs nixpkgs-pin-contains-commit), and the FIXME-comment convention that ties code to a manifest entry.

Use when editing `.rs` files or `Cargo.toml`, adding/updating a cargo dependency, running `cargo`, `cargo add`, `cargo clippy`, `cargo test`, `cargo xtask`, or before declaring any Rust change complete. Codifies the "lints maxed, no bypasses, no panics in production" Rust policy plus the dependency-hygiene rules (alphabetical sort, full semver pinning) that apply across every Rust crate in fred's repos.

Use when a git commit is rejected by pre-commit hooks, when the user mentions "pre-commit", "lint failed", "hook failed", or before running `git commit` in any of fred's repos that share the fredsystems/precommit-base ruleset (nixos, freminal, docker-acarshub, and downstream projects). Covers diagnosing which hook fired, fixing the underlying issue (never the symptom), and the strict no-bypass policy.

Use when editing `.nix` files in any of fred's flake-managed repos (nixos, freminal, docker-acarshub, and downstream). Codifies the active, strict Nix lint stack — `nixfmt` (auto-format), `statix check` (anti-patterns), `deadnix --fail` (unused bindings) — that runs on every `.nix` commit via the `fredsystems/precommit-base` pre-commit ruleset. Lists the common rejections (empty `{ ... }:` patterns, unused `let` / function args, `with` abuse, anti-patterns flagged by statix) and how to write Nix that passes on the first commit. No bypasses, no per-file disables without a real reason.

Use whenever writing or editing any `.md` / `.mdx` / `.markdown` file (AGENTS.md, agents.md, README.md, agent-docs/*.md, SKILL.md frontmatter bodies, RFCs, design docs, anything). Codifies the markdownlint rules that bite fred's repos most often (MD031, MD040, MD024, MD058, MD012, MD041), the table-column-width rule, the no-emoji-in-tables rule, and the pre-commit fix loop. Prevents the common "pre-commit rejected your commit because of trailing whitespace / missing language tag / unbalanced table" round trip.

Use when editing `.ts` or `.tsx` files, when running `tsc`, `biome`, `eslint`, `vitest`, `playwright`, or `npm`/`pnpm`/`yarn` test/lint commands in any of fred's TypeScript projects. Codifies the strict-mode, no-`any`, no-`@ts-ignore`, explicit-return-types, structured-logger policy.

Use ONLY when working in the fred/nixos flake repository AND the task is to add (or remove) a flake input in flake.nix. Walks the four-location sync requirement, the `# CI:` comment convention, and the post-add verification that confirms CI will rebuild the right host set when the new input changes.

Use ONLY when working in the fred/nixos flake repository AND the task is to add a new NixOS host (server or desktop) to the configuration. Covers the directory layout under hosts/linux/, the servers.nix node-table entry, the desktop_names array in CI, the colmena topology entry for deployment, and the verification dance.

Use ONLY when working in the fred/nixos flake repository AND editing flake.nix inputs, flake.lock entries, .github/workflows/ci-linux.yaml, or the `nixos-eval-impacted-hosts` skill's script. Codifies the four-place sync invariant: every flake input must be classified consistently in (1) the `# CI:` comment in flake.nix, (2) the input-to-category table in agents.md, (3) the `input_category` bash associative array in ci-linux.yaml, and (4) the `INPUT_CATEGORY` array in scripts/impacted-hosts.sh of the nixos-eval-impacted-hosts skill.

Use whenever about to run `git commit`, `git push`, `git rebase`, `git amend`, or open a pull request in any of fred's repos. Codifies atomic-commit policy, conventional-commits format, the "never amend onto a rejected commit" rule, the "each commit must leave tests green" invariant, and the interaction with pre-commit hooks.

Use whenever a task in a Nix-flake-managed repository (freminal, docker-acarshub, nixos, or any future flake-managed project) requires a system-level tool — compiler, linker, system library, test runner, CLI utility — that may not already be in the dev shell. Mandates the "add to flake.nix, then STOP and tell the user to run `nix develop` / `direnv allow`, then wait for confirmation" protocol. Forbids working around missing tools by modifying application logic or installing out-of-band.

Use whenever a test fails sporadically, when CI fails for "the flaky one", when a test depends on parallel scheduling or timing, when a retry is being considered, or when `it.skip` / longer timeouts / fake-async patches are being proposed. Codifies the no-punting policy: a flaky test is a broken test, root-cause it before continuing other work. Applies to every one of fred's repos regardless of language.

Use whenever about to create a new markdown file, write documentation, or finalize a multi-step task in any of fred's repos (nixos, freminal, docker-acarshub, and downstream). Codifies the strict no-summary-documents policy -- no PHASE_X_SUMMARY.md, no IMPLEMENTATION_PROGRESS.md, no REFACTOR_NOTES.md, no "what I did" markdown. Documentation only exists if it is durable reference material.

Use when changing code in a performance-sensitive area of any of fred's projects — rendering pipelines, parsers, I/O hot paths, data-flatten loops, or anything the project's own skills flag as benchmark-mandated. Codifies the before/after capture procedure, the 15% regression threshold, the recording format, and the "add a benchmark first if none exists" rule. Project-specific skills (e.g. `freminal-bench-table`) list which benchmark file covers which area; this skill is the generic policy that uses those tables.

Use before declaring any task complete in fred's repos, before opening a PR, when adding a new function/module/service, or when fixing a bug. Codifies the mandatory-testing policy that applies across freminal (cargo test + benches), docker-acarshub (vitest + playwright), and the NixOS repo (nix eval of impacted hosts). "It compiles and old tests pass" is never sufficient -- new code requires new tests, bug fixes require regression tests, and a task is not done until verification is green.