ryan4yin | 二花 090a7b622b refactor(nixpak): split policy checks into per-app suites (#493) ...

* refactor(nixpak): split policy checks into per-app suites

Make hardening/tests/policy.nix a small loader that auto-discovers one suite per app under hardening/tests/policy. Shared checks live in policy-lib.nix and common expectations are generated by mkAppPolicy; app files only declare differences and special cases. The loader also discovers wrappers from hardening/nixpaks and fails when wrapper/suite inventory or check names diverge.

Assisted-by: DeepSeek Harness (deepseek-flash)

* fix(nixpak): reject duplicate per-app policy checks

mkAppPolicy merges generated and custom checks, so an extraChecks key could silently override a standard assertion. Fail explicitly when a per-app check name is defined twice.

Assisted-by: DeepSeek Harness (deepseek-flash)

2026-11-01 10:05:15 +08:00

..

nixos-tests

chore(docs): prune stale TODOs (#370)

2026-10-03 17:50:28 +08:00

src

feat(wechat): native nixpkgs package with app-scoped data (#492)

2026-11-01 00:09:27 +08:00

tests

refactor(nixpak): split policy checks into per-app suites (#493)

2026-11-01 10:05:15 +08:00

default.nix

fix(colmena): deploy the systems nixosConfigurations evaluates

2026-10-21 20:59:07 +08:00