refactor: slim flake.nix into nix/ entry files

nix/packages/assets.nix

@@ -0,0 +1,63 @@
+{
+  stdenv,
+  librsvg,
+}:
+
+# Branding SVG/PNG family + claude prompts, split out from the rust
+# workspace so a tweak here doesn't invalidate the rust cargo cache.
+# Rationale + agent-configs PNG rendering: docs/gotchas.md::Split asset
+# derivations away from the rust workspace.
+#
+# Output layout:
+#   $out/share/hyperhive/branding/{hyperhive,agent-configs}.{svg,png}
+#   $out/share/hyperhive/prompts/{system.md, claude-settings.json}
+#
+# The repo docs/ tree is a SEPARATE derivation (./reference-docs.nix)
+# so agents can consume the docs without the branding+prompt assets and
+# the website repo can reuse it — see that file.
+
+stdenv.mkDerivation {
+  pname = "hyperhive-assets";
+  version = "0.1.0";
+  # Narrow `srcs` (branding/ + hive-ag3nt/prompts/) is what decouples
+  # this derivation's input hash from the rest of the tree.
+  srcs = [
+    ../../branding
+    ../../hive-ag3nt/prompts
+  ];
+  unpackPhase = ''
+    runHook preUnpack
+    cp -r ${../../branding} branding
+    cp -r ${../../hive-ag3nt/prompts} prompts
+    chmod -R u+w branding prompts
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = [ librsvg ];
+
+  # 300×300 matches branding/hyperhive.png — the size Forgejo's avatar
+  # endpoint accepts without resampling on upload.
+  buildPhase = ''
+    runHook preBuild
+    rsvg-convert --width 300 --height 300 \
+      -o branding/agent-configs.png \
+      branding/agent-configs.svg
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/hyperhive
+    cp -r branding $out/share/hyperhive/branding
+    cp -r prompts $out/share/hyperhive/prompts
+    runHook postInstall
+  '';
+
+  # Pure data — no executables to fixup, no shared libs to patchelf.
+  dontFixup = true;
+
+  meta = {
+    description = "hyperhive static assets (branding + claude prompts)";
+    homepage = "https://forge.darkest.space/hyperhive/hyperhive";
+  };
+}

nix/packages/default.nix

@@ -0,0 +1,201 @@
+# All flake package outputs. Imported per system from flake.nix; the
+# shared rust build wiring (cleanSrc / cargoArtifacts /
+# nativeBuildInputs) comes in via `rust` (see ../rust.nix).
+{
+  pkgs,
+  craneLib,
+  rust,
+  self,
+  nixpkgs,
+}:
+let
+  inherit (rust) cleanSrc cargoArtifacts nativeBuildInputs;
+
+  docsAttrs = import ../docs {
+    inherit pkgs self;
+    inherit (nixpkgs) lib;
+    inherit (nixpkgs.lib) nixosSystem;
+  };
+
+  # One package per daemon/harness/MCP-server binary — matches the
+  # `hivectl` / `hive-forge` split below rather than grouping them
+  # into a single derivation. Consumers (agent containers, host
+  # module, `nix profile install`) depend on exactly the binaries
+  # they need instead of an all-or-nothing bundle. All share
+  # `cargoArtifacts` (built once via `buildDepsOnly`), so each call
+  # below only pays for compiling + linking its own bin's workspace
+  # crates.
+  #
+  # Tests are kept in the separate `checks.cargo-test` derivation
+  # (carries the hyperhive-assets build input for the prompt-template
+  # assertions in hive-ag3nt::prompt::tests). Keeping them out of the
+  # binary derivations means a prompt edit doesn't bust the cargo cache.
+  mkDaemonBin =
+    bin: description:
+    craneLib.buildPackage {
+      src = cleanSrc;
+      inherit cargoArtifacts nativeBuildInputs;
+      cargoExtraArgs = "--bin ${bin}";
+      pname = bin;
+      version = "0.1.0";
+      meta.description = description;
+      doCheck = false;
+    };
+  hiveC0rePkg = mkDaemonBin "hive-c0re" "hyperhive host coordinator daemon";
+  hivePrivPkg = mkDaemonBin "hive-priv" "hyperhive privileged root helper";
+  hiveAgentPkg = mkDaemonBin "hive-agent" "hyperhive in-container agent harness serve loop";
+  hiveAgentMcpPkg = mkDaemonBin "hive-agent-mcp" "hyperhive agent-surface MCP server";
+  hiveAgentWakePkg = mkDaemonBin "hive-agent-wake" "hyperhive external wake CLI — push a message into an agent's own inbox";
+  hiveBashDaemonPkg = mkDaemonBin "hive-bash-daemon" "hyperhive per-agent bash-task runner daemon";
+  hiveBashMcpPkg = mkDaemonBin "hive-bash-mcp" "hyperhive bash-task MCP bridge";
+  hiveMatrixDaemonPkg = mkDaemonBin "hive-matrix-daemon" "hyperhive per-agent matrix-sdk daemon";
+  hiveMatrixMcpPkg = mkDaemonBin "hive-matrix-mcp" "hyperhive matrix MCP bridge";
+  hiveMetricPkg = mkDaemonBin "hive-metric" "hyperhive agent-emitted custom metrics CLI";
+
+  # Operator CLI — ships `hivectl` (with shell completions and the
+  # `wg` wrapper) without the daemon binaries. Suitable for
+  # `nix profile install .#hivectl` / `environment.systemPackages
+  # = [ inputs.hyperhive.packages.${system}.hivectl ]` when the
+  # operator only wants the admin CLI. Shares `cargoArtifacts` with
+  # the daemon bins so there is no double-rustc cost.
+  hivectlPkg = craneLib.buildPackage {
+    src = cleanSrc;
+    inherit cargoArtifacts;
+    cargoExtraArgs = "--bin hivectl";
+    pname = "hivectl";
+    version = "0.1.0";
+    meta.description = "hyperhive operator CLI";
+    doCheck = false;
+    # `installShellFiles` + `makeWrapper` scoped to this derivation
+    # only — daemon bins don't need them.
+    nativeBuildInputs = nativeBuildInputs ++ [
+      pkgs.installShellFiles
+      pkgs.makeWrapper
+    ];
+    # Ship shell completions (the binary's own `completions <shell>`
+    # verb is the single source of truth, so they never drift from
+    # the actual verbs). Wrap with wireguard-tools so `hivectl wg`
+    # subcommands work before `swarm.wireguard.enable` is set (wg
+    # init is the very first setup step). Completion generation runs
+    # before wrapProgram since wrapProgram renames the real binary.
+    postInstall = ''
+      installShellCompletion --cmd hivectl \
+        --bash <("$out/bin/hivectl" completions bash) \
+        --zsh <("$out/bin/hivectl" completions zsh) \
+        --fish <("$out/bin/hivectl" completions fish)
+      wrapProgram "$out/bin/hivectl" \
+        --prefix PATH : ${pkgs.wireguard-tools}/bin
+    '';
+  };
+
+  # Forgejo CLI — ships `hive-forge` without the rest of the
+  # workspace. Useful for operator workstations / CI environments
+  # that only need forge access. Shares `cargoArtifacts` with the
+  # daemon bins.
+  hiveForgePkg = craneLib.buildPackage {
+    src = cleanSrc;
+    inherit cargoArtifacts nativeBuildInputs;
+    cargoExtraArgs = "--bin hive-forge";
+    pname = "hive-forge";
+    version = "0.1.0";
+    meta.description = "hyperhive Forgejo CLI";
+    doCheck = false;
+  };
+in
+{
+  # All workspace binaries in one derivation via symlinkJoin.
+  # Each binary is compiled exactly once (one rustc per bin, all
+  # sharing `cargoArtifacts`); symlinkJoin assembles the outputs
+  # without any additional compilation. The NixOS module's
+  # `pkgs.hyperhive` (= this) and `nix build .#` both land here.
+  default = pkgs.symlinkJoin {
+    name = "hyperhive";
+    paths = [
+      hiveC0rePkg
+      hivePrivPkg
+      hiveAgentPkg
+      hiveAgentMcpPkg
+      hiveAgentWakePkg
+      hiveBashDaemonPkg
+      hiveBashMcpPkg
+      hiveMatrixDaemonPkg
+      hiveMatrixMcpPkg
+      hiveMetricPkg
+      hivectlPkg
+      hiveForgePkg
+    ];
+  };
+  # Per-bin split packages. Agent containers depend on the
+  # individual bins they actually exec/PATH-need (see
+  # `harness-base.nix`) instead of the `default` bundle — that
+  # keeps `hivectl` (dials the *host* admin socket, unreachable
+  # from inside a container, drags in `wireguard-tools`) and a
+  # redundant `hive-forge` copy out of every agent's closure.
+  hivectl = hivectlPkg;
+  hive-forge = hiveForgePkg;
+  hive-c0re = hiveC0rePkg;
+  hive-priv = hivePrivPkg;
+  hive-agent = hiveAgentPkg;
+  hive-agent-mcp = hiveAgentMcpPkg;
+  hive-agent-wake = hiveAgentWakePkg;
+  hive-bash-daemon = hiveBashDaemonPkg;
+  hive-bash-mcp = hiveBashMcpPkg;
+  hive-matrix-daemon = hiveMatrixDaemonPkg;
+  hive-matrix-mcp = hiveMatrixMcpPkg;
+  hive-metric = hiveMetricPkg;
+
+  # Bundled browser assets — see ./frontend.nix. Output is
+  # $out/{dashboard,agent}/ which the Rust binaries serve via
+  # tower_http::ServeDir.
+  frontend = pkgs.callPackage ./frontend.nix {
+    branding-svg = ../../branding/hyperhive.svg;
+  };
+  # Static runtime assets the rust binaries read via
+  # `hive_sh4re::assets::*`: branding/* + prompts/*, plus the
+  # rendered agent-configs.png. Split out of the rust derivation so
+  # a tweak to e.g. system.md doesn't bust the cargo cache. Build
+  # input of the `cargo-test` check but NOT of `packages.default`,
+  # so the binary derivation stays cached when a prompt edit ripples
+  # through.
+  assets = pkgs.callPackage ./assets.nix { };
+  # The repo docs/ markdown tree as a standalone derivation —
+  # agents read it in-container (added as a claude additional
+  # directory) and the website repo reuses it as a flake input,
+  # neither of which needs the branding/prompt assets. See
+  # ./reference-docs.nix. (`docs` below is the auto-generated
+  # nix-options reference, a different artifact.)
+  reference-docs = pkgs.callPackage ./reference-docs.nix { };
+  # XDG icon set + .desktop entries for hyperhive processes.
+  # Narrow input: only the branding SVG, so unrelated source changes
+  # don't bust this derivation's cache.
+  xdg-icons = pkgs.callPackage ./hive-xdg-icons.nix {
+    hyperhiveSvg = ../../branding/hyperhive.svg;
+  };
+
+  # Pre-built per-container system closures. Exposed as packages
+  # so operators can `nix build .#agent-base-toplevel` (or wire
+  # them into their host system closure via the
+  # `preBuildAgentTemplates` option on the hive-c0re module —
+  # see nix/modules/hive-c0re.nix). Speeds up the first agent
+  # spawn dramatically because the heavy lifting (nixpkgs +
+  # claude-code + hive-ag3nt binary) is already in the store
+  # when the meta evaluator goes to build the container.
+  #
+  # nixosConfigurations are pinned to x86_64-linux (nixos-
+  # containers only run native arch), so these toplevels are
+  # only useful on an x86_64-linux host — flake check across
+  # systems still tolerates evaluating them on aarch64 because
+  # they're plain derivations, but `nix build` from a non-x86
+  # host would only succeed via a remote x86 builder.
+  agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel;
+  ruth-toplevel = self.nixosConfigurations.ruth.config.system.build.toplevel;
+
+  # Auto-generated nix options reference for hyperhive.
+  # `docs` bundles host + agent pages into one tree; the split
+  # outputs are useful when consumers only want one surface.
+  # All three are pure markdown — no rust or frontend deps in
+  # the closure, so `nix build .#docs` is cheap.
+  docs = docsAttrs.bundle;
+  docs-host = docsAttrs.host;
+  docs-agent = docsAttrs.agent;
+}

nix/packages/frontend.nix

@@ -0,0 +1,67 @@
+{
+  buildNpmPackage,
+  lib,
+  branding-svg,
+}:
+
+# Hermetic build of the npm-managed frontend workspaces (see
+# `frontend/README.md`). Consumes `frontend/package-lock.json` as the
+# source of truth for dependency versions; `npmDepsHash` pins the
+# vendor-tarball hash so a stale lockfile fails the build instead of
+# silently fetching different upstream tarballs.
+#
+# Output layout (`$out`) — two subdirectories, one per surface, that
+# the Rust binaries serve via `tower_http::ServeDir`:
+#
+#   $out/dashboard/   the hive-c0re dashboard assets (full layout in
+#                     frontend/packages/dashboard/build.mjs):
+#       index.html (H0M3 hub, served at /) dashboard.html (operator SPA,
+#       served at /dashboard.html) flow.html logs.html settings.html
+#       stats.html favicon.svg
+#       static/{home,tabs,flow,logs,settings,stats,stream-worker}.js{,.map}
+#       static/{colors,theme,common,home,dashboard,flow,logs,settings,stats}.css
+#   $out/agent/       the per-agent default UI (layered with
+#                     hyperhive.frontend.extraFiles at activation time)
+#       index.html stats.html screen.html
+#       static/{app,stats}.js{,.map}
+#       static/{colors,theme,agent}.css
+#
+# The dashboard favicon lives outside the npm tree (`branding/hyperhive
+# .svg` at the repo root) — we copy it in during the install phase so
+# the served prefix has everything in one place.
+
+buildNpmPackage {
+  pname = "hyperhive-frontend";
+  version = "0.0.0";
+  src = ../../frontend;
+
+  # Computed from `frontend/package-lock.json` via
+  #   prefetch-npm-deps frontend/package-lock.json
+  # Update whenever the lockfile changes. Recompute locally with the
+  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
+  # and copy the actual hash from the error message.
+  npmDepsHash = "sha256-/aklU+l5HqSs4l68gf9J3mgyKM30reBgTkaEjtx2MNY=";
+
+  # `npm run build` recurses into all workspaces (`--workspaces
+  # --if-present`). The workspaces' build scripts each run their own
+  # `build.mjs` (esbuild).
+  npmBuildScript = "build";
+
+  # buildNpmPackage's default install phase copies the working dir into
+  # $out, which is overkill — we only want the dist trees. Hand-roll
+  # the install to keep $out tight.
+  dontNpmInstall = true;
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/dashboard $out/agent
+    cp -r packages/dashboard/dist/. $out/dashboard/
+    cp -r packages/agent/dist/. $out/agent/
+    cp ${branding-svg} $out/dashboard/favicon.svg
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Bundled browser-facing assets for the hyperhive dashboard and per-agent UI";
+    homepage = "https://forge.darkest.space/hyperhive/hyperhive";
+  };
+}

nix/packages/reference-docs.nix

@@ -0,0 +1,41 @@
+{
+  stdenv,
+}:
+
+# The repo `docs/` markdown tree, shipped as a standalone derivation so
+# agents can read the reference docs in-container (added as a claude
+# additional directory by the harness) WITHOUT pulling the branding +
+# prompt assets they don't need, and so the `hyperhive/website` repo can
+# reuse the exact same tree as a flake input.
+#
+# Pure data: the docs are copied verbatim (never transformed), so there
+# is no writable/build step — `$out` is the docs tree as-is.
+#
+# Output layout:
+#   $out/  — the repo `docs/` tree verbatim (e.g. `$out/setup.md`)
+
+stdenv.mkDerivation {
+  pname = "hyperhive-docs";
+  version = "0.1.0";
+  # Narrow src (just docs/) keeps this derivation's input hash decoupled
+  # from the rest of the tree — a doc edit only re-hashes this.
+  src = ../../docs;
+
+  # No build: pure markdown, nothing to compile or render.
+  dontBuild = true;
+  dontConfigure = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r ./* $out/
+    runHook postInstall
+  '';
+
+  dontFixup = true;
+
+  meta = {
+    description = "hyperhive reference docs (the repo docs/ tree)";
+    homepage = "https://forge.darkest.space/hyperhive/hyperhive";
+  };
+}