fetch vale styles in nix, pinned, and drop vale sync

nix/devshell.nix

@@ -24,11 +24,9 @@
         rustc
         rustfmt
         shellcheck
-        # The two "prose lint (vale)" CI jobs run vale over docs/. `vale
-        # sync` must run once before `vale docs` and writes styles to
-        # $XDG_DATA_HOME, so point that at the repo like CI does:
-        # `XDG_DATA_HOME=$PWD/.vale-data nix develop -c sh -c 'vale sync && vale docs'`.
-        vale
+        # The pinned-styles `vale` the two "prose lint (vale)" CI jobs run
+        # (nix/packages/vale.nix), with the pinned styles built in.
+        (pkgs.callPackage ./packages/vale.nix { })
       ]);
 
     # `cargo llvm-cov` shells out to `llvm-profdata` and `llvm-cov`,

nix/packages/default.nix

@@ -276,6 +276,10 @@ in
   # is exposed too since it's independently useful/inspectable.
   inherit swagger-ui-dist swagger-ui-theme;
 
+  # `vale` preconfigured with .vale.ini and the pinned style packages
+  # (./vale.nix, ./vale-styles.nix); the prose-lint CI jobs and the devshell run it.
+  vale = pkgs.callPackage ./vale.nix { };
+
   # REA and the Ghidra it needs; consumed by nix/agent-modules/rea.nix.
   rea = pkgs.callPackage ./rea.nix { };
   ghidra-12-1 = pkgs.callPackage ./ghidra-12-1.nix { };

nix/packages/vale-styles.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchzip,
+  runCommand,
+}:
+
+# The Vale style packages named in `.vale.ini`, fetched at build time and
+# laid out as Vale expects a `StylesPath`: `<out>/<Package>/<rule>.yml`.
+# Each is the release asset `vale sync` would download, pinned to a tag and
+# hash so a lint run makes no network request and every caller sees the
+# same rules. Bumping a style means changing its `tag` and `hash` here.
+let
+  styles = {
+    Microsoft = {
+      tag = "v0.15.1";
+      hash = "sha256-NqH69LL8aKMqyoo5qWi/hFAkYA4WL7OCfTpPwR907vU=";
+    };
+    alex = {
+      tag = "v0.2.3";
+      hash = "sha256-YvNfhjCg437wDMxnOqu9xTKq82KZfQt9HvCpoDfwsL4=";
+    };
+    write-good = {
+      tag = "v0.4.1";
+      hash = "sha256-XhvZtirGg9Vl/i73HMyZpK2iSoQoXv8OS7ckryveIdU=";
+    };
+  };
+
+  fetch =
+    name:
+    { tag, hash }:
+    fetchzip {
+      url = "https://github.com/vale-cli/${name}/releases/download/${tag}/${name}.zip";
+      inherit hash;
+      stripRoot = false;
+    };
+in
+runCommand "vale-styles" { } ''
+  mkdir -p $out
+  ${lib.concatStrings (lib.mapAttrsToList (name: s: "ln -s ${fetch name s} $out/${name}\n") styles)}
+''

nix/packages/vale.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  vale,
+  runCommand,
+  makeWrapper,
+  callPackage,
+}:
+
+# `vale` with the repo's `.vale.ini` and the pinned styles from
+# ./vale-styles.nix baked in, so `vale docs` works from the repo root without
+# any setup step. CI, the devshell and local runs all
+# take this one binary. `.vale.ini` carries no `StylesPath`; the wrapper's
+# generated config prepends the store path to the file's contents.
+let
+  styles = callPackage ./vale-styles.nix { };
+  config = runCommand "vale.ini" { } ''
+    { echo "StylesPath = ${styles}"; cat ${../../.vale.ini}; } > $out
+  '';
+in
+runCommand "vale-${vale.version}-hyperhive"
+  {
+    nativeBuildInputs = [ makeWrapper ];
+    meta = {
+      description = "vale preconfigured with the repo's .vale.ini and pinned style packages";
+      mainProgram = "vale";
+    };
+  }
+  ''
+    makeWrapper ${lib.getExe vale} $out/bin/vale --add-flags "--config ${config}"
+  ''