[clhodapp]

Builds on nix-caisson/caisson-core#53, merged, which makes defaultEcosystemSrc a selection. The locks pin caisson-core main at its merge commit, 9e1bdf6.

A nixpkgs checkout holds three parts that caisson treats as separate layers. Each is resolved from its own key, with no fallback between keys:

Part	Key	Read by
the library (lib/, with the module system)	nixpkgs-lib	the nixpkgs-lib entry of every lib
the package set and its configuration	nixpkgs	package configs; nix-darwin's nixpkgs.source
the NixOS module collection (nixos/modules, nixos/lib/eval-config.nix)	nixos	NixOS configurations, and system-manager for its NixOS modules

Until now, the nixpkgs-lib entry fell back to the nixpkgs key, and NixOS and system-manager read nixpkgs. The parts are separate so that they can come from different sources on purpose. A tree that takes them all from one checkout names it under each key.

Selections. ecosystemSrc on a configuration is now a function of the tree's pinned sources, ecosystemSrc = sources: sources.nixpkgs-stable;, as defaultEcosystemSrc is with #53, and as defaultPkgs already is for package sets. A value is refused. resolveEcosystemSrc applies the selection, so every integration that resolves through it takes the function. flake-parts reads its source directly, and applies it through the new selectedEcosystemSrc.

An override replaces its integration's part for that evaluation and nothing else. A NixOS configuration that selects another module collection runs it on the tree's lib.

The package-set libraries come from the package set's source. nixpkgs' library holds general utilities and the module system, which serve every evaluation, and package-set libraries, which describe and build packages: systems and platforms, meta, licenses, sourceTypes, maintainers and teams, customisation, derivations, fetchers and versions. A package set's lib now takes those libraries from the package set's source, together with the names nixpkgs publishes from them at the top level of its library, such as getExe and callPackageWith. A name that a general library also defines, such as compareVersions, stays with the general library. The general utilities and the module system keep coming from nixpkgs-lib.

The packages of a set are written against the package-set libraries at the revision of the set. With this, a package set builds on a library from the nixpkgs.lib mirror, which holds only lib/ and follows nixpkgs master. nixpkgs reads maintainers and teams from its maintainers directory beside lib/, and checks the maintainers of every derivation it creates. ch-firmware's nixos-26.05 package set failed on the 26.11 mirror before this change, on lib.licenses.gfl and then on hostPlatform.linux-kernel. Its full nix flake check passes on the mirror with it.

The new nixpkgs-lib-only integration test builds a package set on a library that holds only lib/. Its lib overlay marks getExe and splitString in the composed lib, and the test checks that the package set's lib replaces the first and keeps the second.

Breaking. Every tree must declare the keys of the parts it uses. With an input named nixpkgs, that's:

defaultEcosystemSrc = sources: { nixpkgs-lib = sources.nixpkgs; nixos = sources.nixpkgs; };

and every ecosystemSrc = inputs.X becomes ecosystemSrc = sources: sources.X. The workspace consumers follow in PRs of their own, which pin this change.

Tests. Every test tree and example declares the keys it uses, with its sources pinned and selected. A new unit test checks that an ecosystemSrc given as a value is refused. nix flake check passes locally, including the VM tests and the evaluation-cost gate.

🤖 Generated with Claude Code