feat(hjem): add the hjem integration

README.md

@@ -18,7 +18,7 @@
   <a href="https://github.com/nix-caisson/caisson/actions/workflows/drift.yml"><img alt="drift" src="https://github.com/nix-caisson/caisson/actions/workflows/drift.yml/badge.svg?branch=main&event=schedule"></a>
 </p>
 
-<p align="center"><sub>The drift badge reports the daily run of the pinned-world suite against the current upstreams (nixpkgs, home-manager, colmena, terranix, system-manager); red means an upstream moved and broke an expectation caisson holds.</sub></p>
+<p align="center"><sub>The drift badge reports the daily run of the pinned-world suite against the current upstreams (nixpkgs, home-manager, colmena, disko, nix-darwin, hjem, terranix, system-manager); red means an upstream moved and broke an expectation caisson holds.</sub></p>
 
 ---
 
@@ -124,6 +124,7 @@ source by.
 | `nixos-minimal` | `nixpkgs` | the `nixos` class under the minimal evaluator (no NixOS base modules); a second integration over the class `nixos` owns |
 | `home-manager` | `home-manager` | Home Manager configurations |
 | `home-manager-minimal` | `home-manager` | the `homeManager` class with Home Manager's necessary modules alone, the configuration importing what it uses from `modulesPath`; a second integration over the class `home-manager` owns |
+| `hjem` | `hjem` | the files and packages of a user, as hjem manifests; activated by the NixOS configuration they are declared inside, or applied with `hjem standalone` |
 | `terranix` | `terranix` | Terranix and Terraform configurations |
 | `caisson-colmena` | `colmena` | colmena configurations whose machines are NixOS configurations declared inside them, published as the hive colmena's command reads; the colmena integration we recommend for new configurations |
 | `colmena` | `colmena` | a hive written for colmena, taken as it is, with each node a NixOS configuration; for porting an existing hive and the modules written for it |

configs/flake/caisson/partitions/checks.nix

@@ -178,6 +178,43 @@
                     };
                   in
                   builtins.seq suite.summary (pkgs.runCommand "pinned-world" { } "touch $out");
+                # The manifest file of an hjem configuration inside a NixOS
+                # machine and the units that activate it, built. Building
+                # the manifest file checks it against hjem's own schema
+                # with `cue vet`, so the file the machine activates is one
+                # hjem's CLI accepts. Building the units runs shellcheck
+                # on their scripts.
+                hjem-system =
+                  let
+                    probe = import (self.outPath + "/tests/hjem-system") {
+                      inputs = inputs // {
+                        caisson = self;
+                      };
+                    };
+                    units = probe.top.nixosConfigurations.probe-machine.config.systemd.units;
+                  in
+                  pkgs.linkFarm "hjem-system" (
+                    [
+                      {
+                        name = "manifest-probe.json";
+                        path = probe.inner.outputs.manifestFile;
+                      }
+                    ]
+                    ++
+                      builtins.map
+                        (name: {
+                          inherit name;
+                          path = units.${name}.unit;
+                        })
+                        [
+                          "hjem.target"
+                          "hjem-prepare.service"
+                          "hjem-activate@.service"
+                          "hjem-reload@.service"
+                          "hjem-update-state@.service"
+                          "hjem-cleanup.service"
+                        ]
+                  );
                 # The argument error of every entry point comes from Nix
                 # itself, raised at the call site with no frame of caisson
                 # above it: the real evaluator runs each wrong call and the

configs/structural/impl/default.nix

@@ -24,6 +24,7 @@
         nixos-minimal
         home-manager
         home-manager-minimal
+        hjem
         caisson-colmena
         colmena
         caisson-disko

docs/development/repository-structure.md

@@ -26,7 +26,7 @@ without nixpkgs can depend on it directly.
 
 The layer users reach for: the integrations (`structural`,
 `flake-parts`, `nixpkgs`, `nixos`, `nixos-minimal`, `home-manager`,
-`home-manager-minimal`, `darwin`, `caisson-colmena`, `colmena`,
+`home-manager-minimal`, `darwin`, `hjem`, `caisson-colmena`, `colmena`,
 `caisson-disko`, `disko`, `terranix`, `system-manager`), each
 a library overlay
 contributing its `lib.caisson` namespace, registering its module
@@ -50,7 +50,7 @@ inject the same names beside `self`.
 ## The pinned world
 
 The upstream world caisson is tested against (nixpkgs, home-manager,
-colmena, disko, nix-darwin, terranix, system-manager, and the test
+colmena, disko, nix-darwin, hjem, terranix, system-manager, and the test
 tooling) is pinned in
 `tests/dependencies/flake.lock`, a lock only the checks and formatter
 partitions read, so caisson's `flake.nix` carries no churning pin. The

docs/development/testing-architecture.md

@@ -311,7 +311,8 @@ The checks partition merges outputs from all test and example flakes into the
 | `literate-flake-default` | `examples/literate-flake/` | Example default package builds |
 | `literate-flake-greeting` | `examples/literate-flake/` | Example greeting package builds |
 | `debug-disabled` | `checks.nix` (inline) | `self.debug` is not exposed in production |
-| `pinned-world` | `checks.nix` + `tests/pinned-world/` | caisson composed with the pinned upstream world (nixpkgs, home-manager, colmena, disko, nix-darwin, terranix, system-manager) evaluates end to end; the `drift` workflow runs the same check against advanced pins |
+| `pinned-world` | `checks.nix` + `tests/pinned-world/` | caisson composed with the pinned upstream world (nixpkgs, home-manager, colmena, disko, nix-darwin, hjem, terranix, system-manager) evaluates end to end; the `drift` workflow runs the same check against advanced pins |
+| `hjem-system` | `checks.nix` + `tests/hjem-system/` | The manifest file of an hjem configuration inside a NixOS machine builds, which checks it against hjem's schema with `cue vet`, and so do the units that activate it, which runs shellcheck on their scripts |
 | `darwin-system` (aarch64-darwin) | `checks.nix` + `tests/darwin-system/` | The macOS machine of the pinned-world suite, declared through the darwin integration, builds; the `darwin-build` job of the check workflow builds it on a macOS runner |
 | `argument-errors` | `checks.nix` + `tests/argument-errors/` | The argument error of every entry point comes from Nix itself, raised at the call site with no frame of caisson |
 | `eval-weight` | `checks.nix` + `tests/eval-weight/` | Framework evaluation cost held to committed ceilings ([guide](https://nix-caisson.github.io/docs/eval-weight.html)) |

docs/development/testing.md

@@ -23,13 +23,17 @@ plumbing works.
 ## Pinned-World Suite
 
 - **Scope:** caisson composed with concrete pinned versions of the upstream
-  world (nixpkgs, home-manager, colmena, disko, nix-darwin, terranix,
-  system-manager) and exercised end to end: a home configuration, a
-  NixOS system with homes declared inside it, a colmena hive, disk
-  layouts with the machines installed onto them, a darwin machine
-  evaluated at aarch64-darwin, a terranix and a system-manager
+  world (nixpkgs, home-manager, colmena, disko, nix-darwin, hjem,
+  terranix, system-manager) and exercised end to end: a home
+  configuration, a NixOS system with homes declared inside it, a
+  colmena hive, disk layouts with the machines installed onto them, a
+  darwin machine evaluated at aarch64-darwin, hjem configurations on
+  their own and inside a NixOS machine, a terranix and a system-manager
   configuration, and the composition guarantees of the real exported
-  overlays. The darwin machine of the suite is also the one check at
+  overlays. The `hjem-system` check builds the manifest file of the hjem
+  configuration inside the machine, which checks it against hjem's
+  schema, and the units that activate it, which runs shellcheck on
+  their scripts. The darwin machine of the suite is also the one check at
   aarch64-darwin, `checks.aarch64-darwin.darwin-system`, which the
   `darwin-build` job of the check workflow builds on a macOS runner. Every upstream expectation caisson relies on is a probe here.
 - **Location:** `tests/pinned-world/default.nix`; the pins in