Date: 2026-08-27
Who this is for. You know Nix. You do not know this project. This report tells you what exists, what is decided, and what is left.
How to read the numbers. Every figure comes from a command run against the live repositories on the date above. No figure is copied from a document. Where a claim could not be checked, the report says so.
Integrating third-party NixOS-style system builders—such as Finix—into a Den flake workspace requires understanding how Den manages module collection, builder invocation, and output attribute paths.
This tutorial provides a complete architectural guide and three practical integration patterns for wiring Finix hosts into a Den-managed fleet.
Revision note. The first version of this guide was not runnable end to end. Its
finixSystemcalls omitted the requiredlibargument, it assumed Finix declares thenixpkgs.*options Den emits, and it activated host aspects through a key Den ignores. Every code block below has now been evaluated against denc7ef3f1and finix78fd549; §6 builds a realfinix-system.drv. The three corrections are called out inline as Correction 1/2/3.
Predicate for the refresh-daemon work (deliverable 0 in refresh_daemon_plan.md):
XDG config-path support and non-clobbering key-file naming. Rev 2 folds in the
adversarial review (verdict SOUND-WITH-FIXES) and the owner's I7 ruling.
~/.opk/ configurations continue to work untouched. Any
behavior change anywhere must be explicitly identified, never silent.
Companion to refresh_daemon_spec.md (the ratified design, 2026-08-20). All
design forks from the earlier draft of this file are resolved; the decision log
below records the rulings. Branch: feat/refresh-daemon, stacked on
feat/agent-lifetime (PR 1 = openpubkey/opkssh#611).
0. Predicate PR — storage layout (own design discussion; not yet designed)
Successor to the draft reviewed in openpubkey/opkssh#606 (gist version). This revision is the ratified design; §2 lists every material change from that draft with rationale.
opkssh daemon is a standalone, user-started background process that owns OIDC
authentication and token refresh end-to-end. When it is running, every
opkssh login delegates to it: the daemon runs the OIDC flow, holds all secrets,
This specification outlines the architecture for PR 2, building upon the configurable ssh-agent lifetime support introduced in PR 1.
The goal of PR 2 is to transform opkssh login --auto-refresh from a simple foreground sleep loop into a resilient, background-capable Token Refresh Daemon. The daemon automatically maintains active OIDC PK Tokens and keeps loaded certificates in ssh-agent synchronized without interrupting SSH connections.
Repo: den-server (LSP + MCP frontends) · den/gen (projection lib + node.query facet) · nixd (upstream reference) · Date: 2026-07-20 · Status: approved scoping design (gate ladder + consumer analysis; vehicle = one den-server with LSP + MCP frontends over a shared query engine, built MCP-first; Gate-2 spike decides viability + routing, not the vehicle)
Scope the work and delivery order for extending Nix language tooling to understand den's gen libraries, policy system, and native (gen-graph) graphs. This is a scoping spec: it fixes the value ladder, the eval-model seam that governs it, the per-gate capability delta over vanilla nixd and over vanilla NixOS, and the vehicle decision
Status: design, approved for spec review
Date: 2026-07-17
Supersedes the synthesis model of 2026-06-11-d3-presentation-backend-design.md (the enum + guarded-modules dispatch). The per-app-options threading, the ArgoCD option relocation + back-compat aliases, and the minimal Flux proof carry over unchanged; only the dispatch and synthesis mechanism is redesigned.
Branch: refactor/presentation-backend (PR arnarg/nixidy#104), now rebased onto the ready-to-merge #102 (build/ layout seam) at 8c3c6b0.
Draft — publishes after the current v1-trust roadmap lands. The module system, trust artifacts, and fleet measurements are real and green today; den's next-generation internals are the foundation-laid-for, not done-yet, and are phrased that way below. Numbers grounded in
gen/BENCHMARKS.md,gen/VALIDATION.md, andgen/ci/README.mdas of 2026-07-05.
Per-Aspect Settings in Den — a beginner-friendly (simplified English) guide to the host/aspect settings pattern
Hi! 👋 This guide teaches you a really useful pattern used in a Nix framework called Den. Don't worry if you're new to Nix — we'll explain everything slowly, in plain language, with examples.
Who is this for? Anyone learning about Nix/NixOS who knows a little but isn't an expert yet. If