flake: Rust 1.98.1 from rust-overlay; rust-version 1.98

The owner's hosts (titan, talos) run 1.98.1; nixos-26.05's Rust is
1.95.0, so builds and lints differed by host. The flake gains a second
input, oxalica's rust-overlay (following our nixpkgs, so host configs
can still follow theirs), and both the package build and the dev shell
use its stable 1.98.1 with clippy and rustfmt. The workspace's
rust-version rises to 1.98 to match; AGENTS.md, docs/dependencies.md
and the M5c-1 plan follow.

Checked on straylight: nix build gives all seven binaries; the dev
shell has rustc, cargo and clippy 1.98.1, rustfmt 1.9.0, cargo-deny
0.19.6; make gate in it passes with 1122 tests, as on titan.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -34,7 +34,7 @@ Unix sockets. You are implementing it one task at a time.
 
 ## Code rules
 
-- Rust stable, edition 2024, `rust-version = "1.95"`. No `unsafe`. No async runtime.
+- Rust stable, edition 2024, `rust-version = "1.98"`. No `unsafe`. No async runtime.
 - No dependency that the task file does not name. All external dependencies are declared in the
   root `Cargo.toml` under `[workspace.dependencies]`, used with `name.workspace = true`, and have a
   row in `docs/dependencies.md`.

Cargo.toml

@@ -13,7 +13,7 @@ members = [
 
 [workspace.package]
 edition = "2024"
-rust-version = "1.95"
+rust-version = "1.98"
 publish = false
 
 [workspace.lints.rust]

docs/dependencies.md

@@ -25,10 +25,16 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
 
 ## Build inputs
 
-`flake.nix` has one input, `nixpkgs`, pinned to `nixos-26.05` in `flake.lock`: the release the
+`flake.nix` has two inputs, pinned in `flake.lock`:
-owner's NixOS hosts run, so a host's config can use the flake with
+
-`inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`. It has Rust 1.95.0, the workspace's
+- `nixpkgs`, `nixos-26.05`: the release the owner's NixOS hosts run, so a host's config can use
-`rust-version`. Nix fetches it when building, never the harness when running, so it is not in
+  the flake with `inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`;
+- `rust-overlay` (github.com/oxalica/rust-overlay, MIT), following that `nixpkgs`: the Rust
+  toolchain, pinned to 1.98.1, the workspace's `rust-version` and the version titan and talos run
+  (owner, 2026-09-27), so every host builds and lints with the same compiler and clippy. The
+  release's own Rust is 1.95.0.
+
+Nix fetches them when building, never the harness when running, so they are not in
 `docs/egress.md`.
 
 - `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.

docs/plans/M5c1/README.md

@@ -13,7 +13,7 @@ session-state question; `loopd`, `gatewayd` and `bxctl chat` carry the speaker;
 the question on a new socket; `memoryd` gains a `honcho` module (configuration, ledger, decision,
 `roncho` clients, a sync worker, mirrored memory writes) and `bxctl memory sync` shows its state.
 
-**Tech stack:** Rust 1.95, edition 2024; `roncho` 1.0.0 (`default-features = false, features =
+**Tech stack:** Rust 1.98, edition 2024; `roncho` 1.0.0 (`default-features = false, features =
 ["blocking"]`), added by the design model in task 00; no other new crate.
 
 **Spec:** `docs/specs/2026-09-27-m5c-honcho.md` (approved 2026-09-27), sections 3 to 7 and 10 to

flake.lock

@@ -16,7 +16,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790495762,
+        "narHash": "sha256-26FbceKgybcbwkIvs2yHsF5jHcWLEkITYg5g9WPSy64=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "edea2d6f98b1e5f64ce5ac21e19a96c603c20b8c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,13 +1,40 @@
 {
   description = "boxmaker: a sovereign personal agent harness";
 
-  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-26.05";
+    # The Rust toolchain, pinned below, independent of the host's nixpkgs release.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { self, nixpkgs }:
+    {
+      self,
+      nixpkgs,
+      rust-overlay,
+    }:
     let
       systems = [ "x86_64-linux" ];
       forAllSystems = nixpkgs.lib.genAttrs systems;
+      # nixpkgs with rust-overlay, and the one Rust toolchain every host uses (the workspace's
+      # `rust-version`): cargo, rustc, clippy and rustfmt.
+      pkgsFor =
+        system:
+        import nixpkgs {
+          inherit system;
+          overlays = [ rust-overlay.overlays.default ];
+        };
+      toolchainFor =
+        pkgs:
+        pkgs.rust-bin.stable."1.98.1".default.override {
+          extensions = [
+            "clippy"
+            "rustfmt"
+          ];
+        };
       version =
         if self ? shortRev then
           self.shortRev
@@ -20,7 +47,12 @@
       packages = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
+          toolchain = toolchainFor pkgs;
+          rustPlatform = pkgs.makeRustPlatform {
+            cargo = toolchain;
+            rustc = toolchain;
+          };
           lib = pkgs.lib;
           # Only what the build reads: no target/, no .state/, no docs.
           src = lib.cleanSourceWith {
@@ -33,7 +65,7 @@
               rel == "Cargo.toml" || rel == "Cargo.lock" || rel == "crates" || lib.hasPrefix "crates/" rel;
           };
           # Every binary of the workspace: the roles, bxctl and toolkit.
-          boxmaker = pkgs.rustPlatform.buildRustPackage {
+          boxmaker = rustPlatform.buildRustPackage {
             pname = "boxmaker";
             inherit version src;
             cargoLock.lockFile = ./Cargo.lock;
@@ -57,15 +89,12 @@
       devShells = forAllSystems (
         system:
         let
-          pkgs = nixpkgs.legacyPackages.${system};
+          pkgs = pkgsFor system;
         in
         {
           default = pkgs.mkShell {
             nativeBuildInputs = [
-              pkgs.cargo
+              (toolchainFor pkgs)
-              pkgs.rustc
-              pkgs.clippy
-              pkgs.rustfmt
               pkgs.cargo-deny
               pkgs.gnumake
             ];