{
  description = "boxmaker: a sovereign personal agent harness";

  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";

  outputs =
    { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" ];
      forAllSystems = nixpkgs.lib.genAttrs systems;
      version =
        if self ? shortRev then
          self.shortRev
        else if self ? dirtyShortRev then
          self.dirtyShortRev
        else
          "dev";
    in
    {
      packages = forAllSystems (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
          lib = pkgs.lib;
          # Only what the build reads: no target/, no .state/, no docs.
          src = lib.cleanSourceWith {
            src = ./.;
            filter =
              path: type:
              let
                rel = lib.removePrefix (toString ./. + "/") (toString path);
              in
              rel == "Cargo.toml" || rel == "Cargo.lock" || rel == "crates" || lib.hasPrefix "crates/" rel;
          };
          # Every binary of the workspace: the roles, bxctl and toolkit.
          boxmaker = pkgs.rustPlatform.buildRustPackage {
            pname = "boxmaker";
            inherit version src;
            cargoLock.lockFile = ./Cargo.lock;
            # The tests run in `make gate`: they need Unix sockets under /tmp and scripts they write
            # and run, which the build sandbox is not checked to allow.
            doCheck = false;
            meta = {
              description = "a sovereign personal agent harness";
              mainProgram = "bxctl";
            };
          };
          # The image every tool container runs from; see the file for how it is loaded.
          tools-image = import ./deploy/tools-image.nix { inherit pkgs; };
        in
        {
          inherit boxmaker tools-image;
          default = boxmaker;
        }
      );

      devShells = forAllSystems (
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        {
          default = pkgs.mkShell {
            nativeBuildInputs = [
              pkgs.cargo
              pkgs.rustc
              pkgs.clippy
              pkgs.rustfmt
              pkgs.cargo-deny
              pkgs.gnumake
            ];
          };
        }
      );
    };
}