experiment: reconstruct Buck product in Nix

[schickling-assistant]

Problem

nix/buck2-products/default.nix can only fetch published release assets. A missing product therefore hard-blocks a Nix consumer even when the repository contains a buildable Buck target.

Goal

Collect evidence, without making an infrastructure decision, about whether normal sandboxed Nix can reconstruct a real Buck JavaScript product from filtered source and prefetched inputs.

Decisions

None. This is an experiment for reframed q44 (2026-09-19).

The prototype selects oxc-config, the smallest product in the checked-in manifest, and exposes .#oxc-config-from-source. It projects the existing prepared pnpm FOD and Bun closure into a copied Buck tree, then runs pinned Buck2 local-only with remote caching disabled.

Verification

• buck2-heavy.sh -- nix build -L .#oxc-config-from-source --no-link --print-out-paths — succeeded in the normal Nix sandbox; 3 local actions, 0 cached, 0 remote.
• axe vrs check --profile strict context/buck2 — ok.
• Reconstructed current-tree output: 64,565 bytes, SHA-256 fd5b505b4056d373cd99b4d1264a3f79774381faa9cd06d1b4cb4bcef1ccf03a.
• Published manifest artifact: 64,568 bytes, SHA-256 f300c5d6e2faf51f432895a0e74d87e6d76bca1140ad07b31efb887c5d2d78be.

Complexity

Adds one deliberately narrow derivation, one flake package output, and one strict-checked experiment record. It does not alter the production importer or Buck graph.

Concerns

The two artifacts differ only in one generated identifier (localName versus localName2), but the publication descriptor has no producer commit and the checked-in manifest predates relevant package/bundler changes. A same-commit byte-equivalence claim is therefore not currently testable from publication metadata.

The adapter is target-specific: it removes the prepared workspace self-link and patches one generated dependency-view label. It is evidence for feasibility, not a general fallback implementation.

Friction & bottlenecks

Buck initializes an HTTP client even with remote use disabled, so the Nix sandbox's /no-cert-file.crt poison required an explicit declared CA bundle. Buck's project ignore also hides directories named node_modules, requiring the immutable prepared tree to be projected under a non-ignored name.

Follow-ups

• Add producer-commit provenance before requiring same-commit artifact comparison.
• If q44 selects a fallback, generalize dependency-tree projection rather than adding per-target patches.
• Keep Snowydeer as complementary Buck-to-Nix export prior art; it does not replace a Nix source recipe.

References

• Experiment: context/buck2/.experiments/2026-09-19-nix-reconstruction-from-source.md
• Mercury Snowydeer
• Tweag buck2.nix

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.t3mkm4sd
session	unknown
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.14
agent_runtime	OMP 18.1.14
tooling_profile	dotfiles@5d1e05f

[schickling-assistant]

Superseded: this prototype's code moves into #1321 (P1, generalized mkBuckProductFromSource) after #1283 removed the plugin-bundle FOD it depended on; the experiment record is carried by #1319. Closing per decision q52 (2026-09-20).

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.t3mkm4sd
session	unknown
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.14
agent_runtime	OMP 18.1.14
tooling_profile	dotfiles@5d1e05f