feat(xatu): scaffold project

Add the Xatu Rust package as a minimal hello-world skeleton with Cargo workspace metadata and Bazel library, binary, and test targets.

Include the Statix and Deadnix evaluation notes so the new linter work starts with the prior rule and architecture research.

AGENTS.md

@@ -98,14 +98,9 @@
 - Rust tests in this monorepo live in separate `*_test.rs` files, not inline `#[cfg(test)]` modules.
 - Ariadne Rust tests are declared in Bazel `BUILD` files; do not add `[[test]]` entries to
   `src/ariadne/Cargo.toml` unless explicitly requested.
-- Rust package validation in this monorepo uses Bazel `rust_test` targets.
-  Do not claim or require `cargo test` as the standard Rust validation path unless explicitly requested.
 - In this monorepo, "dotfiles" refers to the dotfiles/NixOS configuration under `src/dotfiles/` and `configs/nixos/`.
 - The flake does not currently define `formatter.x86_64-linux`.
   Do not use `nix fmt` as a validation command until a formatter is added.
-- Keep `third_party/**` excluded from treefmt.
-  Vendored code can contain syntax fixtures, generated files, or upstream formatting that local
-  formatters must not rewrite.
 - Ariadne extraction must preserve the game-root season prefix for archived source.
   Different game installs can contain compiled scripts with the same internal path.
 - Clew owns Ren'Py extraction, preparation, and compiled-script AST export. Ariadne owns analysis over Clew-produced data.
@@ -119,5 +114,3 @@
   Do not use `git subtree add` or `git subtree pull` for Pi PR branches.
   Gitea rebases the synthetic upstream root commit without the `third_party/pi` prefix.
   Preserve `git-subtree-dir` and `git-subtree-split` trailers on Pi vendor commits.
-- `rules_rust` `crates_vendor` can vendor direct crate specs through the `packages` attribute.
-  Do not create a placeholder Rust package only to anchor a future vendored dependency.

src/dotfiles/apps.nix

@@ -15,9 +15,14 @@ in
         name = "fix";
         runtimeInputs = [
           formatter
+          pkgs.statix
+          pkgs.deadnix
         ];
         text = ''
           treefmt
+          statix fix .
+          deadnix --edit --exclude configs/nixos/hosts/*/hardware-configuration.nix -- .
+          treefmt
         '';
       }
     );

src/dotfiles/formatter.nix

@@ -6,6 +6,5 @@ inputs.treefmt-nix.lib.evalModule inputs.nixpkgs.legacyPackages.${system} {
 
   settings.formatter.nixfmt.excludes = [
     "configs/nixos/hosts/*/hardware-configuration.nix"
-    "third_party/**"
   ];
 }

src/dotfiles/registry.nix

@@ -4,26 +4,211 @@
   root,
 }:
 let
-  definitionModule = import ./registry/definition-module.nix { inherit lib; };
+  checkType = lib.types.submodule {
+    options = {
+      assertion = lib.mkOption {
+        type = lib.types.functionTo lib.types.bool;
+        description = ''
+          Predicate run against this registry's flattened collected entries.
+        '';
+      };
 
-  definitions = import ./registry/definitions.nix {
+      message = lib.mkOption {
-    inherit lib root;
+        type = lib.types.str;
-    inherit (definitionModule) registryDefinitionModule registryLib;
+        description = ''
+          Error message shown when this registry validation check fails.
+        '';
+      };
+    };
   };
 
-  registryOption = import ./registry/options.nix { inherit lib; };
+  predicates = {
-
+    uniqueValue =
-  collection = import ./registry/collect.nix {
+      value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
-    inherit definitions lib;
   };
 
-  validation = import ./registry/validation.nix {
+  registryLib = lib // {
-    inherit definitions lib;
+    registry = (lib.registry or { }) // {
+      inherit predicates;
+    };
   };
 
-  operations = import ./registry/operations.nix {
+  registryDefinitionModule = {
-    inherit definitions lib;
+    options = {
+      type = lib.mkOption {
+        type = lib.types.raw;
+        description = ''
+          NixOS option type for one registry entry.
+        '';
+      };
+
+      replicate = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether collected entries are merged and published under every host key.
+        '';
+      };
+
+      checks = lib.mkOption {
+        type = lib.types.listOf checkType;
+        default = [ ];
+        description = ''
+          Validation checks for this registry's flattened collected entries.
+        '';
+      };
+    };
   };
+
+  registryName = fileName: lib.removeSuffix ".nix" fileName;
+
+  registryOption =
+    registry:
+    lib.mkOption {
+      type = lib.types.attrsOf (lib.types.attrsOf registry.type);
+      default = { };
+      description = ''
+        Lazily collected fleet-visible registry entries, nested by host and entry name.
+      '';
+    };
+
+  mkRegistry =
+    path:
+    let
+      evaluated = lib.evalModules {
+        specialArgs.lib = registryLib;
+        modules = [
+          registryDefinitionModule
+          path
+        ];
+      };
+    in
+    {
+      inherit (evaluated.config) type replicate checks;
+    };
+
+  definitions =
+    lib.mapAttrs'
+      (
+        name: _type:
+        let
+          path = root + "/${name}";
+        in
+        lib.nameValuePair (registryName name) (mkRegistry path)
+      )
+      (
+        lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".nix" name) (builtins.readDir root)
+      );
+
+  flattenRegistryEntries =
+    registryName: data:
+    lib.concatLists (
+      lib.mapAttrsToList (
+        host: entries:
+        lib.mapAttrsToList (entry: value: {
+          path = "registry.${registryName}.${host}.${entry}";
+          inherit host entry value;
+        }) entries
+      ) data
+    );
+
+  rawDeclarations =
+    registryName: hosts:
+    lib.mapAttrs (_hostName: host: host.config.registry.${registryName} or { }) hosts;
+
+  replicatedEntries =
+    registryName: raw:
+    let
+      entries = lib.concatLists (
+        lib.concatLists (
+          lib.mapAttrsToList (
+            _evalHost: hostDeclarations:
+            lib.mapAttrsToList (
+              hostName: declarations:
+              lib.mapAttrsToList (entryName: value: {
+                path = "registry.${registryName}.${hostName}.${entryName}";
+                inherit entryName value;
+              }) declarations
+            ) hostDeclarations
+          ) raw
+        )
+      );
+    in
+    lib.foldl' (
+      acc: entry:
+      if lib.hasAttr entry.entryName acc then
+        if acc.${entry.entryName}.value == entry.value then
+          acc
+        else
+          throw "conflicting replicated registry entry ${entry.path} does not match ${acc.${entry.entryName}.path}"
+      else
+        acc
+        // {
+          ${entry.entryName} = entry;
+        }
+    ) { } entries;
+
+  replicatedData =
+    registryName: hosts: raw:
+    let
+      entries = lib.mapAttrs (_entryName: entry: entry.value) (replicatedEntries registryName raw);
+    in
+    lib.mapAttrs (_hostName: _host: entries) hosts;
+
+  validationAssertions =
+    data:
+    lib.concatLists (
+      lib.mapAttrsToList (
+        registryName: registry:
+        let
+          entries = flattenRegistryEntries registryName data.${registryName};
+        in
+        map (check: {
+          assertion = check.assertion entries;
+          inherit (check) message;
+        }) registry.checks
+      ) definitions
+    );
+
+  assertValid =
+    data:
+    let
+      assertions = validationAssertions data;
+      failures = lib.filter (assertion: !assertion.assertion) assertions;
+    in
+    assert lib.assertMsg (lib.all (assertion: assertion.assertion) assertions) (
+      lib.concatMapStringsSep "\n" (assertion: assertion.message) failures
+    );
+    data;
+
+  join =
+    registry: host: entry:
+    lib.filterAttrs (_name: value: value != null) (
+      lib.mapAttrs (
+        registryName: _registry: (registry.${registryName}.${host} or { }).${entry} or null
+      ) definitions
+    );
+
+  collectData =
+    { hosts }:
+    let
+      raw = lib.mapAttrs (registryName: _registry: rawDeclarations registryName hosts) definitions;
+      data = lib.mapAttrs (
+        registryName: registry:
+        if registry.replicate or false then
+          replicatedData registryName hosts raw.${registryName}
+        else
+          lib.mapAttrs (hostName: host: host.config.registry.${registryName}.${hostName} or { }) hosts
+      ) definitions;
+    in
+    assertValid data;
+
+  withOperations =
+    registry:
+    registry
+    // {
+      join = host: entry: join registry host entry;
+    };
 in
 {
   types = lib.mapAttrs (_name: definition: definition.type) definitions;
@@ -32,11 +217,7 @@ in
     options.registry = lib.mapAttrs (_name: registryOption) definitions;
   };
 
-  collected = operations.withOperations (
+  collected = withOperations (collectData {
-    validation.assertValid (
+    inherit hosts;
-      collection.collectData {
+  });
-        inherit hosts;
-      }
-    )
-  );
 }

src/dotfiles/registry/collect.nix

@@ -1,67 +0,0 @@
-{ definitions, lib }:
-let
-  rawDeclarations =
-    registryName: hosts:
-    lib.mapAttrs (_hostName: host: host.config.registry.${registryName} or { }) hosts;
-
-  replicatedEntries =
-    registryName: raw:
-    let
-      entries = lib.concatLists (
-        lib.concatLists (
-          lib.mapAttrsToList (
-            _evalHost: hostDeclarations:
-            lib.mapAttrsToList (
-              hostName: declarations:
-              lib.mapAttrsToList (entryName: value: {
-                path = "registry.${registryName}.${hostName}.${entryName}";
-                inherit entryName value;
-              }) declarations
-            ) hostDeclarations
-          ) raw
-        )
-      );
-    in
-    lib.foldl' (
-      acc: entry:
-      if lib.hasAttr entry.entryName acc then
-        if acc.${entry.entryName}.value == entry.value then
-          acc
-        else
-          throw "conflicting replicated registry entry ${entry.path} does not match ${acc.${entry.entryName}.path}"
-      else
-        acc
-        // {
-          ${entry.entryName} = entry;
-        }
-    ) { } entries;
-
-  replicatedData =
-    registryName: hosts: raw:
-    let
-      entries = lib.mapAttrs (_entryName: entry: entry.value) (replicatedEntries registryName raw);
-    in
-    lib.mapAttrs (_hostName: _host: entries) hosts;
-
-  collectData =
-    { hosts }:
-    let
-      raw = lib.mapAttrs (registryName: _registry: rawDeclarations registryName hosts) definitions;
-      data = lib.mapAttrs (
-        registryName: registry:
-        if registry.replicate or false then
-          replicatedData registryName hosts raw.${registryName}
-        else
-          lib.mapAttrs (hostName: host: host.config.registry.${registryName}.${hostName} or { }) hosts
-      ) definitions;
-    in
-    data;
-in
-{
-  inherit
-    collectData
-    rawDeclarations
-    replicatedData
-    replicatedEntries
-    ;
-}

src/dotfiles/registry/definition-module.nix

@@ -1,66 +0,0 @@
-{ lib }:
-let
-  checkType = lib.types.submodule {
-    options = {
-      assertion = lib.mkOption {
-        type = lib.types.functionTo lib.types.bool;
-        description = ''
-          Predicate run against this registry's flattened collected entries.
-        '';
-      };
-
-      message = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          Error message shown when this registry validation check fails.
-        '';
-      };
-    };
-  };
-
-  predicates = {
-    uniqueValue =
-      value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
-  };
-
-  registryLib = lib // {
-    registry = (lib.registry or { }) // {
-      inherit predicates;
-    };
-  };
-
-  registryDefinitionModule = {
-    options = {
-      type = lib.mkOption {
-        type = lib.types.raw;
-        description = ''
-          NixOS option type for one registry entry.
-        '';
-      };
-
-      replicate = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether collected entries are merged and published under every host key.
-        '';
-      };
-
-      checks = lib.mkOption {
-        type = lib.types.listOf checkType;
-        default = [ ];
-        description = ''
-          Validation checks for this registry's flattened collected entries.
-        '';
-      };
-    };
-  };
-in
-{
-  inherit
-    checkType
-    predicates
-    registryDefinitionModule
-    registryLib
-    ;
-}

src/dotfiles/registry/definitions.nix

@@ -1,35 +0,0 @@
-{
-  lib,
-  registryDefinitionModule,
-  registryLib,
-  root,
-}:
-let
-  registryName = fileName: lib.removeSuffix ".nix" fileName;
-
-  mkRegistry =
-    path:
-    let
-      evaluated = lib.evalModules {
-        specialArgs.lib = registryLib;
-        modules = [
-          registryDefinitionModule
-          path
-        ];
-      };
-    in
-    {
-      inherit (evaluated.config) type replicate checks;
-    };
-in
-lib.mapAttrs'
-  (
-    name: _type:
-    let
-      path = root + "/${name}";
-    in
-    lib.nameValuePair (registryName name) (mkRegistry path)
-  )
-  (
-    lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".nix" name) (builtins.readDir root)
-  )

src/dotfiles/registry/operations.nix

@@ -1,20 +0,0 @@
-{ definitions, lib }:
-let
-  join =
-    registry: host: entry:
-    lib.filterAttrs (_name: value: value != null) (
-      lib.mapAttrs (
-        registryName: _registry: (registry.${registryName}.${host} or { }).${entry} or null
-      ) definitions
-    );
-
-  withOperations =
-    registry:
-    registry
-    // {
-      join = host: entry: join registry host entry;
-    };
-in
-{
-  inherit join withOperations;
-}

src/dotfiles/registry/options.nix

@@ -1,9 +0,0 @@
-{ lib }:
-registry:
-lib.mkOption {
-  type = lib.types.attrsOf (lib.types.attrsOf registry.type);
-  default = { };
-  description = ''
-    Lazily collected fleet-visible registry entries, nested by host and entry name.
-  '';
-}

src/dotfiles/registry/validation.nix

@@ -1,47 +0,0 @@
-{ definitions, lib }:
-let
-  flattenRegistryEntries =
-    registryName: data:
-    lib.concatLists (
-      lib.mapAttrsToList (
-        host: entries:
-        lib.mapAttrsToList (entry: value: {
-          path = "registry.${registryName}.${host}.${entry}";
-          inherit host entry value;
-        }) entries
-      ) data
-    );
-
-  validationAssertions =
-    data:
-    lib.concatLists (
-      lib.mapAttrsToList (
-        registryName: registry:
-        let
-          entries = flattenRegistryEntries registryName data.${registryName};
-        in
-        map (check: {
-          assertion = check.assertion entries;
-          inherit (check) message;
-        }) registry.checks
-      ) definitions
-    );
-
-  assertValid =
-    data:
-    let
-      assertions = validationAssertions data;
-      failures = lib.filter (assertion: !assertion.assertion) assertions;
-    in
-    assert lib.assertMsg (lib.all (assertion: assertion.assertion) assertions) (
-      lib.concatMapStringsSep "\n" (assertion: assertion.message) failures
-    );
-    data;
-in
-{
-  inherit
-    assertValid
-    flattenRegistryEntries
-    validationAssertions
-    ;
-}

statix.toml

@@ -0,0 +1,3 @@
+disabled = [
+  "repeated_keys",
+]